{
    "ok": true,
    "slug": "admin.ch-2026-03-24",
    "stats": {
        "subs": 15364,
        "all": 15364,
        "resolved": 9814,
        "live": 143,
        "takeover": 136,
        "juicy": 146,
        "nuclei": 0,
        "subjack": 0,
        "subjack_vuln": 0,
        "takeover_v4": 7,
        "takeover_hot_claim": 1,
        "takeover_claimed": 0,
        "takeover_telegram_ok": 1,
        "confirmed": false,
        "alert": true,
        "scan_log": true
    },
    "path": "\/www\/wwwroot\/tooldomain\/output\/admin.ch-2026-03-24",
    "takeover_candidates": [
        "3d.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md1csvxf7gxsy2w.cloudfront.net\u001b[0m]",
        "api.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md10lncxppk45mx.cloudfront.net\u001b[0m]",
        "api3.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md10lncxppk45mx.cloudfront.net\u001b[0m]",
        "apiconsole.i14y.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mi14y-ch.github.io\u001b[0m]",
        "carta.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2qsax72qqhqlc.cloudfront.net\u001b[0m]",
        "carte.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2qsax72qqhqlc.cloudfront.net\u001b[0m]",
        "charta.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2qsax72qqhqlc.cloudfront.net\u001b[0m]",
        "cms.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md1fn9yyhpz4njx.cloudfront.net\u001b[0m]",
        "control.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2xd79x6lo5bcl.cloudfront.net\u001b[0m]",
        "dashboard-energia.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mdbug7tzsn5rv2.cloudfront.net\u001b[0m]",
        "dashboard-energie.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mdbug7tzsn5rv2.cloudfront.net\u001b[0m]",
        "dashboard.lindas.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mec2-51-96-41-252.eu-central-2.compute.amazonaws.com\u001b[0m]",
        "dashboardenergia.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mdbug7tzsn5rv2.cloudfront.net\u001b[0m]",
        "dashboardenergie.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mdbug7tzsn5rv2.cloudfront.net\u001b[0m]",
        "data.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mdx2kdr2wyybtj.cloudfront.net\u001b[0m]",
        "dev-vnch.swisstopo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mcloudfront.dev.vnch.swisstopo.cloud\u001b[0m]",
        "docs.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md3vx3nxvh37xiu.cloudfront.net\u001b[0m]",
        "energiedashboard.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mdbug7tzsn5rv2.cloudfront.net\u001b[0m]",
        "energydashboard.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mdbug7tzsn5rv2.cloudfront.net\u001b[0m]",
        "graphdb.lindas.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mec2-51-96-41-252.eu-central-2.compute.amazonaws.com\u001b[0m]",
        "help.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2qsax72qqhqlc.cloudfront.net\u001b[0m]",
        "historic.swisstopo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md37aypcz8dffts.cloudfront.net\u001b[0m]",
        "historicalmaps.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md3umwq6di3sym1.cloudfront.net\u001b[0m]",
        "int-osb.aws.csb.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md-ggijibo679.execute-api.eu-central-1.amazonaws.com\u001b[0m]",
        "int-vnch.swisstopo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mcloudfront.int.vnch.swisstopo.cloud\u001b[0m]",
        "int.graphdb.lindas.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mec2-51-96-41-252.eu-central-2.compute.amazonaws.com\u001b[0m]",
        "internal.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md22t0ugh7xbbgn.cloudfront.net\u001b[0m]",
        "karte.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2qsax72qqhqlc.cloudfront.net\u001b[0m]",
        "logging.lindas.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mec2-51-96-41-252.eu-central-2.compute.amazonaws.com\u001b[0m]",
        "m.map.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2qsax72qqhqlc.cloudfront.net\u001b[0m]",
        "madd.bfs.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mmadd-lb-tf-240567482.eu-west-1.elb.amazonaws.com\u001b[0m]",
        "mageai.marmotini-dev.prometheon.bfe.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mmarmot20260309160638068400000001-1858131174.eu-central-1.elb.amazonaws.com\u001b[0m]",
        "mageai.marmotini-test.prometheon.bfe.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mmarmot2026031912375079470000000d-422944736.eu-central-1.elb.amazonaws.com\u001b[0m]",
        "map.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md16adhxp2sjlbw.cloudfront.net\u001b[0m]",
        "map2.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2qsax72qqhqlc.cloudfront.net\u001b[0m]",
        "map3.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2qsax72qqhqlc.cloudfront.net\u001b[0m]",
        "maps.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2qsax72qqhqlc.cloudfront.net\u001b[0m]",
