{
  "run_date": "2026-10-28",
  "events": [
    {
      "id": "76901157-757c-42fe-b73f-d6e13480fba1",
      "domain": "missionaustralia.com.au",
      "domain_id": "3ecf7362-bf67-4da1-a54d-a0f19a6cc4cf",
      "cohort": "nfp-watchlist",
      "cohort_label": "Nfp Watchlist",
      "event_type": "nameservers_changed",
      "event_label": "Nameserver change",
      "event_time": "2026-10-27T21:20:36.749256+00:00",
      "summary": "missionaustralia.com.au: nameservers changed",
      "old_value": [
        "ns1-02.azure-dns.com",
        "ns2-02.azure-dns.net"
      ],
      "new_value": [
        "ns1-02.azure-dns.com",
        "ns2-02.azure-dns.net",
        "ns3-02.azure-dns.org",
        "ns4-02.azure-dns.info"
      ],
      "category": "delegation",
      "severity": "medium",
      "materiality": "material",
      "event_scope": "observatory",
      "snapshot_id": "30d8884c-04fa-4bde-a74c-8b8d540fb8d2",
      "signal_tier": "tier_1",
      "signal_label": "High-signal trust posture change",
      "certainty": "Observed",
      "visible_by_default": true,
      "collapse_by_default": false
    },
    {
      "id": "5fdd5823-7e0b-41cd-94eb-55d2e42af631",
      "domain": "sydney.edu.au",
      "domain_id": "765c7ce3-77b6-4f53-8654-d18a4e8f7580",
      "cohort": "education-watchlist",
      "cohort_label": "Education Watchlist",
      "event_type": "nameservers_changed",
      "event_label": "Nameserver change",
      "event_time": "2026-10-27T21:19:19.214434+00:00",
      "summary": "sydney.edu.au: nameservers changed",
      "old_value": [
        "dns-1.sydney.edu.au",
        "dns-2.sydney.edu.au",
        "extro.ucc.usyd.edu.au",
        "metro.ucc.usyd.edu.au",
        "ns-440.awsdns-55.com",
        "ns1.aarnet.net.au",
        "ns2.aarnet.net.au",
        "ns3.aarnet.net.au"
      ],
      "new_value": [
        "dns-1.sydney.edu.au",
        "dns-2.sydney.edu.au",
        "extro.ucc.usyd.edu.au",
        "metro.ucc.usyd.edu.au",
        "ns1.aarnet.net.au",
        "ns2.aarnet.net.au",
        "ns3.aarnet.net.au"
      ],
      "category": "delegation",
      "severity": "medium",
      "materiality": "material",
      "event_scope": "observatory",
      "snapshot_id": "fe786e6e-e5d4-4534-a799-f7b7a2287380",
      "signal_tier": "tier_1",
      "signal_label": "High-signal trust posture change",
      "certainty": "Observed",
      "visible_by_default": true,
      "collapse_by_default": false
    },
    {
      "id": "8a7a6f2b-80cd-4da0-8314-54a14545e093",
      "domain": "unimelb.edu.au",
      "domain_id": "5bcc8436-9604-45e9-9b0f-c8d590115aa4",
      "cohort": "education-watchlist",
      "cohort_label": "Education Watchlist",
      "event_type": "nameservers_changed",
      "event_label": "Nameserver change",
      "event_time": "2026-10-27T21:21:42.543911+00:00",
      "summary": "unimelb.edu.au: nameservers changed",
      "old_value": [
        "edns-266.unimelb.net.au",
        "edns-396.unimelb.net.au",
        "ns1.aarnet.net.au",
        "ns2.aarnet.net.au",
        "ns3.aarnet.net.au"
      ],
      "new_value": [
        "ns1.aarnet.net.au",
        "ns2.aarnet.net.au",
        "ns3.aarnet.net.au"
      ],
      "category": "delegation",
      "severity": "medium",
      "materiality": "material",
      "event_scope": "observatory",
      "snapshot_id": "411dad39-0c2b-401f-a0fb-983fea07cf96",
      "signal_tier": "tier_1",
      "signal_label": "High-signal trust posture change",
      "certainty": "Observed",
      "visible_by_default": true,
      "collapse_by_default": false
    },
    {
      "id": "771082a5-5dcd-449f-a13f-4d909d7a44c9",
      "domain": "sydney.edu.au",
      "domain_id": "765c7ce3-77b6-4f53-8654-d18a4e8f7580",
      "cohort": "education-watchlist",
      "cohort_label": "Education Watchlist",
      "event_type": "hosting_move_signal",
      "event_label": "Hosting Move Signal",
