{
    "export_type": "scanapse_public_evidence",
    "schema_version": "2.0",
    "engine_version": "3.0.0-rc.3",
    "pattern_version": "2026.09.4",
    "scan_id": "0b1454327c070712bf392b2b",
    "domain": "sheettolabel.com",
    "scanned_at": "2026-09-20T19:35:04+00:00",
    "evidence_count": 57,
    "evidence": [
        {
            "id": "08ebdd5c82008e5591ed87f1db5ac70d7fe14d4da894ae76943c17338782bd1b",
            "evidence_type": "module_finding",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "005c8fe4d4554dde87eb8e251486d988c2cf4fbf963fcca7d7fc98019d918581"
            ],
            "excerpt": {
                "evidence": null,
                "severity": "medium"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "681c626dab8e6968b13eebace4cf2e8cd16ce69fa16952870042253bf8f1b02c",
            "evidence_type": "tls_issuer",
            "collector": "tls",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "0189cd7d2a5db65541084e83618c255a0845bfc888cdaa767df261e5d789ba06"
            ],
            "excerpt": "C = US, O = Let's Encrypt, CN = YE2",
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "3dfe5324710860c117ecc4ba68defc046354001ea971b85b28be7160d88be045",
            "evidence_type": "module_finding",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "06f6f4790996326dd8c18e17f344ce0ce7b9fa04a8006acf424fec8c02521ab8"
            ],
            "excerpt": {
                "evidence": null,
                "severity": "medium"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "367ee838f60568aaca6f0dae20070bff97b196cd28613c6eeadcec45ac4ac4cb",
            "evidence_type": "module_finding",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "08d86b8ec1e3e4e2a5df12fc36f93971234c0d2b994d5f1ccf4cfb2627f52243"
            ],
            "excerpt": {
                "evidence": null,
                "severity": "low"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "5b88c46a757112806d77de9f23a6deca0ba523faaaf5dcc43dc0b4ac143384ad",
            "evidence_type": "openpgp_discovery",
            "collector": "openpgp_discovery",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "13b1ace849aa2324ad80cecf3a5e0b2913d08c9e16d4628037b750b6bc88ebfd"
            ],
            "excerpt": {
                "dns_openpgpkey": {
                    "reason": "recipient_identity_required",
                    "state": "untested"
                },
                "fingerprint": null,
                "mechanisms": [],
                "reason": "security_txt_encryption_not_observed",
                "state": "not_observed",
                "wkd": {
                    "reason": "wkd_not_fetched_without_identity",
                    "state": "untested"
                }
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "9c38bd55a570fa7b4c378fbdc77f23da7df2506091431118e7f0963d5ec95a0d",
            "evidence_type": "dns_nameserver",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "18ded4947bbc830e5e439a60dd40e42b6e5eeaa5744bfb79fd991c7b079fd768"
            ],
            "excerpt": "dns1.registrar-servers.com",
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "d04bdd6234331426f87a94a62d5332db0829a3717cf21a551bda2d640c6f7cb6",
            "evidence_type": "dependency_provider",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "247e87c5593f49b53ec24b90a27b9a8ad0c40c99039f83621ab50b497863492f"
            ],
            "excerpt": {
                "critical": false,
                "hosts": [
                    "eforward3.registrar-servers.com"
                ],
                "id": "host-f04fe961f4f4",
                "known": false,
                "name": "eforward3.registrar-servers.com",
                "observation_count": 1,
                "services": [
                    "unknown"
                ],
                "tracker": false
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "daf7ca5638f8c168cd454ada6c69786f1ac70637ded6ef74672bdc11007a0746",
            "evidence_type": "spf_policy",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "28b51cd7a80e8fd0426bb0791087294b0758666040cc15f7102a0acb167f2bd2"
            ],
            "excerpt": "softfail",
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "94e3b09e06e6f2b3e0b6f28564eba76080716cf23f18dd94c2eeb594d7a815aa",
            "evidence_type": "modern_transport_evidence",
            "collector": "modern_transport",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "2abb8d011b4541e585a85a0f718bc2f8e97da7b946243cbd18ae7f4b1168615e"
            ],
            "excerpt": {
                "alpn": {
                    "state": "untested",
                    "value": ""
                },
                "certificate": {
                    "cipher": "",
                    "issuer": "C = US, O = Let's Encrypt, CN = YE2",
                    "protocol": "",
                    "san_count": 0,
                    "state": "observed",
                    "valid_from": "2026-08-30T23:22:50+00:00",
                    "valid_to": "2026-11-28T23:22:49+00:00"
                },
                "http2": {
                    "negotiated": "2",
                    "state": "observed"
                },
                "http3_advertised": {
