OBSERVE · CONNECT · UNDERSTAND
FR EN
Read a domain

PUBLIC DOMAIN DOSSIER

0bla.com

What is observed, how to verify it and what changed

5 public observations are documented in this dossier.

2 structuring public dependencies are visible.

2 useful changes are retained since the previous reading.

2 points still require confirmation or cannot be observed from outside.

Measured 2026-09-04 22:03 UTC First observation 2026-09-04 19:31 UTC Latest observation 2026-09-04 22:03 UTC
History Compare JSON Markdown

TIME

What changed over time

Compared with the previous stored reading

0Appeared
2Modified
39Stable
0Disappeared
Modified

Http header

Modified

Module finding

SHORT VIEW

Four readings before the detail

The 12 historical angles remain available below for deeper inspection.

Identity & governance

  • ObservedDepends on providerCloudflare
  • Not observable from outsideOrigin host
  • Not testedCanary detection

Infrastructure & transport

  • ObservedTls issuerC = US, O = Let's Encrypt, CN = YE2
  • Not testedPost quantum tls

Mail & trust

  • ObservedDmarc policyreject
  • ObservedSpf policyhardfail

Dependencies & exposure

  • ObservedDepends on providerInfomaniak
  • Not observable from outsideData location

Explanatory record

What Scanapse understands about this domain

Scanapse has enough material to describe 11 of 12 knowledge angles for 0bla.com. 4 questions remain open with the available public evidence.

Measured on 2026-09-04 22:03 UTC Engine 2.6.2

Read the domain folder

The key points for reading this domain folder

Four key points to understand what Scanapse observed, what can reasonably be retained, and what still needs verification.

Key points

Worth looking at today

Only a few items are shown when they add something genuinely useful to the reading.

DEPENDENCIES

Critical function concentration

Cloudflare is associated with 3 critical function(s) or observations in the visible scope.

This concentration is descriptive. It does not prove a future outage or the absence of failover mechanisms invisible to the scan.

Territorial and legal context

Which legal context can reasonably be retained

Scanapse distinguishes established, probable and to-confirm jurisdiction and always explains which clues support the reading.

To confirm To confirm

Why this context appears

  • No sufficiently reliable public jurisdiction clue was found in the report

What this does not establish

  • Technical hosting, IP addresses, ASNs and CDN locations do not establish the applicable legal jurisdiction by themselves.
  • The applicable jurisdiction requires additional public or organisational evidence.

Regulatory frameworks

Useful texts for this context

References are selected from the observed context. Their presence explains potential relevance, never automatic compliance.

To confirmTo determine

Regulatory context to determine

The available public evidence does not establish a sufficiently reliable jurisdiction for automatic legal contextualisation.

This section provides documentary context. It is not legal advice, certification or a compliance verdict.

Trajectory

Useful changes since the previous reading

Only differences that help interpretation are highlighted. Stable or purely technical variations remain available in the evidence.

No significant change retained

The available comparison does not surface a change worth highlighting in the public reading.

12 knowledge angles

12 angles to understand the domain

Each angle explains what is known, why it matters, how to read it, its purpose and its limits.

01
Documented Change observed

Domain identity

Public evidence provides enough material to document this angle

Angle 01

Domain identity

Documented Change observed

Public evidence provides enough material to document this angle

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

24evidence
9changes
0open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
24
Signals
1
Changes
9
caa_record dns 88ad8c62903bd998f00bb720f5f43ccfb945b9bd9b3a3ccbf29df62328a7a597 
{
    "flags": 0,
    "tag": "issue",
    "value": "ssl.com"
}
dns_address dns 207f1b2c1ef93c9272920ea1a2e109a3cf02531185ac5b4653164d6db2fabdf1 
"2606:4700:3031::ac43:831e"
caa_record dns d43e5cde3fe6cf816545dc84a4a3bb7fbde32a48db22f62ae00e1c9027e5be8b 
{
    "flags": 0,
    "tag": "iodef",
    "value": "mailto:security@0bla.com"
}
module_finding dns d7169fed1697eea2b2342dd1aacf8b1ec8dd699fcf096e775e7455806d4f0fe3 
{
    "evidence": [
        "david.ns.cloudflare.com",
        "thea.ns.cloudflare.com"
    ],
    "severity": "low"
}
dns_address dns de033d871f02b262bf9935ed22c148d2b43b6cce9d9f22f40ea670386c7f6448 
"172.67.131.30"
caa_record dns 5e3e1e052d05d6230058755bd5d275af0105a4983e61202871fbb675544a89c8 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "pki.goog; cansignhttpexchanges=yes"
}
mail_exchanger dns 7b37751c85e01b43c68201673910aedaaf302200936008d6d1421d6d185d601d 
"mta-gw.infomaniak.ch"
caa_record dns bb5792415779adf9aae1cbd8b32de9e9132938c1ab8ae9090ff6541c7f9d1f95 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "ssl.com"
}
caa_record dns 8f9dc4bd6de6804762c744fbcf0b0e0e4c9588b17ce8ce4091110923fc8fce3f 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "letsencrypt.org"
}
module_finding dns 10761c231b097efd961779c8d2b92571b4e273bc515e35c8aeebf9ce85175491 
{
    "evidence": {
        "reason": "No external validating resolver is used; DS validation is intentionally not inferred.",
        "status": "not_tested"
    },
    "severity": "info"
}
caa_record dns ccdef8c7fb74aa33117385797c19bdaa7fbe8b2f18d38ff2441d73ecc8c8cedc 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "digicert.com; cansignhttpexchanges=yes"
}
caa_record dns 6b0c2c30edba58bdfe31ce5a794d5e4b0822a2b2db70bb2e18e584933f009d1e 
{
    "flags": 0,
    "tag": "issue",
    "value": "pki.goog; cansignhttpexchanges=yes"
}
caa_record dns ddf530c83b6c4327f0d5e274b8b375ec49abebf2df443881f5c5844ad0a23c56 
{
    "flags": 0,
    "tag": "issue",
    "value": "digicert.com; cansignhttpexchanges=yes"
}
caa_record dns 037f43d5216309eb9484949c2279c8859aabf22d171a5cbb4d8db072fae8c2e8 
{
    "flags": 0,
    "tag": "issue",
    "value": "sectigo.com"
}
dns_address dns c099f90048a3e5a61db9d52ebb13caf086f7f50cbab2c492dce69514be0a74d0 
"104.21.9.251"
dmarc_record dns 149e0762b4d1aef0ca24356cbdec1d5e744d64c8e802f7503e718dbb6e5de490 
"v=DMARC1; p=reject;"
caa_record dns 63f8b030f669d39f019fb867caec7a28532ce4831c40d252909046a3c8b84e6a 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "comodoca.com"
}
dns_nameserver dns ccfebcf15da5a47827204050350684ada8dd8899402e9b1c616bdcc40eeefccc 
"david.ns.cloudflare.com"
caa_record dns 2fe58c9ddf755f8e208dc5110e3a161a125ce466a0b39ed5f95fd80be46d65d5 
{
    "flags": 0,
    "tag": "issue",
    "value": "letsencrypt.org"
}
dns_address dns 648edc8155510db097dbcd3755bfc96f81f7eac7bc035edb2473d3f0c534aff2 
"2606:4700:3032::6815:9fb"
spf_record dns efb500af6db39365bf96852e04c914f70f4c2d094686882c00d67e4523eaad71 
"v=spf1 include:spf.infomaniak.ch -all"
caa_record dns 1026f34962c595ee1b6a9391fe509ab38e7574202f94cda7da9f441c06fd5db5 
{
    "flags": 0,
    "tag": "issue",
    "value": "comodoca.com"
}
dns_nameserver dns 1c5cf97fe6ac4ac6b506f33800e2b8f17e48e8560656ac00c04ae81bbf2fa297 
"thea.ns.cloudflare.com"
caa_record dns b6e518b345db7042821c72f0e5087203237ed8a995ffbe7d7f4b16f684131d62 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "sectigo.com"
}
02
Documented Change observed

Infrastructure

Public evidence provides enough material to document this angle

Angle 02

Infrastructure

Documented Change observed

Public evidence provides enough material to document this angle

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

30evidence
12changes
2open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
30
Signals
2
Changes
12