      "event_time": "2026-10-27T21:19:20.766730+00:00",
      "summary": "sydney.edu.au: nameserver and Provider Catalogue association changed together",
      "old_value": {
        "provider": {
          "state": "matched",
          "provider_ids": [
            "amazon"
          ]
        },
        "nameservers": [
          "dns-1.sydney.edu.au",
          "dns-2.sydney.edu.au",
          "extro.ucc.usyd.edu.au",
          "metro.ucc.usyd.edu.au",
          "ns-440.awsdns-55.com",
          "ns1.aarnet.net.au",
          "ns2.aarnet.net.au",
          "ns3.aarnet.net.au"
        ]
      },
      "new_value": {
        "provider": {
          "state": "unmatched",
          "provider_ids": []
        },
        "nameservers": [
          "dns-1.sydney.edu.au",
          "dns-2.sydney.edu.au",
          "extro.ucc.usyd.edu.au",
          "metro.ucc.usyd.edu.au",
          "ns1.aarnet.net.au",
          "ns2.aarnet.net.au",
          "ns3.aarnet.net.au"
        ]
      },
      "category": "derived",
      "severity": "high",
      "materiality": "material",
      "event_scope": "observatory",
      "snapshot_id": "fe786e6e-e5d4-4534-a799-f7b7a2287380",
      "signal_tier": "tier_2",
      "signal_label": "Meaningful infrastructure movement",
      "certainty": "Observed",
      "visible_by_default": true,
      "collapse_by_default": false
    },
    {
      "id": "aa6e9b0a-19f6-4c4f-9990-8456691117d7",
      "domain": "sydney.edu.au",
      "domain_id": "765c7ce3-77b6-4f53-8654-d18a4e8f7580",
      "cohort": "education-watchlist",
      "cohort_label": "Education Watchlist",
      "event_type": "dns_provider_changed",
      "event_label": "DNS provider change",
      "event_time": "2026-10-27T21:19:20.407637+00:00",
      "summary": "sydney.edu.au: dns_hosting provider association changed with observed infrastructure",
      "old_value": {
        "targets": [
          "dns-1.sydney.edu.au",
          "dns-2.sydney.edu.au",
          "extro.ucc.usyd.edu.au",
          "metro.ucc.usyd.edu.au",
          "ns-440.awsdns-55.com",
          "ns1.aarnet.net.au",
          "ns2.aarnet.net.au",
          "ns3.aarnet.net.au"
        ],
        "identity": {
          "state": "matched",
          "provider_ids": [
            "amazon"
          ]
        }
      },
      "new_value": {
        "targets": [
          "dns-1.sydney.edu.au",
          "dns-2.sydney.edu.au",
          "extro.ucc.usyd.edu.au",
          "metro.ucc.usyd.edu.au",
          "ns1.aarnet.net.au",
          "ns2.aarnet.net.au",
          "ns3.aarnet.net.au"
        ],
        "identity": {
          "state": "unmatched",
          "provider_ids": []
        }
      },
      "category": "provider",
      "severity": "medium",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "fe786e6e-e5d4-4534-a799-f7b7a2287380",
      "signal_tier": "tier_2",
      "signal_label": "Meaningful infrastructure movement",
      "certainty": "Observed",
      "visible_by_default": true,
      "collapse_by_default": false
    },
    {
      "id": "a3fdc2b5-1079-49e8-9285-fb90d3bb187c",
      "domain": "abc.net.au",
      "domain_id": "295df832-b961-491d-8bf3-30815f5a1b0a",
      "cohort": "media-watchlist",
      "cohort_label": "Media Watchlist",
      "event_type": "a_changed",
      "event_label": "A record change",
      "event_time": "2026-10-27T21:19:47.743622+00:00",
      "summary": "abc.net.au: a_records changed",
      "old_value": [
        "173.223.0.97"
      ],
      "new_value": [
        "23.197.220.131"
      ],
      "category": "resolution",
      "severity": "info",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "9df69811-ac19-41f2-bc6d-191b2a8cfe42",
      "signal_tier": "tier_3",
      "signal_label": "Routine or low-confidence churn",
      "certainty": "Observed",
      "visible_by_default": false,