                    "alt_svc": "",
                    "state": "not_observed"
                },
                "ipv4": {
                    "addresses": [
                        "16.170.233.91"
                    ],
                    "state": "observed"
                },
                "ipv6": {
                    "addresses": [],
                    "state": "not_observed"
                }
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "1513dea231803de18deb20fd0351c418b95759eb1ba13be8c3fe71cecd3b2844",
            "evidence_type": "mail_policy_flag",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "2bddde707d2718c5e236c517c1585bb5d9610fbcc5b0fc47db159fdc65c80e9b"
            ],
            "excerpt": false,
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "7ad3530ea316946b485a4bb3d8ae048af103d06787d1e8a3881504ff0114344f",
            "evidence_type": "module_finding",
            "collector": "technology",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "3a77bc59bb1416a4a1342e7f4349cfc46891db8c1dceea950dcd21057e273ea6"
            ],
            "excerpt": {
                "evidence": [
                    "nginx/1.28.3 (Ubuntu)"
                ],
                "severity": "medium"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "b355d0451a9fc31ed0649eb400b8a772b2653ca2b6b448e7335e3e432e7e7958",
            "evidence_type": "module_finding",
            "collector": "resilience",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "3fbacbba4200199be30eafc8ac31e31a73d7162f2eece695ec8b2b9cb35a10bd"
            ],
            "excerpt": {
                "evidence": [
                    "dns1.registrar-servers.com",
                    "dns2.registrar-servers.com"
                ],
                "severity": "medium"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "341ad4a2d176ed1530e54fda2314bff2f38954f393d4128a1373d9f7cd9c53e2",
            "evidence_type": "mail_exchanger",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "416e431767ea68497ba490a5d837472c299d9465452ed5078f77bdc58c1458a1"
            ],
            "excerpt": "eforward2.registrar-servers.com",
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "63e720ad47104adad0b7cafb8b75175394dfda4506b403285506acadef9514bc",
            "evidence_type": "module_finding",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "41db5da0178da6882493ef37a9a1f9b5b35d2f7b2da26f73dede4db52cf8e59b"
            ],
            "excerpt": {
                "evidence": null,
                "severity": "low"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "dc17bce278738f51c1ebb4f4f1c39601d440ba8b71e5cb03b07183ed9a0e135a",
            "evidence_type": "mail_exchanger",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "4cf08249e0bd5abffdcdcdcff99b7dd250bb5ff78685b4f183b4bdaf0948bf3c"
            ],
            "excerpt": "eforward1.registrar-servers.com",
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "58eca9ed435c783ca13077e2b4cedbfeafb62600658fd379ffd84b0cea3dca04",
            "evidence_type": "mail_exchanger",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "50061552e1a7d86b58f393d3ae69cb72e76e6ea109d5778bbf1971732a3e3afb"
            ],
            "excerpt": "eforward3.registrar-servers.com",
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "0323d51370c20c2ada7ab4720f201881187725961a55d1541997aa65c226b6a1",
            "evidence_type": "csp_evidence",
            "collector": "csp_depth",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "50d00dd429955cbc53ebe0640fdb7df629a7af6d2f7f43276f6c99f64c68e379"
            ],
            "excerpt": {
                "enforced": false,
                "frame_ancestors": false,
                "hash_present": false,
                "nonce_present": false,
                "object_src": false,
                "report_only": false,
                "reporting_endpoint": false,
                "state": "not_observed",
                "strict_dynamic": false,
                "trusted_types": false
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "9c25ea4a38e92c92221bae5556b4540d3ee4110ea37b0f51bf161a68257be3e6",
            "evidence_type": "dependency_provider",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "57fb007c4180397249608d2e34a8134d006bc37eb7a38c64d1d44aa4700b9a52"
            ],
            "excerpt": {
                "critical": false,
                "hosts": [
                    "eforward1.registrar-servers.com"
                ],
                "id": "host-d94f6d23f2bd",
                "known": false,
                "name": "eforward1.registrar-servers.com",
                "observation_count": 1,
                "services": [
                    "unknown"
                ],
                "tracker": false
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "1ff0d81512a85e5d631625de6fe281853b40c4b5f54d4727d9949fa252ebe41c",
            "evidence_type": "module_finding",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "5ba744a83f3a0f26e10cdcae3f11cd610f3f8e9c5e0d64cb38d47c64df8533bd"
            ],
            "excerpt": {
                "evidence": null,