Unknowns and limitations

2 items still require qualification

caa_record dns 88ad8c62903bd998f00bb720f5f43ccfb945b9bd9b3a3ccbf29df62328a7a597 
{
    "flags": 0,
    "tag": "issue",
    "value": "ssl.com"
}
dns_address dns 207f1b2c1ef93c9272920ea1a2e109a3cf02531185ac5b4653164d6db2fabdf1 
"2606:4700:3031::ac43:831e"
caa_record dns d43e5cde3fe6cf816545dc84a4a3bb7fbde32a48db22f62ae00e1c9027e5be8b 
{
    "flags": 0,
    "tag": "iodef",
    "value": "mailto:security@0bla.com"
}
module_finding dns d7169fed1697eea2b2342dd1aacf8b1ec8dd699fcf096e775e7455806d4f0fe3 
{
    "evidence": [
        "david.ns.cloudflare.com",
        "thea.ns.cloudflare.com"
    ],
    "severity": "low"
}
dns_address dns de033d871f02b262bf9935ed22c148d2b43b6cce9d9f22f40ea670386c7f6448 
"172.67.131.30"
caa_record dns 5e3e1e052d05d6230058755bd5d275af0105a4983e61202871fbb675544a89c8 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "pki.goog; cansignhttpexchanges=yes"
}
mail_exchanger dns 7b37751c85e01b43c68201673910aedaaf302200936008d6d1421d6d185d601d 
"mta-gw.infomaniak.ch"
dependency_provider dependencies c65dd2899db54c1c547a7081dbbeb53f1ce50af461eb40f6c4412fe2fe2c3069 
{
    "critical": true,
    "hosts": [
        "cloudflare.com",
        "david.ns.cloudflare.com",
        "thea.ns.cloudflare.com"
    ],
    "id": "cloudflare",
    "known": true,
    "name": "Cloudflare",
    "observation_count": 3,
    "services": [
        "cdn",
        "security"
    ],
    "tracker": false
}
dependency_provider dependencies 1e0e4c2e7194c71cacc567eaaaf27145eae61b010f85458201f63823d2b0949f 
{
    "critical": false,
    "hosts": [
        "mta-gw.infomaniak.ch"
    ],
    "id": "infomaniak",
    "known": true,
    "name": "Infomaniak",
    "observation_count": 1,
    "services": [
        "dns",
        "hosting",
        "mail"
    ],
    "tracker": false
}
caa_record dns bb5792415779adf9aae1cbd8b32de9e9132938c1ab8ae9090ff6541c7f9d1f95 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "ssl.com"
}
caa_record dns 8f9dc4bd6de6804762c744fbcf0b0e0e4c9588b17ce8ce4091110923fc8fce3f 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "letsencrypt.org"
}
module_finding dns 10761c231b097efd961779c8d2b92571b4e273bc515e35c8aeebf9ce85175491 
{
    "evidence": {
        "reason": "No external validating resolver is used; DS validation is intentionally not inferred.",
        "status": "not_tested"
    },
    "severity": "info"
}
caa_record dns ccdef8c7fb74aa33117385797c19bdaa7fbe8b2f18d38ff2441d73ecc8c8cedc 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "digicert.com; cansignhttpexchanges=yes"
}
caa_record dns 6b0c2c30edba58bdfe31ce5a794d5e4b0822a2b2db70bb2e18e584933f009d1e 
{
    "flags": 0,
    "tag": "issue",
    "value": "pki.goog; cansignhttpexchanges=yes"
}
caa_record dns ddf530c83b6c4327f0d5e274b8b375ec49abebf2df443881f5c5844ad0a23c56 
{
    "flags": 0,
    "tag": "issue",
    "value": "digicert.com; cansignhttpexchanges=yes"
}
caa_record dns 037f43d5216309eb9484949c2279c8859aabf22d171a5cbb4d8db072fae8c2e8 
{
    "flags": 0,
    "tag": "issue",
    "value": "sectigo.com"
}
module_finding resilience 62d1cae4295ebafc158cfdf3376b5df32792020e351bd313facf36ed682860e8 
{
    "evidence": [
        "david.ns.cloudflare.com",
        "thea.ns.cloudflare.com"
    ],
    "severity": "medium"
}
dns_address dns c099f90048a3e5a61db9d52ebb13caf086f7f50cbab2c492dce69514be0a74d0 
"104.21.9.251"
dmarc_record dns 149e0762b4d1aef0ca24356cbdec1d5e744d64c8e802f7503e718dbb6e5de490 
"v=DMARC1; p=reject;"
caa_record dns 63f8b030f669d39f019fb867caec7a28532ce4831c40d252909046a3c8b84e6a 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "comodoca.com"
}
module_finding resilience b0ad5a58e67d2bdbbca7a0340d53653b2c5bf49be88dac2dbfdefcd58f6cae24 
{
    "evidence": {
        "provider": "Cloudflare",
        "share": 75
    },
    "severity": "medium"
}
module_finding dependencies 8ccbaadfcc6c918d5e778066343b1db4b87a37f7aeddf4b9678b404abfd606f0 
{
    "evidence": "75%",
    "severity": "medium"
}
dns_nameserver dns ccfebcf15da5a47827204050350684ada8dd8899402e9b1c616bdcc40eeefccc 
"david.ns.cloudflare.com"
caa_record dns 2fe58c9ddf755f8e208dc5110e3a161a125ce466a0b39ed5f95fd80be46d65d5 
{
    "flags": 0,
    "tag": "issue",
    "value": "letsencrypt.org"
}
03
Partial Change observed

Encryption and transport

This angle is only partially documented by public evidence

Angle 03

Encryption and transport

Partial Change observed

This angle is only partially documented by public evidence

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

12evidence
5changes
1open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
12
Signals
0
Changes
5

Unknowns and limitations

1 items still require qualification

tls_valid_to tls adc9a815da67d5f82ae7e399d086a871229c59b5b0ad39f17ae7da745f6bc93a 
"2026-11-14T14:07:24+00:00"
http_header headers a54f9fbcc16ae5780cb09d69d4a5823a722d9fb2c97129381f608b2d794cd298 
[
    "max-age=63072000; includeSubDomains; preload"
]
http_header headers 3b9bde6ae5bfa31f0e699c1d3c45c75c2882bff2511e9bded8859a9f3ccdf018 
[
    "same-origin"
]
tls_issuer tls 21dc11d89d8c1177c7a4e18ac8c4b905a4fca9242ff6045007de2a89f31cc7eb 
"C = US, O = Let's Encrypt, CN = YE2"
http_header headers 56620bd8950e7d7cf2791f5383d20ee1b7d0a73fc17187d65a8325ab39555ad9 
[
    "DENY"
]
http_header headers 4eb279513f07f7ffaf2d19b40322bf2a5fe70ee7860a7e2dc2316155e07e36f7 
[
    "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), gamepad=(), hid=(), idle-detection=(), serial=(), unload=()"
]
http_header headers d26139656facab0d01e620bb2e116538d8f2d04c27a44fe8c9456bc1b65dd1fe 
[
    "default-src 'none'; script-src 'self' 'nonce-6DRbkX9AG5HKlbENqeuAtw=='; style-src 'self' 'nonce-6DRbkX9AG5HKlbENqeuAtw=='; font-src 'self'; img-src 'self' data: https://lh3.googleusercontent.com; connect-src 'self'; manifest-src 'self'; form-action 'self' https://formspree.io; frame-ancestors 'none'; base-uri 'none'; object-src 'none';"
]
http_header headers 5016f5635b4c25f714994c29cb61d9fa510681318c77f419c45b5155a2037a40 
[
    "same-origin"
]
http_header headers f0894a119cef6eef2b09badecadc47b6cb754099b0bb94cfeb181b2b1af40cf2 
[
    "nosniff"
]
http_header headers e75648c3a622b5ec3d1b9e870a914226c3172852862e8a91dbeeb8eb37ad35f9 
[
    "cloudflare"
]
http_header headers c5cce1f4222e68060866b0d0c3f3bac20918460b9c12f4521229f995e3f492b6 
[
    "strict-origin-when-cross-origin"
]
http_header headers ae536ebe725e679d84e372cb0ccdbff1ec0f44c0816d63ee0fef09f1793c6ccb 
[
    "require-corp"
]
04
Documented Change observed

Mail and trust

Public evidence provides enough material to document this angle

Angle 04

Mail and trust

Documented Change observed

Public evidence provides enough material to document this angle

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

32evidence
11changes
0open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
32
Signals
2
Changes
11
caa_record dns 88ad8c62903bd998f00bb720f5f43ccfb945b9bd9b3a3ccbf29df62328a7a597 
{
    "flags": 0,
    "tag": "issue",
    "value": "ssl.com"
}
module_finding mail_trust d1f0ec4fd038ee2230ac6e73a9f74266c74aa50137d4311d891de59b401ba1dd 
{
    "evidence": [
        {
            "host": "mta-gw.infomaniak.ch",
            "priority": 5
        }
    ],
    "severity": "low"
}
dns_address dns 207f1b2c1ef93c9272920ea1a2e109a3cf02531185ac5b4653164d6db2fabdf1 
"2606:4700:3031::ac43:831e"
caa_record dns d43e5cde3fe6cf816545dc84a4a3bb7fbde32a48db22f62ae00e1c9027e5be8b 
{
    "flags": 0,
    "tag": "iodef",
    "value": "mailto:security@0bla.com"
}
module_finding dns d7169fed1697eea2b2342dd1aacf8b1ec8dd699fcf096e775e7455806d4f0fe3 
{
    "evidence": [
        "david.ns.cloudflare.com",
        "thea.ns.cloudflare.com"
    ],
    "severity": "low"
}
dns_address dns de033d871f02b262bf9935ed22c148d2b43b6cce9d9f22f40ea670386c7f6448 
"172.67.131.30"
caa_record dns 5e3e1e052d05d6230058755bd5d275af0105a4983e61202871fbb675544a89c8 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "pki.goog; cansignhttpexchanges=yes"
}
mail_exchanger dns 7b37751c85e01b43c68201673910aedaaf302200936008d6d1421d6d185d601d 
"mta-gw.infomaniak.ch"
dmarc_policy mail_trust d5b9592f4d70de7f8757b01ecbda71c02d07aedaba965761c6cb3be7e21bc6f4 
"reject"
caa_record dns bb5792415779adf9aae1cbd8b32de9e9132938c1ab8ae9090ff6541c7f9d1f95 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "ssl.com"
}
caa_record dns 8f9dc4bd6de6804762c744fbcf0b0e0e4c9588b17ce8ce4091110923fc8fce3f 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "letsencrypt.org"
}
mail_policy_flag mail_trust 7ee4b64795ef4a6e6534952234b96bd9f56d21c6ca4b048cfaffaad7f494f390 
false
module_finding dns 10761c231b097efd961779c8d2b92571b4e273bc515e35c8aeebf9ce85175491 
{
    "evidence": {
        "reason": "No external validating resolver is used; DS validation is intentionally not inferred.",
        "status": "not_tested"
    },
    "severity": "info"
}
caa_record dns ccdef8c7fb74aa33117385797c19bdaa7fbe8b2f18d38ff2441d73ecc8c8cedc 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "digicert.com; cansignhttpexchanges=yes"
}
module_finding mail_trust 88679ad179cb067a132405fb4f25ec9f3f069a7c8c34774f90cd3895b840aaaf 
{
    "evidence": null,
    "severity": "low"
}
caa_record dns 6b0c2c30edba58bdfe31ce5a794d5e4b0822a2b2db70bb2e18e584933f009d1e 
{
    "flags": 0,
    "tag": "issue",
    "value": "pki.goog; cansignhttpexchanges=yes"
}
caa_record dns ddf530c83b6c4327f0d5e274b8b375ec49abebf2df443881f5c5844ad0a23c56 
{
    "flags": 0,
    "tag": "issue",
    "value": "digicert.com; cansignhttpexchanges=yes"
}
caa_record dns 037f43d5216309eb9484949c2279c8859aabf22d171a5cbb4d8db072fae8c2e8 
{
    "flags": 0,
    "tag": "issue",
    "value": "sectigo.com"
}
module_finding mail_trust 59eb97e829254deb99b459244fcc2d3a5a8961d624a02a8bfc9c4108494b6593 
{
    "evidence": null,
    "severity": "low"
}
spf_policy mail_trust b96af84d3df776bf9533e24e351a6bb00667b7eabe09fd90334b87eafdddf360 
"hardfail"
dns_address dns c099f90048a3e5a61db9d52ebb13caf086f7f50cbab2c492dce69514be0a74d0 
"104.21.9.251"
dmarc_record dns 149e0762b4d1aef0ca24356cbdec1d5e744d64c8e802f7503e718dbb6e5de490 
"v=DMARC1; p=reject;"
caa_record dns 63f8b030f669d39f019fb867caec7a28532ce4831c40d252909046a3c8b84e6a 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "comodoca.com"
}
dns_nameserver dns ccfebcf15da5a47827204050350684ada8dd8899402e9b1c616bdcc40eeefccc 
"david.ns.cloudflare.com"
05
Documented Change observed