      "collapse_by_default": true
    },
    {
      "id": "129726b6-c8de-460d-8002-a4039a3b01ef",
      "domain": "agl.com.au",
      "domain_id": "0423069a-2fcc-4511-b53c-52c7c6b0bd3a",
      "cohort": "critical-infrastructure",
      "cohort_label": "Critical Infrastructure",
      "event_type": "a_changed",
      "event_label": "A record change",
      "event_time": "2026-10-27T21:18:01.582749+00:00",
      "summary": "agl.com.au: a_records changed",
      "old_value": [
        "2.18.217.200"
      ],
      "new_value": [
        "184.29.31.224"
      ],
      "category": "resolution",
      "severity": "info",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "d6823912-03e9-4429-be98-7a1feca90267",
      "signal_tier": "tier_3",
      "signal_label": "Routine or low-confidence churn",
      "certainty": "Observed",
      "visible_by_default": false,
      "collapse_by_default": true
    },
    {
      "id": "3fc53f53-f098-46b4-bfc3-ea692cf87b47",
      "domain": "auspost.com.au",
      "domain_id": "da561ddf-bcd7-497a-be21-9ee0e20cbb1d",
      "cohort": "critical-infrastructure",
      "cohort_label": "Critical Infrastructure",
      "event_type": "a_changed",
      "event_label": "A record change",
      "event_time": "2026-10-27T21:21:04.417614+00:00",
      "summary": "auspost.com.au: a_records changed",
      "old_value": [
        "13.225.47.16",
        "13.225.47.64",
        "13.225.47.65",
        "13.225.47.95"
      ],
      "new_value": [
        "13.249.74.101",
        "13.249.74.111",
        "13.249.74.121",
        "13.249.74.27"
      ],
      "category": "resolution",
      "severity": "info",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "5081fbf7-3d4a-43cb-be89-d81015f1df46",
      "signal_tier": "tier_3",
      "signal_label": "Routine or low-confidence churn",
      "certainty": "Observed",
      "visible_by_default": false,
      "collapse_by_default": true
    },
    {
      "id": "5a24db62-b4de-4107-8fe3-45b0caa065bc",
      "domain": "care.org.au",
      "domain_id": "01ccd864-caf2-4596-b7bc-7dffffdf7be5",
      "cohort": "nfp-watchlist",
      "cohort_label": "Nfp Watchlist",
      "event_type": "aaaa_changed",
      "event_label": "AAAA record change",
      "event_time": "2026-10-27T21:20:17.097829+00:00",
      "summary": "care.org.au: aaaa_records changed",
      "old_value": [
        "2600:9000:2348:1800:2:88:1b80:93a1",
        "2600:9000:2348:3400:2:88:1b80:93a1",
        "2600:9000:2348:5400:2:88:1b80:93a1",
        "2600:9000:2348:8a00:2:88:1b80:93a1",
        "2600:9000:2348:9a00:2:88:1b80:93a1",
        "2600:9000:2348:be00:2:88:1b80:93a1",
        "2600:9000:2348:da00:2:88:1b80:93a1",
        "2600:9000:2348:e600:2:88:1b80:93a1"
      ],
      "new_value": [
        "2600:9000:2348:2800:2:88:1b80:93a1",
        "2600:9000:2348:5e00:2:88:1b80:93a1",
        "2600:9000:2348:6400:2:88:1b80:93a1",
        "2600:9000:2348:6800:2:88:1b80:93a1",
        "2600:9000:2348:8800:2:88:1b80:93a1",
        "2600:9000:2348:9a00:2:88:1b80:93a1",
        "2600:9000:2348:c600:2:88:1b80:93a1",
        "2600:9000:2348:e600:2:88:1b80:93a1"
      ],
      "category": "resolution",
      "severity": "info",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "7f850b44-fc10-438a-87c0-b5ec73809564",
      "signal_tier": "tier_3",
      "signal_label": "Routine or low-confidence churn",
      "certainty": "Observed",
      "visible_by_default": false,
      "collapse_by_default": true
    },
    {
      "id": "4ff1dde7-e1f3-4a22-a945-ac0d9cb27092",
      "domain": "domain.com.au",
      "domain_id": "a1d39ea5-bbc8-4df9-a283-384b6dd2cf55",
      "cohort": "commercial-watchlist",
      "cohort_label": "Commercial Watchlist",
      "event_type": "a_changed",
      "event_label": "A record change",
      "event_time": "2026-10-27T21:20:24.751442+00:00",
      "summary": "domain.com.au: a_records changed",