                "severity": "critical"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "73f2c4eeaeb293fce659f0de014561c83d9ba23029640840ffbe7bc3701edc6a",
            "evidence_type": "module_finding",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "5c63c338f8f5df8e6486acacf341634f7b5a131af2894a7d198a1977c3208f7a"
            ],
            "excerpt": {
                "evidence": [
                    "dns1.registrar-servers.com",
                    "dns2.registrar-servers.com",
                    "eforward1.registrar-servers.com",
                    "eforward2.registrar-servers.com",
                    "eforward3.registrar-servers.com",
                    "eforward4.registrar-servers.com",
                    "eforward5.registrar-servers.com"
                ],
                "severity": "medium"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "3da22ceed3d836ca6861140ef254d9fdfce835479459cf178183b9b0890dc302",
            "evidence_type": "module_finding",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "5efd9f559424c8744f07824bca93cd5d5f99722433342016f36f7e54fa0b08ab"
            ],
            "excerpt": {
                "evidence": [
                    "dns1.registrar-servers.com",
                    "dns2.registrar-servers.com",
                    "eforward1.registrar-servers.com",
                    "eforward2.registrar-servers.com",
                    "eforward3.registrar-servers.com",
                    "eforward4.registrar-servers.com",
                    "eforward5.registrar-servers.com"
                ],
                "severity": "medium"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "ef17fd6518ca8fe80a34faa1088b3db46150e1e524f57acaafa960c17a057b4d",
            "evidence_type": "module_finding",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "62e5189eacaa045ae4f58dd91facd885dddcc833644cd8382d0d02a29a5f38bf"
            ],
            "excerpt": {
                "evidence": null,
                "severity": "low"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "44ad1cd2a35cc103aeb1b09f370d677ab1d91f52032059453476e01878e4398d",
            "evidence_type": "module_finding",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "685a25741accf43b116b4ebb5904e334d36979372e10a8a2c2367e1b1c8525b1"
            ],
            "excerpt": {
                "evidence": null,
                "severity": "medium"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "20dd7572679e416ab76f673748a82325913d34fa6f28a0d4918c1be8b1fd4e48",
            "evidence_type": "module_finding",
            "collector": "resilience",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "6bc52d8f040dfc613191ccf8f948adc4af01c3409664fb2d2b4b18b4bfd358a6"
            ],
            "excerpt": {
                "evidence": [
                    "16.170.233.91"
                ],
                "severity": "info"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "24c205cc031af4954018f5c492de43695824c5bd0f6f685182111fba7986bca8",
            "evidence_type": "dependency_provider",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "6d0c1a93013ac9dc6e90c9aa08e0b956aedcd5a861e18fff9b50ed8c835e10c6"
            ],
            "excerpt": {
                "critical": true,
                "hosts": [
                    "dns1.registrar-servers.com"
                ],
                "id": "host-58454878a030",
                "known": false,
                "name": "dns1.registrar-servers.com",
                "observation_count": 1,
                "services": [
                    "unknown"
                ],
                "tracker": false
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "16c58717d2f5a1763b8fcc9ef25f0cfd4ffee648e68ed6334e28eb5ca918609a",
            "evidence_type": "dependency_provider",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "6dc30fad9621ff41d1ab78ed120e9f4c359674b1e5e400efe3687250f696ee67"
            ],
            "excerpt": {
                "critical": false,
                "hosts": [
                    "eforward2.registrar-servers.com"
                ],
                "id": "host-8b34d525a90c",
                "known": false,
                "name": "eforward2.registrar-servers.com",
                "observation_count": 1,
                "services": [
                    "unknown"
                ],
                "tracker": false
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "49f446e06adb1a38177730303f2e8478408536bc4060c9dd7dc4e36d9f1e94d0",
            "evidence_type": "module_finding",
            "collector": "transparency",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "6e687885ae2f009e928b701042a1767ce71615dc96a9b179ae0a50242ada0656"
            ],
            "excerpt": {
                "evidence": null,
                "severity": "low"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "fe4de6a7415464b4ba3e1122c579505e7eedf027ffa27d54cdcc963e7526c983",
            "evidence_type": "module_finding",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "7de2c8e6ea8c128b0923df9cf316eb5a71d07dd2b7d72b80fc5ea59333428c25"
            ],
            "excerpt": {
                "evidence": null,
                "severity": "low"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "2c31055c7e51ccfd6ea601c1ce93e984df6d2b0a444fcbf5bd5e831d122f12b3",
