{
  "kind": "PREVIOUSLY_RETAINED_CONTEMPORANEOUS_DNS_ZONE_VIEWS",
  "newNetworkQueries": 0,
  "retainedQueries": [
    {
      "serverQueried": "chad.ns.cloudflare.com",
      "nameQueried": "debugbear.com",
      "recordType": "NS",
      "recordedUTC": "2026-10-29T18:28:06Z",
      "originalTimeAsDisplayed": "Thu Oct29 19:28:06CET2026",
      "capsule": "capsules/dns-chad-debugbear.com-NS.txt",
      "originalPath": "evidence/infra-followup/auth-chad.ns.cloudflare.com-debugbear.com-NS.txt",
      "SHA256": "e8e7a474c3f00aabd7226f5c0e45ad9c7c0a323461408210cec654ae58295907",
      "parsed": {
        "status": "NOERROR",
        "authoritativeFlag": true,
        "records": [
          {
            "name": "debugbear.com.",
            "TTL": 86400,
            "type": "NS",
            "value": "chad.ns.cloudflare.com."
          },
          {
            "name": "debugbear.com.",
            "TTL": 86400,
            "type": "NS",
            "value": "meiling.ns.cloudflare.com."
          }
        ]
      }
    },
    {
      "serverQueried": "chad.ns.cloudflare.com",
      "nameQueried": "cdn.debugbear.com",
      "recordType": "A",
      "recordedUTC": "2026-10-29T18:28:06Z",
      "originalTimeAsDisplayed": "Thu Oct29 19:28:06CET2026",
      "capsule": "capsules/dns-chad-cdn.debugbear.com-A.txt",
      "originalPath": "evidence/infra-followup/auth-chad.ns.cloudflare.com-cdn.debugbear.com-A.txt",
      "SHA256": "0ff42da8835bbb26c919f36068024e6b3fd6d9ae4105b9b462d570d99695d7b3",
      "parsed": {
        "status": "NXDOMAIN",
        "authoritativeFlag": true,
        "records": []
      }
    },
    {
      "serverQueried": "chad.ns.cloudflare.com",
      "nameQueried": "data.debugbear.com",
      "recordType": "A",
      "recordedUTC": "2026-10-29T18:28:06Z",
      "originalTimeAsDisplayed": "Thu Oct29 19:28:06CET2026",
      "capsule": "capsules/dns-chad-data.debugbear.com-A.txt",
      "originalPath": "evidence/infra-followup/auth-chad.ns.cloudflare.com-data.debugbear.com-A.txt",
      "SHA256": "74c7e9f3c97475feacc1e56d5da56aeb90c594e162f62857de36d062382a4197",
      "parsed": {
        "status": "NXDOMAIN",
        "authoritativeFlag": true,
        "records": []
      }
    },
    {
      "serverQueried": "elisabeth.ns.cloudflare.com",
      "nameQueried": "debugbear.com",
      "recordType": "NS",
      "recordedUTC": "2026-10-29T18:28:06Z",
      "originalTimeAsDisplayed": "Thu Oct29 19:28:06CET2026",
      "capsule": "capsules/dns-elisabeth-debugbear.com-NS.txt",
      "originalPath": "evidence/infra-followup/auth-elisabeth.ns.cloudflare.com-debugbear.com-NS.txt",
      "SHA256": "f45a784298827f0ded36ab3be0d7c76a76dfecb824eed0829e07de68511b5a8a",
      "parsed": {
        "status": "NOERROR",
        "authoritativeFlag": true,
        "records": [
          {
            "name": "debugbear.com.",
            "TTL": 86400,
            "type": "NS",
            "value": "elisabeth.ns.cloudflare.com."
          },
          {
            "name": "debugbear.com.",
            "TTL": 86400,
            "type": "NS",
            "value": "karl.ns.cloudflare.com."