      "old_value": [
        "18.160.213.127",
        "18.160.213.17",
        "18.160.213.27",
        "18.160.213.60"
      ],
      "new_value": [
        "52.222.205.11",
        "52.222.205.113",
        "52.222.205.80",
        "52.222.205.92"
      ],
      "category": "resolution",
      "severity": "info",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "02636ca4-1dbc-4d65-a0da-e9b875187c15",
      "signal_tier": "tier_3",
      "signal_label": "Routine or low-confidence churn",
      "certainty": "Observed",
      "visible_by_default": false,
      "collapse_by_default": true
    },
    {
      "id": "645bf4bf-cf2c-454a-826d-a442434c0ef4",
      "domain": "homeaffairs.gov.au",
      "domain_id": "a51a578f-f9e8-465d-9639-9f5013547056",
      "cohort": "critical-infrastructure",
      "cohort_label": "Critical Infrastructure",
      "event_type": "a_changed",
      "event_label": "A record change",
      "event_time": "2026-10-27T21:21:07.537986+00:00",
      "summary": "homeaffairs.gov.au: a_records changed",
      "old_value": [
        "23.48.203.169",
        "23.48.203.178"
      ],
      "new_value": [
        "23.53.11.138",
        "23.53.11.146"
      ],
      "category": "resolution",
      "severity": "info",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "2101a8e3-261c-412c-84c9-3dad4da9499d",
      "signal_tier": "tier_3",
      "signal_label": "Routine or low-confidence churn",
      "certainty": "Observed",
      "visible_by_default": false,
      "collapse_by_default": true
    },
    {
      "id": "d9217537-8fa5-486e-ada7-da194d5e8fff",
      "domain": "homeaffairs.gov.au",
      "domain_id": "a51a578f-f9e8-465d-9639-9f5013547056",
      "cohort": "critical-infrastructure",
      "cohort_label": "Critical Infrastructure",
      "event_type": "aaaa_changed",
      "event_label": "AAAA record change",
      "event_time": "2026-10-27T21:21:08.259729+00:00",
      "summary": "homeaffairs.gov.au: aaaa_records changed",
      "old_value": [
        "2600:1408:c400:1e::17d4:fa0c",
        "2600:1408:c400:1e::17d4:fa11"
      ],
      "new_value": [
        "2600:1408:ec00:c::1730:cb86",
        "2600:1408:ec00:c::1730:cb8f"
      ],
      "category": "resolution",
      "severity": "info",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "2101a8e3-261c-412c-84c9-3dad4da9499d",
      "signal_tier": "tier_3",
      "signal_label": "Routine or low-confidence churn",
      "certainty": "Observed",
      "visible_by_default": false,
      "collapse_by_default": true
    },
    {
      "id": "0398c566-b95f-47af-82b3-03eaef494b2d",
      "domain": "kmart.com.au",
      "domain_id": "524c9c70-fa54-40d8-9288-180c51e0bcd0",
      "cohort": "commercial-watchlist",
      "cohort_label": "Commercial Watchlist",
      "event_type": "a_changed",
      "event_label": "A record change",
      "event_time": "2026-10-27T21:17:27.891506+00:00",
      "summary": "kmart.com.au: a_records changed",
      "old_value": [
        "23.210.216.146",
        "23.210.216.169"
      ],
      "new_value": [
        "23.211.124.194",
        "23.211.124.209"
      ],
      "category": "resolution",
      "severity": "info",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "9f12e7c2-3bc6-4118-8c8e-c82560423034",
      "signal_tier": "tier_3",
      "signal_label": "Routine or low-confidence churn",
      "certainty": "Observed",
      "visible_by_default": false,
      "collapse_by_default": true
    },
    {
      "id": "20e92a18-2e45-4c59-8195-90dc51e52a90",
      "domain": "kmart.com.au",
      "domain_id": "524c9c70-fa54-40d8-9288-180c51e0bcd0",
      "cohort": "commercial-watchlist",
      "cohort_label": "Commercial Watchlist",
      "event_type": "aaaa_changed",
      "event_label": "AAAA record change",
      "event_time": "2026-10-27T21:17:28.258533+00:00",
      "summary": "kmart.com.au: aaaa_records changed",