DNS and governance

Public evidence provides enough material to document this angle

Angle 05

DNS and governance

Documented Change observed

Public evidence provides enough material to document this angle

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

32evidence
10changes
0open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
32
Signals
2
Changes
10
caa_record dns 88ad8c62903bd998f00bb720f5f43ccfb945b9bd9b3a3ccbf29df62328a7a597 
{
    "flags": 0,
    "tag": "issue",
    "value": "ssl.com"
}
module_finding mail_trust d1f0ec4fd038ee2230ac6e73a9f74266c74aa50137d4311d891de59b401ba1dd 
{
    "evidence": [
        {
            "host": "mta-gw.infomaniak.ch",
            "priority": 5
        }
    ],
    "severity": "low"
}
dns_address dns 207f1b2c1ef93c9272920ea1a2e109a3cf02531185ac5b4653164d6db2fabdf1 
"2606:4700:3031::ac43:831e"
caa_record dns d43e5cde3fe6cf816545dc84a4a3bb7fbde32a48db22f62ae00e1c9027e5be8b 
{
    "flags": 0,
    "tag": "iodef",
    "value": "mailto:security@0bla.com"
}
module_finding dns d7169fed1697eea2b2342dd1aacf8b1ec8dd699fcf096e775e7455806d4f0fe3 
{
    "evidence": [
        "david.ns.cloudflare.com",
        "thea.ns.cloudflare.com"
    ],
    "severity": "low"
}
dns_address dns de033d871f02b262bf9935ed22c148d2b43b6cce9d9f22f40ea670386c7f6448 
"172.67.131.30"
caa_record dns 5e3e1e052d05d6230058755bd5d275af0105a4983e61202871fbb675544a89c8 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "pki.goog; cansignhttpexchanges=yes"
}
mail_exchanger dns 7b37751c85e01b43c68201673910aedaaf302200936008d6d1421d6d185d601d 
"mta-gw.infomaniak.ch"
dmarc_policy mail_trust d5b9592f4d70de7f8757b01ecbda71c02d07aedaba965761c6cb3be7e21bc6f4 
"reject"
caa_record dns bb5792415779adf9aae1cbd8b32de9e9132938c1ab8ae9090ff6541c7f9d1f95 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "ssl.com"
}
caa_record dns 8f9dc4bd6de6804762c744fbcf0b0e0e4c9588b17ce8ce4091110923fc8fce3f 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "letsencrypt.org"
}
mail_policy_flag mail_trust 7ee4b64795ef4a6e6534952234b96bd9f56d21c6ca4b048cfaffaad7f494f390 
false
module_finding dns 10761c231b097efd961779c8d2b92571b4e273bc515e35c8aeebf9ce85175491 
{
    "evidence": {
        "reason": "No external validating resolver is used; DS validation is intentionally not inferred.",
        "status": "not_tested"
    },
    "severity": "info"
}
caa_record dns ccdef8c7fb74aa33117385797c19bdaa7fbe8b2f18d38ff2441d73ecc8c8cedc 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "digicert.com; cansignhttpexchanges=yes"
}
module_finding mail_trust 88679ad179cb067a132405fb4f25ec9f3f069a7c8c34774f90cd3895b840aaaf 
{
    "evidence": null,
    "severity": "low"
}
caa_record dns 6b0c2c30edba58bdfe31ce5a794d5e4b0822a2b2db70bb2e18e584933f009d1e 
{
    "flags": 0,
    "tag": "issue",
    "value": "pki.goog; cansignhttpexchanges=yes"
}
caa_record dns ddf530c83b6c4327f0d5e274b8b375ec49abebf2df443881f5c5844ad0a23c56 
{
    "flags": 0,
    "tag": "issue",
    "value": "digicert.com; cansignhttpexchanges=yes"
}
caa_record dns 037f43d5216309eb9484949c2279c8859aabf22d171a5cbb4d8db072fae8c2e8 
{
    "flags": 0,
    "tag": "issue",
    "value": "sectigo.com"
}
module_finding mail_trust 59eb97e829254deb99b459244fcc2d3a5a8961d624a02a8bfc9c4108494b6593 
{
    "evidence": null,
    "severity": "low"
}
spf_policy mail_trust b96af84d3df776bf9533e24e351a6bb00667b7eabe09fd90334b87eafdddf360 
"hardfail"
dns_address dns c099f90048a3e5a61db9d52ebb13caf086f7f50cbab2c492dce69514be0a74d0 
"104.21.9.251"
dmarc_record dns 149e0762b4d1aef0ca24356cbdec1d5e744d64c8e802f7503e718dbb6e5de490 
"v=DMARC1; p=reject;"
caa_record dns 63f8b030f669d39f019fb867caec7a28532ce4831c40d252909046a3c8b84e6a 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "comodoca.com"
}
dns_nameserver dns ccfebcf15da5a47827204050350684ada8dd8899402e9b1c616bdcc40eeefccc 
"david.ns.cloudflare.com"
06
Documented Change observed

External dependencies

Public evidence provides enough material to document this angle

Angle 06

External dependencies

Documented Change observed

Public evidence provides enough material to document this angle

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

29evidence
5changes
0open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
29
Signals
2
Changes
5
caa_record dns 88ad8c62903bd998f00bb720f5f43ccfb945b9bd9b3a3ccbf29df62328a7a597 
{
    "flags": 0,
    "tag": "issue",
    "value": "ssl.com"
}
dns_address dns 207f1b2c1ef93c9272920ea1a2e109a3cf02531185ac5b4653164d6db2fabdf1 
"2606:4700:3031::ac43:831e"
caa_record dns d43e5cde3fe6cf816545dc84a4a3bb7fbde32a48db22f62ae00e1c9027e5be8b 
{
    "flags": 0,
    "tag": "iodef",
    "value": "mailto:security@0bla.com"
}
module_finding dns d7169fed1697eea2b2342dd1aacf8b1ec8dd699fcf096e775e7455806d4f0fe3 
{
    "evidence": [
        "david.ns.cloudflare.com",
        "thea.ns.cloudflare.com"
    ],
    "severity": "low"
}
dns_address dns de033d871f02b262bf9935ed22c148d2b43b6cce9d9f22f40ea670386c7f6448 
"172.67.131.30"
caa_record dns 5e3e1e052d05d6230058755bd5d275af0105a4983e61202871fbb675544a89c8 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "pki.goog; cansignhttpexchanges=yes"
}
mail_exchanger dns 7b37751c85e01b43c68201673910aedaaf302200936008d6d1421d6d185d601d 
"mta-gw.infomaniak.ch"
dependency_provider dependencies c65dd2899db54c1c547a7081dbbeb53f1ce50af461eb40f6c4412fe2fe2c3069 
{
    "critical": true,
    "hosts": [
        "cloudflare.com",
        "david.ns.cloudflare.com",
        "thea.ns.cloudflare.com"
    ],
    "id": "cloudflare",
    "known": true,
    "name": "Cloudflare",
    "observation_count": 3,
    "services": [
        "cdn",
        "security"
    ],
    "tracker": false
}
dependency_provider dependencies 1e0e4c2e7194c71cacc567eaaaf27145eae61b010f85458201f63823d2b0949f 
{
    "critical": false,
    "hosts": [
        "mta-gw.infomaniak.ch"
    ],
    "id": "infomaniak",
    "known": true,
    "name": "Infomaniak",
    "observation_count": 1,
    "services": [
        "dns",
        "hosting",
        "mail"
    ],
    "tracker": false
}
caa_record dns bb5792415779adf9aae1cbd8b32de9e9132938c1ab8ae9090ff6541c7f9d1f95 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "ssl.com"
}
caa_record dns 8f9dc4bd6de6804762c744fbcf0b0e0e4c9588b17ce8ce4091110923fc8fce3f 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "letsencrypt.org"
}
module_finding dns 10761c231b097efd961779c8d2b92571b4e273bc515e35c8aeebf9ce85175491 
{
    "evidence": {
        "reason": "No external validating resolver is used; DS validation is intentionally not inferred.",
        "status": "not_tested"
    },
    "severity": "info"
}
caa_record dns ccdef8c7fb74aa33117385797c19bdaa7fbe8b2f18d38ff2441d73ecc8c8cedc 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "digicert.com; cansignhttpexchanges=yes"
}
caa_record dns 6b0c2c30edba58bdfe31ce5a794d5e4b0822a2b2db70bb2e18e584933f009d1e 
{
    "flags": 0,
    "tag": "issue",
    "value": "pki.goog; cansignhttpexchanges=yes"
}
caa_record dns ddf530c83b6c4327f0d5e274b8b375ec49abebf2df443881f5c5844ad0a23c56 
{
    "flags": 0,
    "tag": "issue",
    "value": "digicert.com; cansignhttpexchanges=yes"
}
caa_record dns 037f43d5216309eb9484949c2279c8859aabf22d171a5cbb4d8db072fae8c2e8 
{
    "flags": 0,
    "tag": "issue",
    "value": "sectigo.com"
}
dns_address dns c099f90048a3e5a61db9d52ebb13caf086f7f50cbab2c492dce69514be0a74d0 
"104.21.9.251"
dmarc_record dns 149e0762b4d1aef0ca24356cbdec1d5e744d64c8e802f7503e718dbb6e5de490 
"v=DMARC1; p=reject;"
caa_record dns 63f8b030f669d39f019fb867caec7a28532ce4831c40d252909046a3c8b84e6a 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "comodoca.com"
}
module_finding dependencies 8ccbaadfcc6c918d5e778066343b1db4b87a37f7aeddf4b9678b404abfd606f0 
{
    "evidence": "75%",
    "severity": "medium"
}
dns_nameserver dns ccfebcf15da5a47827204050350684ada8dd8899402e9b1c616bdcc40eeefccc 
"david.ns.cloudflare.com"
cookie privacy 6e1b6642ae0be1b699f94701ae4f8dc33cc4fa8ecd952afff450941b7286f16f 
{
    "http_only": true,
    "name": "id",
    "same_site": "lax",
    "secure": true
}
caa_record dns 2fe58c9ddf755f8e208dc5110e3a161a125ce466a0b39ed5f95fd80be46d65d5 
{
    "flags": 0,
    "tag": "issue",
    "value": "letsencrypt.org"
}
dns_address dns 648edc8155510db097dbcd3755bfc96f81f7eac7bc035edb2473d3f0c534aff2 
"2606:4700:3032::6815:9fb"
07
Documented Change observed