            "evidence_type": "dependency_provider",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "7e18c4405adb44ceadd3f4e7264c8052bbc02914f9133ee6a94eba1981817631"
            ],
            "excerpt": {
                "critical": false,
                "hosts": [
                    "eforward4.registrar-servers.com"
                ],
                "id": "host-9701b83eb7ac",
                "known": false,
                "name": "eforward4.registrar-servers.com",
                "observation_count": 1,
                "services": [
                    "unknown"
                ],
                "tracker": false
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "3d5127a193ff262917c3e8dab4174de949f0809b0d6560e20c73fb8b4ea4ca16",
            "evidence_type": "post_quantum_tls",
            "collector": "pq_tls_probe",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "8051b6c031f90165052ea68c9a13e924d46fd30d87602946e24f6d8ddbb7fcbc"
            ],
            "excerpt": {
                "capability": {
                    "capable": false,
                    "groups": [],
                    "reason": "proc_open_unavailable"
                },
                "group": null,
                "reason": "client_capability_unavailable",
                "state": "untested"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "ae742bbed0c32f2d37d80eae9195cf6e3f93f272a7f0074c27723d07563718e3",
            "evidence_type": "module_finding",
            "collector": "transparency",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "81b059e64bf21112c4058589e3ae2defb8edf79ca325afd8442c73d536278fa1"
            ],
            "excerpt": {
                "evidence": null,
                "severity": "low"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "34cacd89be66c17055b5512585b8bd4db9fe27083fea6975ce1b43a77d8868f9",
            "evidence_type": "module_finding",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "82b4ceba8cab5db2a177d37494eae0508609d79393e4a6f0cdbb5a4f1e3626eb"
            ],
            "excerpt": {
                "evidence": null,
                "severity": "high"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "e94a32d341292f57115578c776376c4b49df57abf7889838500cbc588c56233c",
            "evidence_type": "module_finding",
            "collector": "transparency",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "8d02b70471d6e69bf81691c06389214dc0e4c372ccc01dc207362def428cf471"
            ],
            "excerpt": {
                "evidence": 200,
                "severity": "medium"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "c3d61588cb90a09fb36d0d67ff3e52b9dedb632aecb5957e4d88b83ad885258a",
            "evidence_type": "mail_exchanger",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "91774b4a8521323b517f92a985392c815c53d917124e1700935d8815390c9113"
            ],
            "excerpt": "eforward5.registrar-servers.com",
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "150a241b2b5f19e9714bacfda05f1e3a22e12af64a33b1ce6b1a54c04fce06bc",
            "evidence_type": "module_finding",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "9a48035ace809e0524fadf4cc3006c75df5c35e503a445fcba47bed280afc7f8"
            ],
            "excerpt": {
                "evidence": null,
                "severity": "high"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "1b9c6135f6c808f10e6b39f9bbde0b5585e99fe6df6a6e586f74d22cbc52028b",
            "evidence_type": "module_finding",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "9c78ec050ecde772225f095d0e43464a24e64020ac3c348c3dc31287f75a94f7"
            ],
            "excerpt": {
                "evidence": null,
                "severity": "high"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "8dbdaf32cafba598ee010283238462871f9d0eed403abcd01ff549c0d52588e3",
            "evidence_type": "http_header",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "9ddc12b4ab7430209567648b46cde7c95b760b4594471789154e0babc76ea203"
            ],
            "excerpt": [
                "nginx/1.28.3 (Ubuntu)"
            ],
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "fff54af29a2d8c46280af9211c82cb1ed31e90d4bc130f47fc2d7255ca641865",
            "evidence_type": "dependency_provider",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "a392475216ec71ebff05e1ed36f72532eaaf6c896b2f8c506d3b91cac815b851"
            ],
            "excerpt": {
                "critical": false,
                "hosts": [
                    "eforward5.registrar-servers.com"
                ],
                "id": "host-21014ef403c1",
                "known": false,
                "name": "eforward5.registrar-servers.com",
                "observation_count": 1,
                "services": [
                    "unknown"
                ],
                "tracker": false
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "d79790912608d0df3e19c39615406d08e576ca954c18dd6086d0fc7252b9089b",
            "evidence_type": "dns_nameserver",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "a3dbea0a68d1d557bc823ee566c1da9ad634aa939af15c7c480ce72bd266ae72"
            ],
            "excerpt": "dns2.registrar-servers.com",