      "old_value": [
        "2600:1406:5e00:9c::1720:9866",
        "2600:1406:5e00:9c::1720:9872"
      ],
      "new_value": [
        "2600:1405:7400:1d::17c2:7f2f",
        "2600:1405:7400:1d::17c2:7f37"
      ],
      "category": "resolution",
      "severity": "info",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "9f12e7c2-3bc6-4118-8c8e-c82560423034",
      "signal_tier": "tier_3",
      "signal_label": "Routine or low-confidence churn",
      "certainty": "Observed",
      "visible_by_default": false,
      "collapse_by_default": true
    },
    {
      "id": "4eb4695b-3a36-417b-a689-3e07ba0aa63a",
      "domain": "nab.com.au",
      "domain_id": "5c2f02fa-f296-43a7-aa45-fe00c561c1aa",
      "cohort": "finance-watchlist",
      "cohort_label": "Finance Watchlist",
      "event_type": "a_changed",
      "event_label": "A record change",
      "event_time": "2026-10-27T21:17:36.870623+00:00",
      "summary": "nab.com.au: a_records changed",
      "old_value": [
        "23.43.51.4",
        "23.43.51.7"
      ],
      "new_value": [
        "184.25.255.51",
        "184.25.255.59"
      ],
      "category": "resolution",
      "severity": "info",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "2cd84ef1-a2e2-4ba7-a0aa-e1cf31784f2f",
      "signal_tier": "tier_3",
      "signal_label": "Routine or low-confidence churn",
      "certainty": "Observed",
      "visible_by_default": false,
      "collapse_by_default": true
    },
    {
      "id": "eedec668-1714-400a-8e0d-019c7c8618f5",
      "domain": "news.com.au",
      "domain_id": "ddceb0ac-c977-48a0-8fb1-dc3fe9cda97b",
      "cohort": "media-watchlist",
      "cohort_label": "Media Watchlist",
      "event_type": "aaaa_changed",
      "event_label": "AAAA record change",
      "event_time": "2026-10-27T21:22:55.543869+00:00",
      "summary": "news.com.au: aaaa_records changed",
      "old_value": [
        "2600:1408:5400:e81::ebe",
        "2600:1408:5400:e82::ebe",
        "2600:1408:5400:e97::ebe",
        "2600:1408:5400:e9c::ebe",
        "2600:1408:5400:e9e::ebe"
      ],
      "new_value": [
        "2600:1408:5400:e83::ebe",
        "2600:1408:5400:e8d::ebe",
        "2600:1408:5400:e91::ebe",
        "2600:1408:5400:e95::ebe",
        "2600:1408:5400:ea0::ebe"
      ],
      "category": "resolution",
      "severity": "info",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "205556db-3eeb-4820-bcf1-394dec58038e",
      "signal_tier": "tier_3",
      "signal_label": "Routine or low-confidence churn",
      "certainty": "Observed",
      "visible_by_default": false,
      "collapse_by_default": true
    },
    {
      "id": "7fc97b5d-e41b-4178-9a5b-6cea45b59f3b",
      "domain": "nrma.com.au",
      "domain_id": "37f68c2b-f8e7-4ef6-acfa-4125af52c0e3",
      "cohort": "finance-watchlist",
      "cohort_label": "Finance Watchlist",
      "event_type": "a_changed",
      "event_label": "A record change",
      "event_time": "2026-10-27T21:19:21.363101+00:00",
      "summary": "nrma.com.au: a_records changed",
      "old_value": [
        "23.61.99.153"
      ],
      "new_value": [
        "184.84.194.28"
      ],
      "category": "resolution",
      "severity": "info",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "0b648eec-6c6a-4b9e-95de-192c8dd8e084",
      "signal_tier": "tier_3",
      "signal_label": "Routine or low-confidence churn",
      "certainty": "Observed",
      "visible_by_default": false,
      "collapse_by_default": true
    },
    {
      "id": "5c6b9b14-acb2-4df9-b26f-c9255e877b78",
      "domain": "officeworks.com.au",
      "domain_id": "2e02993b-7a95-4723-9a26-59a9b08b44ab",
      "cohort": "commercial-watchlist",
      "cohort_label": "Commercial Watchlist",
      "event_type": "a_changed",
      "event_label": "A record change",
      "event_time": "2026-10-27T21:18:24.257653+00:00",