Observable technologies

Public evidence provides enough material to document this angle

Angle 07

Observable technologies

Documented Change observed

Public evidence provides enough material to document this angle

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

11evidence
1changes
0open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
11
Signals
0
Changes
1
http_header headers a54f9fbcc16ae5780cb09d69d4a5823a722d9fb2c97129381f608b2d794cd298 
[
    "max-age=63072000; includeSubDomains; preload"
]
http_header headers 3b9bde6ae5bfa31f0e699c1d3c45c75c2882bff2511e9bded8859a9f3ccdf018 
[
    "same-origin"
]
http_header headers 56620bd8950e7d7cf2791f5383d20ee1b7d0a73fc17187d65a8325ab39555ad9 
[
    "DENY"
]
http_header headers 4eb279513f07f7ffaf2d19b40322bf2a5fe70ee7860a7e2dc2316155e07e36f7 
[
    "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), gamepad=(), hid=(), idle-detection=(), serial=(), unload=()"
]
technology technology d9c070d8aabd6091d2da9921501fcbd55f28197b7172fa9b902163b8bae4c911 
{
    "name": "cloudflare",
    "version": "",
    "version_exposed": false
}
http_header headers d26139656facab0d01e620bb2e116538d8f2d04c27a44fe8c9456bc1b65dd1fe 
[
    "default-src 'none'; script-src 'self' 'nonce-6DRbkX9AG5HKlbENqeuAtw=='; style-src 'self' 'nonce-6DRbkX9AG5HKlbENqeuAtw=='; font-src 'self'; img-src 'self' data: https://lh3.googleusercontent.com; connect-src 'self'; manifest-src 'self'; form-action 'self' https://formspree.io; frame-ancestors 'none'; base-uri 'none'; object-src 'none';"
]
http_header headers 5016f5635b4c25f714994c29cb61d9fa510681318c77f419c45b5155a2037a40 
[
    "same-origin"
]
http_header headers f0894a119cef6eef2b09badecadc47b6cb754099b0bb94cfeb181b2b1af40cf2 
[
    "nosniff"
]
http_header headers e75648c3a622b5ec3d1b9e870a914226c3172852862e8a91dbeeb8eb37ad35f9 
[
    "cloudflare"
]
http_header headers c5cce1f4222e68060866b0d0c3f3bac20918460b9c12f4521229f995e3f492b6 
[
    "strict-origin-when-cross-origin"
]
http_header headers ae536ebe725e679d84e372cb0ccdbff1ec0f44c0816d63ee0fef09f1793c6ccb 
[
    "require-corp"
]
08
Partial Stable

Public exposure

This angle is only partially documented by public evidence

Angle 08

Public exposure

Partial Stable

This angle is only partially documented by public evidence

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

20evidence
0changes
1open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
20
Signals
0
Changes
0

Unknowns and limitations

1 items still require qualification

module_finding mail_trust d1f0ec4fd038ee2230ac6e73a9f74266c74aa50137d4311d891de59b401ba1dd 
{
    "evidence": [
        {
            "host": "mta-gw.infomaniak.ch",
            "priority": 5
        }
    ],
    "severity": "low"
}
module_finding dns d7169fed1697eea2b2342dd1aacf8b1ec8dd699fcf096e775e7455806d4f0fe3 
{
    "evidence": [
        "david.ns.cloudflare.com",
        "thea.ns.cloudflare.com"
    ],
    "severity": "low"
}
http_header headers a54f9fbcc16ae5780cb09d69d4a5823a722d9fb2c97129381f608b2d794cd298 
[
    "max-age=63072000; includeSubDomains; preload"
]
http_header headers 3b9bde6ae5bfa31f0e699c1d3c45c75c2882bff2511e9bded8859a9f3ccdf018 
[
    "same-origin"
]
module_finding dns 10761c231b097efd961779c8d2b92571b4e273bc515e35c8aeebf9ce85175491 
{
    "evidence": {
        "reason": "No external validating resolver is used; DS validation is intentionally not inferred.",
        "status": "not_tested"
    },
    "severity": "info"
}
module_finding mail_trust 88679ad179cb067a132405fb4f25ec9f3f069a7c8c34774f90cd3895b840aaaf 
{
    "evidence": null,
    "severity": "low"
}
http_header headers 56620bd8950e7d7cf2791f5383d20ee1b7d0a73fc17187d65a8325ab39555ad9 
[
    "DENY"
]
http_header headers 4eb279513f07f7ffaf2d19b40322bf2a5fe70ee7860a7e2dc2316155e07e36f7 
[
    "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), gamepad=(), hid=(), idle-detection=(), serial=(), unload=()"
]
module_finding mail_trust 59eb97e829254deb99b459244fcc2d3a5a8961d624a02a8bfc9c4108494b6593 
{
    "evidence": null,
    "severity": "low"
}
module_finding resilience 62d1cae4295ebafc158cfdf3376b5df32792020e351bd313facf36ed682860e8 
{
    "evidence": [
        "david.ns.cloudflare.com",
        "thea.ns.cloudflare.com"
    ],
    "severity": "medium"
}
http_header headers d26139656facab0d01e620bb2e116538d8f2d04c27a44fe8c9456bc1b65dd1fe 
[
    "default-src 'none'; script-src 'self' 'nonce-6DRbkX9AG5HKlbENqeuAtw=='; style-src 'self' 'nonce-6DRbkX9AG5HKlbENqeuAtw=='; font-src 'self'; img-src 'self' data: https://lh3.googleusercontent.com; connect-src 'self'; manifest-src 'self'; form-action 'self' https://formspree.io; frame-ancestors 'none'; base-uri 'none'; object-src 'none';"
]
http_header headers 5016f5635b4c25f714994c29cb61d9fa510681318c77f419c45b5155a2037a40 
[
    "same-origin"
]
http_header headers f0894a119cef6eef2b09badecadc47b6cb754099b0bb94cfeb181b2b1af40cf2 
[
    "nosniff"
]
module_finding resilience b0ad5a58e67d2bdbbca7a0340d53653b2c5bf49be88dac2dbfdefcd58f6cae24 
{
    "evidence": {
        "provider": "Cloudflare",
        "share": 75
    },
    "severity": "medium"
}
module_finding dependencies 8ccbaadfcc6c918d5e778066343b1db4b87a37f7aeddf4b9678b404abfd606f0 
{
    "evidence": "75%",
    "severity": "medium"
}
cookie privacy 6e1b6642ae0be1b699f94701ae4f8dc33cc4fa8ecd952afff450941b7286f16f 
{
    "http_only": true,
    "name": "id",
    "same_site": "lax",
    "secure": true
}
http_header headers e75648c3a622b5ec3d1b9e870a914226c3172852862e8a91dbeeb8eb37ad35f9 
[
    "cloudflare"
]
http_header headers c5cce1f4222e68060866b0d0c3f3bac20918460b9c12f4521229f995e3f492b6 
[
    "strict-origin-when-cross-origin"
]
http_header headers ae536ebe725e679d84e372cb0ccdbff1ec0f44c0816d63ee0fef09f1793c6ccb 
[
    "require-corp"
]
module_finding sovereignty d3dbc9690edfe94fa2ace0868b6854f43b777a49c2e9ccb5755b2ff167708d59 
{
    "evidence": [
        "Cloudflare"
    ],
    "severity": "high"
}
09
Documented Stable

Documentary trust

Public evidence provides enough material to document this angle

Angle 09

Documentary trust

Documented Stable

Public evidence provides enough material to document this angle

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

19evidence
0changes
0open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
19
Signals
0
Changes
0
module_finding mail_trust d1f0ec4fd038ee2230ac6e73a9f74266c74aa50137d4311d891de59b401ba1dd 
{
    "evidence": [
        {
            "host": "mta-gw.infomaniak.ch",
            "priority": 5
        }
    ],
    "severity": "low"
}
module_finding dns d7169fed1697eea2b2342dd1aacf8b1ec8dd699fcf096e775e7455806d4f0fe3 
{
    "evidence": [
        "david.ns.cloudflare.com",
        "thea.ns.cloudflare.com"
    ],
    "severity": "low"
}
http_header headers a54f9fbcc16ae5780cb09d69d4a5823a722d9fb2c97129381f608b2d794cd298 
[
    "max-age=63072000; includeSubDomains; preload"
]
http_header headers 3b9bde6ae5bfa31f0e699c1d3c45c75c2882bff2511e9bded8859a9f3ccdf018 
[
    "same-origin"
]
module_finding dns 10761c231b097efd961779c8d2b92571b4e273bc515e35c8aeebf9ce85175491 
{
    "evidence": {
        "reason": "No external validating resolver is used; DS validation is intentionally not inferred.",
        "status": "not_tested"
    },
    "severity": "info"
}
module_finding mail_trust 88679ad179cb067a132405fb4f25ec9f3f069a7c8c34774f90cd3895b840aaaf 
{
    "evidence": null,
    "severity": "low"
}
http_header headers 56620bd8950e7d7cf2791f5383d20ee1b7d0a73fc17187d65a8325ab39555ad9 
[
    "DENY"
]
http_header headers 4eb279513f07f7ffaf2d19b40322bf2a5fe70ee7860a7e2dc2316155e07e36f7 
[
    "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), gamepad=(), hid=(), idle-detection=(), serial=(), unload=()"
]
module_finding mail_trust 59eb97e829254deb99b459244fcc2d3a5a8961d624a02a8bfc9c4108494b6593 
{
    "evidence": null,
    "severity": "low"
}
module_finding resilience 62d1cae4295ebafc158cfdf3376b5df32792020e351bd313facf36ed682860e8 
{
    "evidence": [
        "david.ns.cloudflare.com",
        "thea.ns.cloudflare.com"
    ],
    "severity": "medium"
}
http_header headers d26139656facab0d01e620bb2e116538d8f2d04c27a44fe8c9456bc1b65dd1fe 
[
    "default-src 'none'; script-src 'self' 'nonce-6DRbkX9AG5HKlbENqeuAtw=='; style-src 'self' 'nonce-6DRbkX9AG5HKlbENqeuAtw=='; font-src 'self'; img-src 'self' data: https://lh3.googleusercontent.com; connect-src 'self'; manifest-src 'self'; form-action 'self' https://formspree.io; frame-ancestors 'none'; base-uri 'none'; object-src 'none';"
]
http_header headers 5016f5635b4c25f714994c29cb61d9fa510681318c77f419c45b5155a2037a40 
[
    "same-origin"
]
http_header headers f0894a119cef6eef2b09badecadc47b6cb754099b0bb94cfeb181b2b1af40cf2 
[
    "nosniff"
]
module_finding resilience b0ad5a58e67d2bdbbca7a0340d53653b2c5bf49be88dac2dbfdefcd58f6cae24 
{
    "evidence": {
        "provider": "Cloudflare",
        "share": 75
    },
    "severity": "medium"
}
module_finding dependencies 8ccbaadfcc6c918d5e778066343b1db4b87a37f7aeddf4b9678b404abfd606f0 
{
    "evidence": "75%",
    "severity": "medium"
}
http_header headers e75648c3a622b5ec3d1b9e870a914226c3172852862e8a91dbeeb8eb37ad35f9 
[
    "cloudflare"
]
http_header headers c5cce1f4222e68060866b0d0c3f3bac20918460b9c12f4521229f995e3f492b6 
[
    "strict-origin-when-cross-origin"
]
http_header headers ae536ebe725e679d84e372cb0ccdbff1ec0f44c0816d63ee0fef09f1793c6ccb 
[
    "require-corp"
]
module_finding sovereignty d3dbc9690edfe94fa2ace0868b6854f43b777a49c2e9ccb5755b2ff167708d59 
{
    "evidence": [
        "Cloudflare"
    ],
    "severity": "high"
}
10
Documented Change observed