          }
        ]
      }
    },
    {
      "serverQueried": "elisabeth.ns.cloudflare.com",
      "nameQueried": "cdn.debugbear.com",
      "recordType": "A",
      "recordedUTC": "2026-10-29T18:28:06Z",
      "originalTimeAsDisplayed": "Thu Oct29 19:28:06CET2026",
      "capsule": "capsules/dns-elisabeth-cdn.debugbear.com-A.txt",
      "originalPath": "evidence/infra-followup/auth-elisabeth.ns.cloudflare.com-cdn.debugbear.com-A.txt",
      "SHA256": "4b05019afe90bce1319e381a09aa43e8c4434099340e0029bec8c82594654f69",
      "parsed": {
        "status": "NOERROR",
        "authoritativeFlag": true,
        "records": [
          {
            "name": "cdn.debugbear.com.",
            "TTL": 300,
            "type": "A",
            "value": "104.20.25.234"
          },
          {
            "name": "cdn.debugbear.com.",
            "TTL": 300,
            "type": "A",
            "value": "172.66.164.11"
          }
        ]
      }
    },
    {
      "serverQueried": "elisabeth.ns.cloudflare.com",
      "nameQueried": "data.debugbear.com",
      "recordType": "A",
      "recordedUTC": "2026-10-29T18:28:06Z",
      "originalTimeAsDisplayed": "Thu Oct29 19:28:06CET2026",
      "capsule": "capsules/dns-elisabeth-data.debugbear.com-A.txt",
      "originalPath": "evidence/infra-followup/auth-elisabeth.ns.cloudflare.com-data.debugbear.com-A.txt",
      "SHA256": "6d78ea44d9ef1f57b7485a8fdb2cf5da1775ff90aa629e5c754b596aade4676b",
      "parsed": {
        "status": "NOERROR",
        "authoritativeFlag": true,
        "records": [
          {
            "name": "data.debugbear.com.",
            "TTL": 300,
            "type": "A",
            "value": "104.20.25.234"
          },
          {
            "name": "data.debugbear.com.",
            "TTL": 300,
            "type": "A",
            "value": "172.66.164.11"
          }
        ]
      }
    }
  ],
  "retainedRegistryObservation": {
    "source": "evidence/infra-followup/rdap.json",
    "sourceSHA256": "cc2f422922491f35f9b25a621b94bf295fada91c2e7569233d22e558b8f54656",
    "recordedDatabaseUpdateUTC": "2026-10-29T18:26:45Z",
    "nameservers": [
      "CHAD.NS.CLOUDFLARE.COM",
      "MEILING.NS.CLOUDFLARE.COM"
    ]
  },
  "finding": "At18:28:06UTC, queriedCHADansweredauthoritativeNXDOMAINforcdn/data, whilequeriedELISABETHansweredNOERRORwith104.20.25.234and172.66.164.11. Bothserversreturnedself-zoneNSsetswithAAflags. The retainedregistrylistedCHAD/MEILING.",
  "historyBoundary": "These are two queried zone views at one time, not an authenticated parent-delegation change log. An AA flag is the server’s response flag, not DNSSEC or proof of rightful control. Neither zone is classified as attacker-controlled or legitimate/recovery.",
  "sourceClassCorrection": "The previous public-provider pass recovered no new historical host record. It did not erase these already-retainedOct29DNS observations. They are newly reconciled here, not newly discovered network records.",
  "olderWHOISProvenance": {
    "sourceURLsAsCitedByPriorSummary": [
      "https://www.ipaddress.com/website/debugbear.com/",
      "https://www.scam-detector.com/validator/debugbear-com-review/"
    ],
    "sourceClass": "Secondary public WHOIS/directory pages cited by the original infrastructure summary. Exact retained page bodies and original snapshot dates were not located in this audit.",
    "notPromotedToPrimaryDelegationHistory": true
  },
  "networkLimit": "SharedCloudflareedgeIPaddresses do not reveal an origin server, tenant account or attacker. No liveDNS/CDNquery was made in this pass."
}