      "summary": "officeworks.com.au: a_records changed",
      "old_value": [
        "108.138.246.22",
        "108.138.246.76",
        "108.138.246.80",
        "108.138.246.9"
      ],
      "new_value": [
        "143.204.1.104",
        "143.204.1.30",
        "143.204.1.34",
        "143.204.1.67"
      ],
      "category": "resolution",
      "severity": "info",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "8140515d-522d-42dd-bad9-8c013e757778",
      "signal_tier": "tier_3",
      "signal_label": "Routine or low-confidence churn",
      "certainty": "Observed",
      "visible_by_default": false,
      "collapse_by_default": true
    },
    {
      "id": "6ce5c0f7-14c2-420f-a25f-be8211b55f31",
      "domain": "originenergy.com.au",
      "domain_id": "c4bd661a-9563-4df0-a38b-df0b42a028a6",
      "cohort": "critical-infrastructure",
      "cohort_label": "Critical Infrastructure",
      "event_type": "a_changed",
      "event_label": "A record change",
      "event_time": "2026-10-27T21:18:08.799992+00:00",
      "summary": "originenergy.com.au: a_records changed",
      "old_value": [
        "18.238.96.120",
        "18.238.96.122",
        "18.238.96.13",
        "18.238.96.64"
      ],
      "new_value": [
        "65.9.148.112",
        "65.9.148.17",
        "65.9.148.22",
        "65.9.148.81"
      ],
      "category": "resolution",
      "severity": "info",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "e4dbeda2-0090-4768-9404-ef16d120e9de",
      "signal_tier": "tier_3",
      "signal_label": "Routine or low-confidence churn",
      "certainty": "Observed",
      "visible_by_default": false,
      "collapse_by_default": true
    },
    {
      "id": "d0321768-f492-4216-89c9-00abcb2fe5fd",
      "domain": "qantas.com.au",
      "domain_id": "26aeefe2-1460-4353-b95f-009eb9ea2e9e",
      "cohort": "critical-infrastructure",
      "cohort_label": "Critical Infrastructure",
      "event_type": "a_changed",
      "event_label": "A record change",
      "event_time": "2026-10-27T21:18:24.786349+00:00",
      "summary": "qantas.com.au: a_records changed",
      "old_value": [
        "23.209.84.149",
        "23.209.84.150"
      ],
      "new_value": [
        "23.220.103.68",
        "23.220.103.70"
      ],
      "category": "resolution",
      "severity": "info",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "64589953-38e9-4e20-9bb6-528224155c7a",
      "signal_tier": "tier_3",
      "signal_label": "Routine or low-confidence churn",
      "certainty": "Observed",
      "visible_by_default": false,
      "collapse_by_default": true
    },
    {
      "id": "94bf380d-5b02-4323-a42e-40c41fa3bd03",
      "domain": "qantas.com.au",
      "domain_id": "26aeefe2-1460-4353-b95f-009eb9ea2e9e",
      "cohort": "critical-infrastructure",
      "cohort_label": "Critical Infrastructure",
      "event_type": "aaaa_changed",
      "event_label": "AAAA record change",
      "event_time": "2026-10-27T21:18:25.132065+00:00",
      "summary": "qantas.com.au: aaaa_records changed",
      "old_value": [
        "2600:1405:8400:f::173e:e276",
        "2600:1405:8400:f::173e:e278"
      ],
      "new_value": [
        "2600:1405:7400:8::172d:7b44",
        "2600:1405:7400:8::172d:7b4e"
      ],
      "category": "resolution",
      "severity": "info",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "64589953-38e9-4e20-9bb6-528224155c7a",
      "signal_tier": "tier_3",
      "signal_label": "Routine or low-confidence churn",
      "certainty": "Observed",
      "visible_by_default": false,
      "collapse_by_default": true
    },
    {
      "id": "9f7676c9-7121-4149-b432-8f00e3066d02",
      "domain": "realestate.com.au",
      "domain_id": "7f5f2d67-8f93-4467-a6b0-e20363e28aa4",
      "cohort": "commercial-watchlist",
      "cohort_label": "Commercial Watchlist",
      "event_type": "aaaa_changed",