Security signals

Public evidence provides enough material to document this angle

Angle 10

Security signals

Documented Change observed

Public evidence provides enough material to document this angle

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

49evidence
21changes
2open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
49
Signals
2
Changes
21

Unknowns and limitations

2 items still require qualification

caa_record dns 88ad8c62903bd998f00bb720f5f43ccfb945b9bd9b3a3ccbf29df62328a7a597 
{
    "flags": 0,
    "tag": "issue",
    "value": "ssl.com"
}
tls_valid_to tls adc9a815da67d5f82ae7e399d086a871229c59b5b0ad39f17ae7da745f6bc93a 
"2026-11-14T14:07:24+00:00"
module_finding mail_trust d1f0ec4fd038ee2230ac6e73a9f74266c74aa50137d4311d891de59b401ba1dd 
{
    "evidence": [
        {
            "host": "mta-gw.infomaniak.ch",
            "priority": 5
        }
    ],
    "severity": "low"
}
dns_address dns 207f1b2c1ef93c9272920ea1a2e109a3cf02531185ac5b4653164d6db2fabdf1 
"2606:4700:3031::ac43:831e"
caa_record dns d43e5cde3fe6cf816545dc84a4a3bb7fbde32a48db22f62ae00e1c9027e5be8b 
{
    "flags": 0,
    "tag": "iodef",
    "value": "mailto:security@0bla.com"
}
module_finding dns d7169fed1697eea2b2342dd1aacf8b1ec8dd699fcf096e775e7455806d4f0fe3 
{
    "evidence": [
        "david.ns.cloudflare.com",
        "thea.ns.cloudflare.com"
    ],
    "severity": "low"
}
dns_address dns de033d871f02b262bf9935ed22c148d2b43b6cce9d9f22f40ea670386c7f6448 
"172.67.131.30"
http_header headers a54f9fbcc16ae5780cb09d69d4a5823a722d9fb2c97129381f608b2d794cd298 
[
    "max-age=63072000; includeSubDomains; preload"
]
caa_record dns 5e3e1e052d05d6230058755bd5d275af0105a4983e61202871fbb675544a89c8 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "pki.goog; cansignhttpexchanges=yes"
}
mail_exchanger dns 7b37751c85e01b43c68201673910aedaaf302200936008d6d1421d6d185d601d 
"mta-gw.infomaniak.ch"
dmarc_policy mail_trust d5b9592f4d70de7f8757b01ecbda71c02d07aedaba965761c6cb3be7e21bc6f4 
"reject"
http_header headers 3b9bde6ae5bfa31f0e699c1d3c45c75c2882bff2511e9bded8859a9f3ccdf018 
[
    "same-origin"
]
caa_record dns bb5792415779adf9aae1cbd8b32de9e9132938c1ab8ae9090ff6541c7f9d1f95 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "ssl.com"
}
caa_record dns 8f9dc4bd6de6804762c744fbcf0b0e0e4c9588b17ce8ce4091110923fc8fce3f 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "letsencrypt.org"
}
mail_policy_flag mail_trust 7ee4b64795ef4a6e6534952234b96bd9f56d21c6ca4b048cfaffaad7f494f390 
false
tls_issuer tls 21dc11d89d8c1177c7a4e18ac8c4b905a4fca9242ff6045007de2a89f31cc7eb 
"C = US, O = Let's Encrypt, CN = YE2"
module_finding dns 10761c231b097efd961779c8d2b92571b4e273bc515e35c8aeebf9ce85175491 
{
    "evidence": {
        "reason": "No external validating resolver is used; DS validation is intentionally not inferred.",
        "status": "not_tested"
    },
    "severity": "info"
}
caa_record dns ccdef8c7fb74aa33117385797c19bdaa7fbe8b2f18d38ff2441d73ecc8c8cedc 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "digicert.com; cansignhttpexchanges=yes"
}
module_finding mail_trust 88679ad179cb067a132405fb4f25ec9f3f069a7c8c34774f90cd3895b840aaaf 
{
    "evidence": null,
    "severity": "low"
}
caa_record dns 6b0c2c30edba58bdfe31ce5a794d5e4b0822a2b2db70bb2e18e584933f009d1e 
{
    "flags": 0,
    "tag": "issue",
    "value": "pki.goog; cansignhttpexchanges=yes"
}
caa_record dns ddf530c83b6c4327f0d5e274b8b375ec49abebf2df443881f5c5844ad0a23c56 
{
    "flags": 0,
    "tag": "issue",
    "value": "digicert.com; cansignhttpexchanges=yes"
}
http_header headers 56620bd8950e7d7cf2791f5383d20ee1b7d0a73fc17187d65a8325ab39555ad9 
[
    "DENY"
]
http_header headers 4eb279513f07f7ffaf2d19b40322bf2a5fe70ee7860a7e2dc2316155e07e36f7 
[
    "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), gamepad=(), hid=(), idle-detection=(), serial=(), unload=()"
]
caa_record dns 037f43d5216309eb9484949c2279c8859aabf22d171a5cbb4d8db072fae8c2e8 
{
    "flags": 0,
    "tag": "issue",
    "value": "sectigo.com"
}
11
To determine First observation

Evolution over time

This angle still needs additional public evidence

Angle 11

Evolution over time

To determine First observation

This angle still needs additional public evidence

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

0evidence
41changes
0open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
0
Signals
0
Changes
41
12
Documented Stable

Evidence and traceability

Public evidence provides enough material to document this angle

Angle 12

Evidence and traceability

Documented Stable

Public evidence provides enough material to document this angle

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

52evidence
0changes
0open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
52
Signals
3
Changes
0
caa_record dns 88ad8c62903bd998f00bb720f5f43ccfb945b9bd9b3a3ccbf29df62328a7a597 
{
    "flags": 0,
    "tag": "issue",
    "value": "ssl.com"
}
tls_valid_to tls adc9a815da67d5f82ae7e399d086a871229c59b5b0ad39f17ae7da745f6bc93a 
"2026-11-14T14:07:24+00:00"
module_finding mail_trust d1f0ec4fd038ee2230ac6e73a9f74266c74aa50137d4311d891de59b401ba1dd 
{
    "evidence": [
        {
            "host": "mta-gw.infomaniak.ch",
            "priority": 5
        }
    ],
    "severity": "low"
}
dns_address dns 207f1b2c1ef93c9272920ea1a2e109a3cf02531185ac5b4653164d6db2fabdf1 
"2606:4700:3031::ac43:831e"
caa_record dns d43e5cde3fe6cf816545dc84a4a3bb7fbde32a48db22f62ae00e1c9027e5be8b 
{
    "flags": 0,
    "tag": "iodef",
    "value": "mailto:security@0bla.com"
}
module_finding dns d7169fed1697eea2b2342dd1aacf8b1ec8dd699fcf096e775e7455806d4f0fe3 
{
    "evidence": [
        "david.ns.cloudflare.com",
        "thea.ns.cloudflare.com"
    ],
    "severity": "low"
}
dns_address dns de033d871f02b262bf9935ed22c148d2b43b6cce9d9f22f40ea670386c7f6448 
"172.67.131.30"
http_header headers a54f9fbcc16ae5780cb09d69d4a5823a722d9fb2c97129381f608b2d794cd298 
[
    "max-age=63072000; includeSubDomains; preload"
]
caa_record dns 5e3e1e052d05d6230058755bd5d275af0105a4983e61202871fbb675544a89c8 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "pki.goog; cansignhttpexchanges=yes"
}
mail_exchanger dns 7b37751c85e01b43c68201673910aedaaf302200936008d6d1421d6d185d601d 
"mta-gw.infomaniak.ch"
dependency_provider dependencies c65dd2899db54c1c547a7081dbbeb53f1ce50af461eb40f6c4412fe2fe2c3069 
{
    "critical": true,
    "hosts": [
        "cloudflare.com",
        "david.ns.cloudflare.com",
        "thea.ns.cloudflare.com"
    ],
    "id": "cloudflare",
    "known": true,
    "name": "Cloudflare",
    "observation_count": 3,
    "services": [
        "cdn",
        "security"
    ],
    "tracker": false
}
dependency_provider dependencies 1e0e4c2e7194c71cacc567eaaaf27145eae61b010f85458201f63823d2b0949f 
{
    "critical": false,
    "hosts": [
        "mta-gw.infomaniak.ch"
    ],
    "id": "infomaniak",
    "known": true,
    "name": "Infomaniak",
    "observation_count": 1,
    "services": [
        "dns",
        "hosting",
        "mail"
    ],
    "tracker": false
}
dmarc_policy mail_trust d5b9592f4d70de7f8757b01ecbda71c02d07aedaba965761c6cb3be7e21bc6f4 
"reject"
http_header headers 3b9bde6ae5bfa31f0e699c1d3c45c75c2882bff2511e9bded8859a9f3ccdf018 
[
    "same-origin"
]
caa_record dns bb5792415779adf9aae1cbd8b32de9e9132938c1ab8ae9090ff6541c7f9d1f95 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "ssl.com"
}
caa_record dns 8f9dc4bd6de6804762c744fbcf0b0e0e4c9588b17ce8ce4091110923fc8fce3f 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "letsencrypt.org"
}
mail_policy_flag mail_trust 7ee4b64795ef4a6e6534952234b96bd9f56d21c6ca4b048cfaffaad7f494f390 
false
tls_issuer tls 21dc11d89d8c1177c7a4e18ac8c4b905a4fca9242ff6045007de2a89f31cc7eb 
"C = US, O = Let's Encrypt, CN = YE2"
module_finding dns 10761c231b097efd961779c8d2b92571b4e273bc515e35c8aeebf9ce85175491 
{
    "evidence": {
        "reason": "No external validating resolver is used; DS validation is intentionally not inferred.",
        "status": "not_tested"
    },
    "severity": "info"
}
caa_record dns ccdef8c7fb74aa33117385797c19bdaa7fbe8b2f18d38ff2441d73ecc8c8cedc 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "digicert.com; cansignhttpexchanges=yes"
}
module_finding mail_trust 88679ad179cb067a132405fb4f25ec9f3f069a7c8c34774f90cd3895b840aaaf 
{
    "evidence": null,
    "severity": "low"
}
caa_record dns 6b0c2c30edba58bdfe31ce5a794d5e4b0822a2b2db70bb2e18e584933f009d1e 
{
    "flags": 0,
    "tag": "issue",
    "value": "pki.goog; cansignhttpexchanges=yes"
}
caa_record dns ddf530c83b6c4327f0d5e274b8b375ec49abebf2df443881f5c5844ad0a23c56 
{
    "flags": 0,
    "tag": "issue",
    "value": "digicert.com; cansignhttpexchanges=yes"
}
http_header headers 56620bd8950e7d7cf2791f5383d20ee1b7d0a73fc17187d65a8325ab39555ad9 
[
    "DENY"
]