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "af050c795f15982c61fe7cf4c638d77472181ebca3e8ffa3c42cf0fadcb2fc32",
            "evidence_type": "dns_address",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "a88ce633dc83374b679cfcdfd67109927788070cfae4fb628b478ebb5ba3ab60"
            ],
            "excerpt": "16.170.233.91",
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "44e208b79a3af7cbf4c80778bd5455aac370c5775d7e085aaeb145ae02ff1aa6",
            "evidence_type": "module_finding",
            "collector": "headers",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "a91e8031dfe25cc8d76f4adeeaeb0cc8f1c3db842904ac7f9b4894eef0edbb74"
            ],
            "excerpt": {
                "evidence": null,
                "severity": "info"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "5e95670351512079fe097395c3bc9956605720cc8eb0cbb5ed09226853dbd78b",
            "evidence_type": "dependency_provider",
            "collector": "dependencies",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "aa213b463e11d37d7faed8876e7c9136b6623292e7cd8335476623691aad1db6"
            ],
            "excerpt": {
                "critical": true,
                "hosts": [
                    "dns2.registrar-servers.com"
                ],
                "id": "host-455e1d6afdbf",
                "known": false,
                "name": "dns2.registrar-servers.com",
                "observation_count": 1,
                "services": [
                    "unknown"
                ],
                "tracker": false
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "f6f9c1d8ebd4366a1a033e90fbc2ecc114b8248216fde2146db3df4df42fa8e8",
            "evidence_type": "mail_policy_flag",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "b074d0af518fba1dcee16afed4e93f9392583154ba6ae4c4e24298b990af978d"
            ],
            "excerpt": false,
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "c15587c439122a059a54a885af47124634d3dc320864068599c23ba58b2aed86",
            "evidence_type": "module_finding",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "b7485d6d474e75f121555932b7bb2c45cb59405f45e6dfccba1c82ca3d27fa57"
            ],
            "excerpt": {
                "evidence": null,
                "severity": "low"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "b4abdcc8d3631716de2901119bea0dd3f07503b0ebafbcd4107c7a7ef3db4ebf",
            "evidence_type": "module_finding",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "bba62aed015e165f1e1e46ab7a4c927aee77440f656ca6c39ba28b515496bff7"
            ],
            "excerpt": {
                "evidence": {
                    "reason": "No external validating resolver is used; cryptographic validation is intentionally not inferred.",
                    "status": "not_tested"
                },
                "severity": "info"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "0c9b0a1b06d5b314f0a833f1576bd5126b240156c30f9a3bf5c2bcca30743d8e",
            "evidence_type": "canary_signal",
            "collector": "canary_passive",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "c2c4b1f231d342e231372bc0d92f21a96a9f3710e639d02dc8ebc25db6604527"
            ],
            "excerpt": {
                "matches": [],
                "reason": "no_known_passive_signature_observed",
                "signature_version": "2026.09.1",
                "state": "not_observed"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "675978d0842449a9c0bf11d1210e8526ee65a2f2da68d1f27a0d505df40e5125",
            "evidence_type": "tls_valid_to",
            "collector": "tls",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "c2f490e598fe6adca8565ec82459299cc6d2bd44e8f02573b7d7f4f05d6172d9"
            ],
            "excerpt": "2026-11-28T23:22:49+00:00",
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "60a33f524a377e993fc61f6cef12c6b8877dc309873847dbbc6064faa9ef972b",
            "evidence_type": "mail_policy_flag",
            "collector": "mail_trust",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "c4b9476e609050a8c752a78064e741f8158b6a970e14075b9281410d273e7e0c"
            ],
            "excerpt": false,
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "bbc108cab65337f01549f0725fa768161850fce05e76e7a7f68605e4c5c82426",
            "evidence_type": "module_finding",
            "collector": "sovereignty",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "c53c707a48f9a895227ebe8b9e5b6d37a23cde48d4c798eb2d86c863cd40f419"
            ],
            "excerpt": {
                "evidence": [
                    "dns1.registrar-servers.com",
                    "dns2.registrar-servers.com",
                    "eforward1.registrar-servers.com",
                    "eforward2.registrar-servers.com",
                    "eforward3.registrar-servers.com",
                    "eforward4.registrar-servers.com",
                    "eforward5.registrar-servers.com"
                ],
                "severity": "medium"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "14b6f72f1fe80e292c9ed07da25fc75768b1fbbd1e7826a96ede3d3f9c28d19a",