      "event_label": "AAAA record change",
      "event_time": "2026-10-27T21:18:07.206032+00:00",
      "summary": "realestate.com.au: aaaa_records changed",
      "old_value": [
        "2600:1406:5e00:9c::1720:986a",
        "2600:1406:5e00:9c::1720:986d"
      ],
      "new_value": [
        "2600:1409:9800:ef::17d8:938c",
        "2600:1409:9800:ef::17d8:9390"
      ],
      "category": "resolution",
      "severity": "info",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "2d2d4cde-de95-4ca2-ad51-eea8a2c1c3f8",
      "signal_tier": "tier_3",
      "signal_label": "Routine or low-confidence churn",
      "certainty": "Observed",
      "visible_by_default": false,
      "collapse_by_default": true
    },
    {
      "id": "661a0b64-16fa-4e6f-a858-365d1a06df1a",
      "domain": "theaustralian.com.au",
      "domain_id": "5bd486d6-d424-4868-b043-5ebbe36da11a",
      "cohort": "media-watchlist",
      "cohort_label": "Media Watchlist",
      "event_type": "aaaa_changed",
      "event_label": "AAAA record change",
      "event_time": "2026-10-27T21:21:50.560804+00:00",
      "summary": "theaustralian.com.au: aaaa_records changed",
      "old_value": [
        "2600:1408:5400:e80::ebe",
        "2600:1408:5400:e86::ebe",
        "2600:1408:5400:e96::ebe",
        "2600:1408:5400:e99::ebe",
        "2600:1408:5400:e9d::ebe"
      ],
      "new_value": [
        "2600:1408:5400:e89::ebe",
        "2600:1408:5400:e8e::ebe",
        "2600:1408:5400:e8f::ebe",
        "2600:1408:5400:e9a::ebe",
        "2600:1408:5400:ea1::ebe"
      ],
      "category": "resolution",
      "severity": "info",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "21b9ccb5-72c9-4769-82bd-5073d3ebfe49",
      "signal_tier": "tier_3",
      "signal_label": "Routine or low-confidence churn",
      "certainty": "Observed",
      "visible_by_default": false,
      "collapse_by_default": true
    },
    {
      "id": "1de331e3-3cdc-41e9-9f1c-60f0985491ed",
      "domain": "woolworths.com.au",
      "domain_id": "94b188b0-2126-477a-b0da-23f05ffb2375",
      "cohort": "commercial-watchlist",
      "cohort_label": "Commercial Watchlist",
      "event_type": "a_changed",
      "event_label": "A record change",
      "event_time": "2026-10-27T21:20:11.774233+00:00",
      "summary": "woolworths.com.au: a_records changed",
      "old_value": [
        "184.29.31.193"
      ],
      "new_value": [
        "23.213.45.110"
      ],
      "category": "resolution",
      "severity": "info",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "9aca1626-9d91-498d-b439-32f81b735a95",
      "signal_tier": "tier_3",
      "signal_label": "Routine or low-confidence churn",
      "certainty": "Observed",
      "visible_by_default": false,
      "collapse_by_default": true
    },
    {
      "id": "792ffcff-5684-4168-80cb-280cf418f236",
      "domain": "xero.com.au",
      "domain_id": "65b653c4-d173-4953-a435-34678df4f5a7",
      "cohort": "saas-watchlist",
      "cohort_label": "Saas Watchlist",
      "event_type": "a_changed",
      "event_label": "A record change",
      "event_time": "2026-10-27T21:21:18.612572+00:00",
      "summary": "xero.com.au: a_records changed",
      "old_value": [
        "23.33.29.137",
        "23.33.29.151"
      ],
      "new_value": [
        "23.62.46.166",
        "23.62.46.175"
      ],
      "category": "resolution",
      "severity": "info",
      "materiality": "supporting",
      "event_scope": "observatory",
      "snapshot_id": "bb767a68-00ec-4201-998e-622464552a62",
      "signal_tier": "tier_3",
      "signal_label": "Routine or low-confidence churn",
      "certainty": "Observed",
      "visible_by_default": false,
      "collapse_by_default": true
    }
  ],
  "default_visibility_rule": "Material, medium/high severity, named high-signal event types, or personal-interest domains are visible by default."
}