Overview

What the domain already shows, and what still needs clarification

An overview of visible relationships and uncertainty areas that still need verification.

Visible relations

Visible relations around the domain

Relations are grouped by function. They describe what is publicly visible, not contracts or the full internal architecture.

Observed domain 0bla.com

DNS

2
DNS server Observed

david.ns.cloudflare.com

DNS server Observed

thea.ns.cloudflare.com

mail

1
Mail server Observed

mta-gw.infomaniak.ch

technology

1
Observed technology Observed

cloudflare

external resources

2
External provider or resource Corroborated

Cloudflare

External provider or resource Observed

Infomaniak

Open questions

4 areas to confirm

An unknown becomes useful information when it precisely explains what is missing to reach a conclusion.

To confirm

Origin hosting

An edge service does not reveal the origin hosting provider.

To confirm

Effective data location

Public provider metadata does not prove where data is actually processed.

To confirm

Post-quantum TLS exchange

This check was not run with a compatible client during this measurement.

To confirm

Public canary signal

Detection of this signal was not enabled for this measurement.

These items do not mean there is a problem. They simply show that useful information is still missing.

Sources and evidence

Evidence supporting this reading

52 evidence items are available. They remain collapsed to preserve a short reading and can be explored on demand.

52evidence items available

Each proof keeps its method, provenance, date, reliability and interpretation limits.

Download evidence JSON
Explore evidence
#01 DNS public records

Evidence: caa_record

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
{ "flags": 0, "tag": "issue", "value": "ssl.com" }
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "flags": 0,
    "tag": "issue",
    "value": "ssl.com"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#02 Public TLS endpoint

Evidence: tls_valid_to

TLS protects the observed connection between the scanner and the public service.

Active non-intrusive High
Why it matters

These elements document public-channel protection and the cryptographic mechanisms actually negotiated.

What to check next

Compare negotiated protocol, issuer, expiry, chain and cryptographic parameters with history. Check other public entry points separately.

Possible action

Address only observed gaps such as an expiring certificate, invalid chain, or unwanted protocol. Test changes in a controlled environment before deployment.

Observation
2026-11-14T14:07:24+00:00
Understand
TLS handshake and public certificate inspection
Source
Public TLS endpoint
Reliability
High
What this supports
Describe the TLS session and certificate presented to Scanapse
What this does not prove
Strong TLS does not prove application security or origin-server security behind a CDN or reverse proxy.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
2026-11-14T14:07:24+00:00

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#03 Mail-related public records

Evidence: module_finding

Public mail policies show how the domain frames sending, authentication and email transport.

Active non-intrusive High
Why it matters

These mechanisms can reduce domain spoofing and document mail-transport posture.

What to check next

Relate SPF, DKIM when a selector is known, DMARC, MX, MTA-STS and TLS-RPT. Compare policy changes over time.

Possible action

Before strengthening a policy, inventory legitimate mail flows and verify alignment. Roll out changes progressively to avoid blocking authorized senders.

Observation
{ "evidence": [ { "host": "mta-gw.infomaniak.ch", "priority": 5 } ], "severity": "low" }
Understand
Public DNS and policy endpoint inspection
Source
Mail-related public records
Reliability
High
What this supports
Describe published mail authentication and transport policies
What this does not prove
They do not prove actual deliverability, every recipient’s behavior, or the absence of phishing.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "evidence": [
        {
            "host": "mta-gw.infomaniak.ch",
            "priority": 5
        }
    ],
    "severity": "low"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#04 DNS public records

Evidence: dns_address

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
2606:4700:3031::ac43:831e
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

Verify it yourself

This command reproduces the public observation without changing the target.

dig A 0bla.com && dig AAAA 0bla.com
View raw data 
2606:4700:3031::ac43:831e

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#05 DNS public records

Evidence: caa_record

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
{ "flags": 0, "tag": "iodef", "value": "mailto:security@0bla.com" }
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "flags": 0,
    "tag": "iodef",
    "value": "mailto:security@0bla.com"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#06 DNS public records

Evidence: module_finding

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
{ "evidence": [ "david.ns.cloudflare.com", "thea.ns.cloudflare.com" ], "severity": "low" }
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "evidence": [
        "david.ns.cloudflare.com",
        "thea.ns.cloudflare.com"
    ],
    "severity": "low"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#07 DNS public records

Evidence: dns_address

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
172.67.131.30
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

Verify it yourself

This command reproduces the public observation without changing the target.

dig A 0bla.com && dig AAAA 0bla.com
View raw data 
172.67.131.30

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#08 Public HTTP response

Evidence: http_header

HTTP headers can ask the browser to enforce specific protections.

Active non-intrusive High
Why it matters

They are visible, verifiable browser-side defensive layers.

What to check next

Read each full policy, identify permissive or contradictory directives, and compare responses across the main public routes.

Possible action

Harden policies progressively from actual application needs. Avoid copying generic templates without functional testing.

Observation
[ "max-age=63072000; includeSubDomains; preload" ]
Understand
HTTP response-header inspection
Source
Public HTTP response
Reliability
High
What this supports
Describe defensive policies declared on the observed response
What this does not prove
A header being present does not prove it is optimal or that the application has no vulnerabilities.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
[
    "max-age=63072000; includeSubDomains; preload"
]

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#09 DNS public records

Evidence: caa_record

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
{ "flags": 0, "tag": "issuewild", "value": "pki.goog; cansignhttpexchanges=yes" }
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "pki.goog; cansignhttpexchanges=yes"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#10 DNS public records

Evidence: mail_exchanger

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
mta-gw.infomaniak.ch
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

Verify it yourself

This command reproduces the public observation without changing the target.

dig MX 0bla.com
View raw data 
mta-gw.infomaniak.ch

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#11 Observed public resources

Evidence: dependency_provider

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "critical": true, "hosts": [ "cloudflare.com", "david.ns.cloudflare.com", "thea.ns.cloudflare.com" ], "id": "cloudflare", "known": true, "name": "Cloudflare", "observation_count": 3, "services": [ "cdn", "security" ], "tracker": false }
Understand
Public HTML/resource dependency extraction and provider matching
Source
Observed public resources
Reliability
Medium
What this supports
Describe visible third-party dependencies
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "critical": true,
    "hosts": [
        "cloudflare.com",
        "david.ns.cloudflare.com",
        "thea.ns.cloudflare.com"
    ],
    "id": "cloudflare",
    "known": true,
    "name": "Cloudflare",
    "observation_count": 3,
    "services": [
        "cdn",
        "security"
    ],
    "tracker": false
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#12 Observed public resources

Evidence: dependency_provider

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "critical": false, "hosts": [ "mta-gw.infomaniak.ch" ], "id": "infomaniak", "known": true, "name": "Infomaniak", "observation_count": 1, "services": [ "dns", "hosting", "mail" ], "tracker": false }
Understand
Public HTML/resource dependency extraction and provider matching
Source
Observed public resources
Reliability
Medium
What this supports
Describe visible third-party dependencies
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "critical": false,
    "hosts": [
        "mta-gw.infomaniak.ch"
    ],
    "id": "infomaniak",
    "known": true,
    "name": "Infomaniak",
    "observation_count": 1,
    "services": [
        "dns",
        "hosting",
        "mail"
    ],
    "tracker": false
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#13 Mail-related public records

Evidence: dmarc_policy

Public mail policies show how the domain frames sending, authentication and email transport.

Active non-intrusive High
Why it matters

These mechanisms can reduce domain spoofing and document mail-transport posture.

What to check next

Relate SPF, DKIM when a selector is known, DMARC, MX, MTA-STS and TLS-RPT. Compare policy changes over time.

Possible action

Before strengthening a policy, inventory legitimate mail flows and verify alignment. Roll out changes progressively to avoid blocking authorized senders.

Observation
reject
Understand
Public DNS and policy endpoint inspection
Source
Mail-related public records
Reliability
High
What this supports
Describe published mail authentication and transport policies
What this does not prove
They do not prove actual deliverability, every recipient’s behavior, or the absence of phishing.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

Verify it yourself

This command reproduces the public observation without changing the target.

dig TXT _dmarc.0bla.com
View raw data 
reject

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#14 Public HTTP response

Evidence: http_header

HTTP headers can ask the browser to enforce specific protections.

