{
  "completedUTC": "2026-10-31T19:43:28.065280+00:00",
  "result": "No exact certificate DER, SPKI public-key or DNS SAN match to the retained DebugBear leaf among64 returned certificate entries.",
  "queries": [
    {
      "domain": "flap.sh",
      "URL": "https://api.certspotter.com/v1/issuances?domain=flap.sh&include_subdomains=true&expand=cert_der",
      "HTTP": 200,
      "returnedEntries": 47,
      "nextLinkUnfollowed": "<https://api.certspotter.com/issuances?after=18085085657&domain=flap.sh&expand=cert_der&include_subdomains=true>; rel=\"next\""
    },
    {
      "domain": "kintsu.xyz",
      "URL": "https://api.certspotter.com/v1/issuances?domain=kintsu.xyz&include_subdomains=true&expand=cert_der",
      "HTTP": 200,
      "returnedEntries": 17,
      "nextLinkUnfollowed": "<https://api.certspotter.com/issuances?after=18083204085&domain=kintsu.xyz&expand=cert_der&include_subdomains=true>; rel=\"next\""
    }
  ],
  "specificFlapValidityStartMatch": {
    "issuanceID": "18080698766",
    "DER_SHA256": "932f8d8361148ce77a576d88753f1b8601260b581bf4b9be92b8ba9d1942b257",
    "SPKI_SHA256": "b2b970b4c46a93aae3b4002a285105a67687761f307871f965220d3821aaaf00",
    "DERMatchesDebugBear": false,
    "SPKIMatchesDebugBear": false,
    "DNS_SANs": [
      "flap.sh",
      "www.flap.sh"
    ],
    "ExactSANOverlapWithDebugBear": [],
    "notBeforeUTC": "2026-10-30T23:53:03+00:00",
    "notAfterUTC": "2027-01-28T23:53:02+00:00",
    "embeddedSCTs": [
      {
        "timestampUTC": "2026-10-31T00:51:33.911000+00:00",
        "logID": "1c9f682ce9faf0456950f81b968a87dddb3210d84ce6c8b2e382524ac4cf599f"
      },
      {
        "timestampUTC": "2026-10-31T00:51:30.568000+00:00",
        "logID": "44e822fc2bab0e92eed0e9fad69664602776d01760e0890509c923a1b03fc37f"
      }
    ]
  },
  "specificFlapScope": "This certificate has the reported Flap validity start and domain SANs. Public CT data alone does not prove it was served by the malicious frontend or the reported IP. No live frontend/IP visited.",
  "chronology": "Flap validity starts2026-10-30 23:53:03UTC; its embedded SCT timestamps are2026-10-31 00:51:30.568 and00:51:33.911UTC. Validity start is not an independently established issuance or DNS takeover time.",
  "baselineDER_SHA256": "684bf11322b411cd14bf2de9192ea0bb0702cc6cbcf2c79febc30267f37fdae2",
  "baselineSPKI_SHA256": "f557256ddbca032685047695cb138b23a825f944e713bc35b94c16bdd7ad70f8",
  "coverage": "Exactly2 requests. Both responses have next links, which were not followed. This is a bounded returned-entry comparison, not exhaustive CT history or proof that the incidents have different operators.",
  "proof": "CERTIFICATE-KEY-COMPARISON.json",
  "replay": "verify_tls_comparison_offline.py",
  "noArticleBodySelected": true
}