        "misc-geoshop.bgdi.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mgeoshop-elasticloa-1qw82w881y4r1-323618868.eu-west-1.elb.amazonaws.com\u001b[0m]",
        "mobile.map.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2qsax72qqhqlc.cloudfront.net\u001b[0m]",
        "monitorage-logement.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mbwo-dashboard.vercel.app\u001b[0m]",
        "monitoraggio-alloggi.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mbwo-dashboard.vercel.app\u001b[0m]",
        "ogd.swisstopo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2g6hm1l6sdbps.cloudfront.net\u001b[0m]",
        "opendata.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mopendata-swiss.github.io\u001b[0m]",
        "osb.aws.csb.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md-my46faz91l.execute-api.eu-central-1.amazonaws.com\u001b[0m]",
        "pnac.swisstopo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md1sjuf2td11epc.cloudfront.net\u001b[0m]",
        "prometheus.lindas.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mec2-51-96-41-252.eu-central-2.compute.amazonaws.com\u001b[0m]",
        "proxy.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md1dlzcqy5tbm7c.cloudfront.net\u001b[0m]",
        "public.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2v8er20ld81yu.cloudfront.net\u001b[0m]",
        "public.madd.bfs.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md3uxa5jkrxsmkn.cloudfront.net\u001b[0m]",
        "redirect-bit.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mdewnooqqs82u8.cloudfront.net\u001b[0m]",
        "redirect.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2qsax72qqhqlc.cloudfront.net\u001b[0m]",
        "report-t.ncsc.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mdqp98bsrkeq2w.cloudfront.net\u001b[0m]",
        "report.ncsc.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md70aw5n53b3mn.cloudfront.net\u001b[0m]",
        "s.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md31i80o0nl53a.cloudfront.net\u001b[0m]",
        "servicedesk.lindas.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mec2-51-96-41-252.eu-central-2.compute.amazonaws.com\u001b[0m]",
        "sftp.lindas.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mec2-51-96-41-252.eu-central-2.compute.amazonaws.com\u001b[0m]",
        "storymaps.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2qsax72qqhqlc.cloudfront.net\u001b[0m]",
        "survey-t.ncsc.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md28s2bc43y4woa.cloudfront.net\u001b[0m]",
        "survey.ncsc.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2oiescro54g8o.cloudfront.net\u001b[0m]",
        "swissmapmobile.swisstopo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md36hgiektr2bks.cloudfront.net\u001b[0m]",
        "template.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md1i8k9ou9tdnsd.cloudfront.net\u001b[0m]",
        "test-s3-bucket.cesium.fsdi.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md34zmz0i441qh5.cloudfront.net\u001b[0m]",
        "test-vnch.swisstopo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mcloudfront.test.vnch.swisstopo.cloud\u001b[0m]",
        "test.graphdb.lindas.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mec2-51-96-41-252.eu-central-2.compute.amazonaws.com\u001b[0m]",
        "test.map.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2qsax72qqhqlc.cloudfront.net\u001b[0m]",
        "test.swisstopo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mses-test-elasticlo-13sc845pxkywd-1713101147.eu-west-1.elb.amazonaws.com\u001b[0m]",
        "toolbox.i14y.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mi14y-ch.github.io\u001b[0m]",
        "vectortiles.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2tbee9lmruldx.cloudfront.net\u001b[0m]",
        "vectortiles0.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2tbee9lmruldx.cloudfront.net\u001b[0m]",
        "vectortiles1.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2tbee9lmruldx.cloudfront.net\u001b[0m]",
        "vectortiles100.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2tbee9lmruldx.cloudfront.net\u001b[0m]",
        "vectortiles101.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2tbee9lmruldx.cloudfront.net\u001b[0m]",
        "vectortiles102.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2tbee9lmruldx.cloudfront.net\u001b[0m]",
        "vectortiles103.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2tbee9lmruldx.cloudfront.net\u001b[0m]",
        "vectortiles104.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2tbee9lmruldx.cloudfront.net\u001b[0m]",
        "vectortiles2.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2tbee9lmruldx.cloudfront.net\u001b[0m]",
        "vectortiles3.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2tbee9lmruldx.cloudfront.net\u001b[0m]",
        "vectortiles4.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2tbee9lmruldx.cloudfront.net\u001b[0m]",