Active non-intrusive High
Why it matters

They are visible, verifiable browser-side defensive layers.

What to check next

Read each full policy, identify permissive or contradictory directives, and compare responses across the main public routes.

Possible action

Harden policies progressively from actual application needs. Avoid copying generic templates without functional testing.

Observation
[ "same-origin" ]
Understand
HTTP response-header inspection
Source
Public HTTP response
Reliability
High
What this supports
Describe defensive policies declared on the observed response
What this does not prove
A header being present does not prove it is optimal or that the application has no vulnerabilities.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
[
    "same-origin"
]

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#15 DNS public records

Evidence: caa_record

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
{ "flags": 0, "tag": "issuewild", "value": "ssl.com" }
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "ssl.com"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#16 DNS public records

Evidence: caa_record

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
{ "flags": 0, "tag": "issuewild", "value": "letsencrypt.org" }
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "letsencrypt.org"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#17 Mail-related public records

Evidence: mail_policy_flag

Public mail policies show how the domain frames sending, authentication and email transport.

Active non-intrusive High
Why it matters

These mechanisms can reduce domain spoofing and document mail-transport posture.

What to check next

Relate SPF, DKIM when a selector is known, DMARC, MX, MTA-STS and TLS-RPT. Compare policy changes over time.

Possible action

Before strengthening a policy, inventory legitimate mail flows and verify alignment. Roll out changes progressively to avoid blocking authorized senders.

Observation
Understand
Public DNS and policy endpoint inspection
Source
Mail-related public records
Reliability
High
What this supports
Describe published mail authentication and transport policies
What this does not prove
They do not prove actual deliverability, every recipient’s behavior, or the absence of phishing.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#18 Public TLS endpoint

Evidence: tls_issuer

TLS protects the observed connection between the scanner and the public service.

Active non-intrusive High
Why it matters

These elements document public-channel protection and the cryptographic mechanisms actually negotiated.

What to check next

Compare negotiated protocol, issuer, expiry, chain and cryptographic parameters with history. Check other public entry points separately.

Possible action

Address only observed gaps such as an expiring certificate, invalid chain, or unwanted protocol. Test changes in a controlled environment before deployment.

Observation
C = US, O = Let's Encrypt, CN = YE2
Understand
TLS handshake and public certificate inspection
Source
Public TLS endpoint
Reliability
High
What this supports
Describe the TLS session and certificate presented to Scanapse
What this does not prove
Strong TLS does not prove application security or origin-server security behind a CDN or reverse proxy.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

Verify it yourself

This command reproduces the public observation without changing the target.

openssl s_client -connect 0bla.com:443 -servername 0bla.com </dev/null
View raw data 
C = US, O = Let's Encrypt, CN = YE2

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#19 DNS public records

Evidence: module_finding

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
{ "evidence": { "reason": "No external validating resolver is used; DS validation is intentionally not inferred.", "status": "not_tested" }, "severity": "info" }
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "evidence": {
        "reason": "No external validating resolver is used; DS validation is intentionally not inferred.",
        "status": "not_tested"
    },
    "severity": "info"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#20 DNS public records

Evidence: caa_record

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
{ "flags": 0, "tag": "issuewild", "value": "digicert.com; cansignhttpexchanges=yes" }
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "digicert.com; cansignhttpexchanges=yes"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#21 Mail-related public records

Evidence: module_finding

Public mail policies show how the domain frames sending, authentication and email transport.

Active non-intrusive High
Why it matters

These mechanisms can reduce domain spoofing and document mail-transport posture.

What to check next

Relate SPF, DKIM when a selector is known, DMARC, MX, MTA-STS and TLS-RPT. Compare policy changes over time.

Possible action

Before strengthening a policy, inventory legitimate mail flows and verify alignment. Roll out changes progressively to avoid blocking authorized senders.

Observation
{ "evidence": null, "severity": "low" }
Understand
Public DNS and policy endpoint inspection
Source
Mail-related public records
Reliability
High
What this supports
Describe published mail authentication and transport policies
What this does not prove
They do not prove actual deliverability, every recipient’s behavior, or the absence of phishing.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "evidence": null,
    "severity": "low"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#22 DNS public records

Evidence: caa_record

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
{ "flags": 0, "tag": "issue", "value": "pki.goog; cansignhttpexchanges=yes" }
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "flags": 0,
    "tag": "issue",
    "value": "pki.goog; cansignhttpexchanges=yes"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#23 DNS public records

Evidence: caa_record

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
{ "flags": 0, "tag": "issue", "value": "digicert.com; cansignhttpexchanges=yes" }
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "flags": 0,
    "tag": "issue",
    "value": "digicert.com; cansignhttpexchanges=yes"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#24 Public HTTP response

Evidence: http_header

HTTP headers can ask the browser to enforce specific protections.

Active non-intrusive High
Why it matters

They are visible, verifiable browser-side defensive layers.

What to check next

Read each full policy, identify permissive or contradictory directives, and compare responses across the main public routes.

Possible action

Harden policies progressively from actual application needs. Avoid copying generic templates without functional testing.

Observation
[ "DENY" ]
Understand
HTTP response-header inspection
Source
Public HTTP response
Reliability
High
What this supports
Describe defensive policies declared on the observed response
What this does not prove
A header being present does not prove it is optimal or that the application has no vulnerabilities.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
[
    "DENY"
]

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#25 Public HTTP response

Evidence: http_header

HTTP headers can ask the browser to enforce specific protections.

Active non-intrusive High
Why it matters

They are visible, verifiable browser-side defensive layers.

What to check next

Read each full policy, identify permissive or contradictory directives, and compare responses across the main public routes.

Possible action

Harden policies progressively from actual application needs. Avoid copying generic templates without functional testing.

Observation
[ "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), gamepad=(), hid=(), idle-detection=(), serial=(), unload=()" ]
Understand
HTTP response-header inspection
Source
Public HTTP response
Reliability
High
What this supports
Describe defensive policies declared on the observed response
What this does not prove
A header being present does not prove it is optimal or that the application has no vulnerabilities.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
[
    "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), gamepad=(), hid=(), idle-detection=(), serial=(), unload=()"
]

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#26 technology

Evidence: technology

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "name": "cloudflare", "version": "", "version_exposed": false }
Understand
Public observation
Source
technology
Reliability
Medium
What this supports
Describe the observed public artefact
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "name": "cloudflare",
    "version": "",
    "version_exposed": false
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#27 DNS public records

Evidence: caa_record

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
{ "flags": 0, "tag": "issue", "value": "sectigo.com" }
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "flags": 0,
    "tag": "issue",
    "value": "sectigo.com"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#28 Mail-related public records

Evidence: module_finding

Public mail policies show how the domain frames sending, authentication and email transport.

Active non-intrusive High
Why it matters

These mechanisms can reduce domain spoofing and document mail-transport posture.

What to check next

Relate SPF, DKIM when a selector is known, DMARC, MX, MTA-STS and TLS-RPT. Compare policy changes over time.

Possible action

Before strengthening a policy, inventory legitimate mail flows and verify alignment. Roll out changes progressively to avoid blocking authorized senders.

Observation
{ "evidence": null, "severity": "low" }
Understand
Public DNS and policy endpoint inspection
Source
Mail-related public records
Reliability
High
What this supports
Describe published mail authentication and transport policies
What this does not prove
They do not prove actual deliverability, every recipient’s behavior, or the absence of phishing.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "evidence": null,
    "severity": "low"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#29 module_finding

Evidence: module_finding

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "evidence": [ "david.ns.cloudflare.com", "thea.ns.cloudflare.com" ], "severity": "medium" }
Understand
Public observation
Source
module_finding
Reliability
Medium
What this supports
Describe the observed public artefact
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "evidence": [
        "david.ns.cloudflare.com",
        "thea.ns.cloudflare.com"
    ],
    "severity": "medium"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#30 Mail-related public records

Evidence: spf_policy

Public mail policies show how the domain frames sending, authentication and email transport.

Active non-intrusive High
Why it matters

These mechanisms can reduce domain spoofing and document mail-transport posture.

What to check next

Relate SPF, DKIM when a selector is known, DMARC, MX, MTA-STS and TLS-RPT. Compare policy changes over time.

Possible action

Before strengthening a policy, inventory legitimate mail flows and verify alignment. Roll out changes progressively to avoid blocking authorized senders.

Observation
hardfail
Understand
Public DNS and policy endpoint inspection
Source
Mail-related public records
Reliability
High
What this supports
Describe published mail authentication and transport policies
What this does not prove
They do not prove actual deliverability, every recipient’s behavior, or the absence of phishing.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

Verify it yourself

This command reproduces the public observation without changing the target.

dig TXT 0bla.com
View raw data 
hardfail

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#31 DNS public records

Evidence: dns_address

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
104.21.9.251
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

Verify it yourself

This command reproduces the public observation without changing the target.

dig A 0bla.com && dig AAAA 0bla.com
View raw data 
104.21.9.251

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#32 DNS public records

Evidence: dmarc_record

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
v=DMARC1; p=reject;
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
v=DMARC1; p=reject;

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#33 Public HTTP response

Evidence: http_header

HTTP headers can ask the browser to enforce specific protections.

Active non-intrusive High
Why it matters

They are visible, verifiable browser-side defensive layers.

What to check next

Read each full policy, identify permissive or contradictory directives, and compare responses across the main public routes.

Possible action

Harden policies progressively from actual application needs. Avoid copying generic templates without functional testing.

Observation
[ "default-src 'none'; script-src 'self' 'nonce-6DRbkX9AG5HKlbENqeuAtw=='; style-src 'self' 'nonce-6DRbkX9AG5HKlbENqeuAtw=='; font-src 'self'; img-src 'self' data: https://lh3.googleusercontent.com; connect-src 'self'; manifest-src 'self'; form-action 'self' https://formspree.io; frame-ancestors 'none'; base-uri 'none'; object-src 'none';" ]
Understand
HTTP response-header inspection
Source
Public HTTP response
Reliability
High
What this supports
Describe defensive policies declared on the observed response
What this does not prove
A header being present does not prove it is optimal or that the application has no vulnerabilities.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
[
    "default-src 'none'; script-src 'self' 'nonce-6DRbkX9AG5HKlbENqeuAtw=='; style-src 'self' 'nonce-6DRbkX9AG5HKlbENqeuAtw=='; font-src 'self'; img-src 'self' data: https://lh3.googleusercontent.com; connect-src 'self'; manifest-src 'self'; form-action 'self' https://formspree.io; frame-ancestors 'none'; base-uri 'none'; object-src 'none';"
]

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#34 Public HTTP response

Evidence: http_header

HTTP headers can ask the browser to enforce specific protections.