            "evidence_type": "module_finding",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "c6a27d8553623381b6fb3b4d3fa7cb1d7f809cf6ae90ebbe5a080b6a115db2ea"
            ],
            "excerpt": {
                "evidence": null,
                "severity": "low"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "8a91f190328d6c1c6797f715e0a0db774d3d801c08ec9bde4e028c7b85bd4916",
            "evidence_type": "mail_exchanger",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "dbfd2efd32f1f43a19fc8738d923e1af3a2856c72fbe9c7e36a86b968615e0d4"
            ],
            "excerpt": "eforward4.registrar-servers.com",
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "43fc5c53b08ad45d1dec86e5c63fb5f0087ee8952753e6dd461e40b762e05393",
            "evidence_type": "dnssec_evidence",
            "collector": "dnssec_depth",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "ddd0be1f18e58f6b9686d0f5f2f0fb96ab9fc3dd506d402e6a82358ece9ed52e"
            ],
            "excerpt": {
                "chain_consistency": {
                    "reason": "insufficient_record_evidence",
                    "state": "untested"
                },
                "dnskey": {
                    "query_supported": false,
                    "records": [],
                    "state": "untested"
                },
                "ds": {
                    "query_supported": false,
                    "records": [],
                    "state": "untested"
                },
                "validation": {
                    "reason": "no_validating_resolver",
                    "state": "untested"
                }
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "366c7c5dfd1f4e8b1040df90d4b75c23683846b4144bbebf479ebbd04cda2e8f",
            "evidence_type": "mail_transport_evidence",
            "collector": "mail_transport",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "e54076d5f26683198466d3c49fa04178d2d7896f5cec060bf6484a211dd81ae0"
            ],
            "excerpt": {
                "bimi": {
                    "records": [],
                    "state": "not_observed"
                },
                "dane_tlsa": {
                    "query_supported": false,
                    "reason": "tlsa_query_not_available",
                    "records": [],
                    "state": "untested"
                },
                "dkim": {
                    "reason": "no_selector_bruteforce",
                    "state": "untested"
                },
                "mta_sts": {
                    "policy": null,
                    "policy_state": "untested",
                    "records": [],
                    "state": "not_observed"
                },
                "tls_rpt": {
                    "records": [],
                    "state": "not_observed"
                }
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "2ac730606b88194ad9f7573ac3e5cc1e165e95329cc6aa0f25da1a38f7c34357",
            "evidence_type": "spf_record",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "eb0e94956b23a4d56e804bfab50e3a69ccd3c5b0d3d8a4c51c9cd63306927971"
            ],
            "excerpt": "v=spf1 include:spf.efwd.registrar-servers.com ~all",
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "34825c13d7c661c61231586d93c1df4237bd6b51e530e6d1d82fac1e92c7e287",
            "evidence_type": "module_finding",
            "collector": "dns",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "efd07e33c7e0a66dedb2027da1dd82bbe17d2bb395fdd551d7e2b8820e1349eb"
            ],
            "excerpt": {
                "evidence": [
                    "dns1.registrar-servers.com",
                    "dns2.registrar-servers.com"
                ],
                "severity": "low"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "5a5aedb82801373d72720230a7daa7243c7549ea01e45d007b05e093579bd619",
            "evidence_type": "module_finding",
            "collector": "transparency",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "f835e8464654bf09e01a61cc74a40c38139d0aabb9d29951c93bd9b8541996f9"
            ],
            "excerpt": {
                "evidence": null,
                "severity": "medium"
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        },
        {
            "id": "5188b8d763f48b5605a52467ad63b9d9c22444510e2b81b993d4245057523107",
            "evidence_type": "technology",
            "collector": "technology",
            "rule_version": "2026.09.4",
            "observation_ids": [
                "f954c82e5a734a75571fb37ef465f815833df03c6abbe820447cecc67cb4210c"
            ],
            "excerpt": {
                "name": "nginx/1.28.3 (Ubuntu)",
                "version": "",
                "version_exposed": true
            },
            "first_seen_at": "2026-09-20T19:35:04+00:00",
            "last_seen_at": "2026-09-20T19:35:04+00:00"
        }
    ],
    "methodology": {
        "model": "evidence_first",
        "version": "2.3.1",
        "principles": [
            "absence_of_evidence_is_not_evidence_of_absence",
            "unknown_remains_unknown",
            "provider_metadata_is_not_data_location",
            "edge_provider_is_not_origin_host",
            "single_snapshot_does_not_prove_resilience"
        ]
    }
}