        "vnch.swisstopo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mcloudfront.prod.vnch.swisstopo.cloud\u001b[0m]",
        "webdav.lindas.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mec2-51-96-41-252.eu-central-2.compute.amazonaws.com\u001b[0m]",
        "wms.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md1kghqk4n65k14.cloudfront.net\u001b[0m]",
        "wms0.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md1kghqk4n65k14.cloudfront.net\u001b[0m]",
        "wms1.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md1kghqk4n65k14.cloudfront.net\u001b[0m]",
        "wms2.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md1kghqk4n65k14.cloudfront.net\u001b[0m]",
        "wms3.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md1kghqk4n65k14.cloudfront.net\u001b[0m]",
        "wms4.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md1kghqk4n65k14.cloudfront.net\u001b[0m]",
        "wmts.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts0.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts1.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts10.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts100.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts101.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts102.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts103.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts104.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts105.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts106.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts107.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts108.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts109.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts11.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts12.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts13.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts14.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts2.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts20.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts21.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts22.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts23.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts24.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts3.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts4.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts5.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts6.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts7.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts8.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wmts9.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2vvg9smm7xxt0.cloudfront.net\u001b[0m]",
        "wohnmonitor.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mbwo-dashboard.vercel.app\u001b[0m]",
        "www-tmp-r.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md1ymley5yvt1qg.cloudfront.net\u001b[0m]",
        "www-tmp-r.bag.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2pwwmksbdmhtg.cloudfront.net\u001b[0m]",
        "www.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md23vgpvjcg53nf.cloudfront.net\u001b[0m]",
        "www.dashboard-energia.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mdbug7tzsn5rv2.cloudfront.net\u001b[0m]",
        "www.dashboard-energie.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mdbug7tzsn5rv2.cloudfront.net\u001b[0m]",
        "www.dashboardenergia.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mdbug7tzsn5rv2.cloudfront.net\u001b[0m]",
        "www.dashboardenergie.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mdbug7tzsn5rv2.cloudfront.net\u001b[0m]",
        "www.data.blv.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mblv-osav-usav.github.io\u001b[0m]",
        "www.energiedashboard.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mdbug7tzsn5rv2.cloudfront.net\u001b[0m]",
        "www.energydashboard.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mdbug7tzsn5rv2.cloudfront.net\u001b[0m]",
        "www.madd.bfs.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mmadd-lb-tf-240567482.eu-west-1.elb.amazonaws.com\u001b[0m]",
        "www.map.geo.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2qsax72qqhqlc.cloudfront.net\u001b[0m]",
        "www.opensource.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mswiss.github.io\u001b[0m]",
        "www.report-t.ncsc.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mdqp98bsrkeq2w.cloudfront.net\u001b[0m]",
        "www.report.ncsc.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md70aw5n53b3mn.cloudfront.net\u001b[0m]",
        "www.shop.zivi.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32mshops.myshopify.com\u001b[0m]",
        "www.survey-t.ncsc.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md28s2bc43y4woa.cloudfront.net\u001b[0m]",
        "www.survey.ncsc.admin.ch [\u001b[35mCNAME\u001b[0m] [\u001b[32md2oiescro54g8o.cloudfront.net\u001b[0m]"
    ],
    "takeover_v4": {
        "domain": "admin.ch",
        "version": 5,