Active non-intrusive High
Why it matters

They are visible, verifiable browser-side defensive layers.

What to check next

Read each full policy, identify permissive or contradictory directives, and compare responses across the main public routes.

Possible action

Harden policies progressively from actual application needs. Avoid copying generic templates without functional testing.

Observation
[ "same-origin" ]
Understand
HTTP response-header inspection
Source
Public HTTP response
Reliability
High
What this supports
Describe defensive policies declared on the observed response
What this does not prove
A header being present does not prove it is optimal or that the application has no vulnerabilities.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
[
    "same-origin"
]

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#35 DNS public records

Evidence: caa_record

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
{ "flags": 0, "tag": "issuewild", "value": "comodoca.com" }
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "comodoca.com"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#36 Public HTTP response

Evidence: http_header

HTTP headers can ask the browser to enforce specific protections.

Active non-intrusive High
Why it matters

They are visible, verifiable browser-side defensive layers.

What to check next

Read each full policy, identify permissive or contradictory directives, and compare responses across the main public routes.

Possible action

Harden policies progressively from actual application needs. Avoid copying generic templates without functional testing.

Observation
[ "nosniff" ]
Understand
HTTP response-header inspection
Source
Public HTTP response
Reliability
High
What this supports
Describe defensive policies declared on the observed response
What this does not prove
A header being present does not prove it is optimal or that the application has no vulnerabilities.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
[
    "nosniff"
]

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#37 module_finding

Evidence: module_finding

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "evidence": { "provider": "Cloudflare", "share": 75 }, "severity": "medium" }
Understand
Public observation
Source
module_finding
Reliability
Medium
What this supports
Describe the observed public artefact
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "evidence": {
        "provider": "Cloudflare",
        "share": 75
    },
    "severity": "medium"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#38 Observed public resources

Evidence: module_finding

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "evidence": "75%", "severity": "medium" }
Understand
Public HTML/resource dependency extraction and provider matching
Source
Observed public resources
Reliability
Medium
What this supports
Describe visible third-party dependencies
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "evidence": "75%",
    "severity": "medium"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#39 DNS public records

Evidence: dns_nameserver

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
david.ns.cloudflare.com
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

Verify it yourself

This command reproduces the public observation without changing the target.

dig NS 0bla.com
View raw data 
david.ns.cloudflare.com

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#40 Mail-related public records

Evidence: mail_policy_flag

Public mail policies show how the domain frames sending, authentication and email transport.

Active non-intrusive High
Why it matters

These mechanisms can reduce domain spoofing and document mail-transport posture.

What to check next

Relate SPF, DKIM when a selector is known, DMARC, MX, MTA-STS and TLS-RPT. Compare policy changes over time.

Possible action

Before strengthening a policy, inventory legitimate mail flows and verify alignment. Roll out changes progressively to avoid blocking authorized senders.

Observation
Understand
Public DNS and policy endpoint inspection
Source
Mail-related public records
Reliability
High
What this supports
Describe published mail authentication and transport policies
What this does not prove
They do not prove actual deliverability, every recipient’s behavior, or the absence of phishing.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#41 Mail-related public records

Evidence: mail_policy_flag

Public mail policies show how the domain frames sending, authentication and email transport.

Active non-intrusive High
Why it matters

These mechanisms can reduce domain spoofing and document mail-transport posture.

What to check next

Relate SPF, DKIM when a selector is known, DMARC, MX, MTA-STS and TLS-RPT. Compare policy changes over time.

Possible action

Before strengthening a policy, inventory legitimate mail flows and verify alignment. Roll out changes progressively to avoid blocking authorized senders.

Observation
Understand
Public DNS and policy endpoint inspection
Source
Mail-related public records
Reliability
High
What this supports
Describe published mail authentication and transport policies
What this does not prove
They do not prove actual deliverability, every recipient’s behavior, or the absence of phishing.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#42 Observed public page

Evidence: cookie

Scanapse describes only privacy signals visible on the observed public journey.

Passive Medium
Why it matters

This separates what the browser actually encounters from what cannot be measured externally.

What to check next

Relate visible cookies and third parties to actual features, then compare those observations with internal documentation when the organisation has it.

Possible action

Remove unnecessary trackers or cookies and document the purposes of required elements. Any legal assessment must remain separate from the external scan.

Observation
{ "http_only": true, "name": "id", "same_site": "lax", "secure": true }
Understand
Visible cookies and tracker signatures on the public response
Source
Observed public page
Reliability
Medium
What this supports
Describe visible privacy-related signals
What this does not prove
This observation is never a GDPR audit and does not reveal every purpose or internal processing activity.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "http_only": true,
    "name": "id",
    "same_site": "lax",
    "secure": true
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#43 DNS public records

Evidence: caa_record

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
{ "flags": 0, "tag": "issue", "value": "letsencrypt.org" }
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "flags": 0,
    "tag": "issue",
    "value": "letsencrypt.org"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#44 Public HTTP response

Evidence: http_header

HTTP headers can ask the browser to enforce specific protections.

Active non-intrusive High
Why it matters

They are visible, verifiable browser-side defensive layers.

What to check next

Read each full policy, identify permissive or contradictory directives, and compare responses across the main public routes.

Possible action

Harden policies progressively from actual application needs. Avoid copying generic templates without functional testing.

Observation
[ "cloudflare" ]
Understand
HTTP response-header inspection
Source
Public HTTP response
Reliability
High
What this supports
Describe defensive policies declared on the observed response
What this does not prove
A header being present does not prove it is optimal or that the application has no vulnerabilities.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
[
    "cloudflare"
]

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#45 DNS public records

Evidence: dns_address

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
2606:4700:3032::6815:9fb
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

Verify it yourself

This command reproduces the public observation without changing the target.

dig A 0bla.com && dig AAAA 0bla.com
View raw data 
2606:4700:3032::6815:9fb

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#46 DNS public records

Evidence: spf_record

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
v=spf1 include:spf.infomaniak.ch -all
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
v=spf1 include:spf.infomaniak.ch -all

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#47 DNS public records

Evidence: caa_record

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
{ "flags": 0, "tag": "issue", "value": "comodoca.com" }
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "flags": 0,
    "tag": "issue",
    "value": "comodoca.com"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#48 DNS public records

Evidence: dns_nameserver

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
thea.ns.cloudflare.com
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

Verify it yourself

This command reproduces the public observation without changing the target.

dig NS 0bla.com
View raw data 
thea.ns.cloudflare.com

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#49 Public HTTP response

Evidence: http_header

HTTP headers can ask the browser to enforce specific protections.

Active non-intrusive High
Why it matters

They are visible, verifiable browser-side defensive layers.

What to check next

Read each full policy, identify permissive or contradictory directives, and compare responses across the main public routes.

Possible action

Harden policies progressively from actual application needs. Avoid copying generic templates without functional testing.

Observation
[ "strict-origin-when-cross-origin" ]
Understand
HTTP response-header inspection
Source
Public HTTP response
Reliability
High
What this supports
Describe defensive policies declared on the observed response
What this does not prove
A header being present does not prove it is optimal or that the application has no vulnerabilities.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
[
    "strict-origin-when-cross-origin"
]

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#50 Public HTTP response

Evidence: http_header

HTTP headers can ask the browser to enforce specific protections.

Active non-intrusive High
Why it matters

They are visible, verifiable browser-side defensive layers.

What to check next

Read each full policy, identify permissive or contradictory directives, and compare responses across the main public routes.

Possible action

Harden policies progressively from actual application needs. Avoid copying generic templates without functional testing.

Observation
[ "require-corp" ]
Understand
HTTP response-header inspection
Source
Public HTTP response
Reliability
High
What this supports
Describe defensive policies declared on the observed response
What this does not prove
A header being present does not prove it is optimal or that the application has no vulnerabilities.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
[
    "require-corp"
]

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#51 DNS public records

Evidence: caa_record

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
{ "flags": 0, "tag": "issuewild", "value": "sectigo.com" }
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "flags": 0,
    "tag": "issuewild",
    "value": "sectigo.com"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

#52 module_finding

Evidence: module_finding

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "evidence": [ "Cloudflare" ], "severity": "high" }
Understand
Public observation
Source
module_finding
Reliability
Medium
What this supports
Describe the observed public artefact
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "evidence": [
        "Cloudflare"
    ],
    "severity": "high"
}

Rule 2026.09.4 · 2026-09-04T22:03:56+00:00

Show technical details 
{
    "schema_version": "2.0",
    "engine_version": "2.6.2",
    "pattern_version": "2026.09.4",
    "scope": {
        "mode": "passive",
        "coverage": "full",
        "access_level": "full",
        "access_reason": "public_document_available",
        "requests": 2,
        "homepage_only": true,
        "javascript_executed": false,
        "ports_scanned": false,
        "private_networks_blocked": true,
        "protection_bypassed": false,
        "max_body_bytes": 1572864,
        "scan_budget_seconds": 24,
        "budget_exhausted": false,
        "transport": "curl_with_socket_fallback"
    },
    "entity": {
        "id": "f7cb4d0842a25fff2ab5e4b95d41fa5aa75d0cd016f22e0c6efb9e1a35930394",
        "display_name": "0bla.com",
        "slug": "0bla-com",
        "entity_type": "domain_subject",
        "auto_created": true,
        "primary_asset": "0bla.com"
    },
    "methodology": {
        "version": "2.3.1",
        "model": "evidence_first",
        "principles": [
            "absence_of_evidence_is_not_evidence_of_absence",
            "unknown_remains_unknown",
            "provider_metadata_is_not_data_location",
            "edge_provider_is_not_origin_host",
            "single_snapshot_does_not_prove_resilience"
        ]
    },
    "trajectory_summary": {
        "has_previous_scan": true,
        "change_counts": {
            "modified": 2,
            "stable": 39
        },
        "observation_count": 52,
        "evidence_count": 52,
        "provider_count": 2,
        "strategic_signal_count": 1,
        "top_signal_count": 1
    }
}