        "generated_at": "2026-03-24T17:05:45.231Z",
        "ai_filter": {
            "engine": "rules_scorer_v1",
            "min_score": 48,
            "llm_pool_min": 38,
            "evaluated": 16,
            "kept_strict": 7,
            "llm_review_pool": 0,
            "dropped_noise": 9,
            "deep_skipped_below_pool": 9
        },
        "candidates": [
            {
                "host": "www-tmp-r.bag.admin.ch",
                "cname": "d2pwwmksbdmhtg.cloudfront.net",
                "status": 502,
                "title": "ERROR: The request could not be satisfied",
                "fingerprint": "aws_s3",
                "confidence": "medium",
                "claim_score": 86,
                "claim_tier": "critical",
                "signals": [
                    "the request could not be satisfied"
                ],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "claim_likely",
                "llm_confidence": 0.85,
                "llm_rationale_vi": "CNAME trỏ tới CloudFront, HTTP 502 với lỗi 'request could not be satisfied' cho thấy phân phối chưa được cấu hình đúng, có khả năng claim cao.",
                "llm_labeled_at": "2026-03-24T17:05:59.855Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "high",
                "claimed": false,
                "claim_status": "needs_manual",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/www-tmp-r.bag.admin.ch\/",
                    "http_status": 502,
                    "title_snippet": "ERROR: The request could not be satisfied",
                    "verify_error": null,
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": true,
                "telegram_error": null
            },
            {
                "host": "api.geo.admin.ch",
                "cname": "d10lncxppk45mx.cloudfront.net",
                "status": 404,
                "title": null,
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 54,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "unlikely",
                "llm_confidence": 0.7,
                "llm_rationale_vi": "CNAME CloudFront nhưng HTTP 404 có thể là trang lỗi tùy chỉnh của ứng dụng đang hoạt động, không rõ ràng để claim.",
                "llm_labeled_at": "2026-03-24T17:05:59.855Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low",
                "claimed": false,
                "claim_status": "needs_manual",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/api.geo.admin.ch\/",
                    "http_status": 404,
                    "title_snippet": "",
                    "verify_error": null,
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:llm_priority_low"
            },
            {
                "host": "control.geo.admin.ch",
                "cname": "d2xd79x6lo5bcl.cloudfront.net",
                "status": 404,
                "title": "Not Found",
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 54,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "unlikely",
                "llm_confidence": 0.7,
                "llm_rationale_vi": "Tương tự, CNAME CloudFront với 404 'Not Found' có thể là hành vi ứng dụng bình thường, không đủ bằng chứng claim.",
                "llm_labeled_at": "2026-03-24T17:05:59.855Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low",
                "claimed": false,
                "claim_status": "needs_manual",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/control.geo.admin.ch\/",
                    "http_status": 404,
                    "title_snippet": "Not Found",
                    "verify_error": null,
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:llm_priority_low"
            },
            {
                "host": "internal.geo.admin.ch",
                "cname": "d22t0ugh7xbbgn.cloudfront.net",
                "status": 404,
                "title": null,
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 54,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "unlikely",
                "llm_confidence": 0.7,
                "llm_rationale_vi": "CNAME CloudFront, HTTP 404 không tiêu đề, có thể là endpoint nội bộ hoặc cấu hình đang chờ, khả năng claim thấp.",
                "llm_labeled_at": "2026-03-24T17:05:59.855Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low",
                "claimed": false,
                "claim_status": "needs_manual",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/internal.geo.admin.ch\/",
                    "http_status": 404,
                    "title_snippet": "",
                    "verify_error": null,
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:llm_priority_low"
            },
            {
                "host": "proxy.geo.admin.ch",
                "cname": "d1dlzcqy5tbm7c.cloudfront.net",
                "status": 404,
                "title": "404 Not Found",
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 54,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "unlikely",
                "llm_confidence": 0.7,
                "llm_rationale_vi": "CNAME CloudFront, HTTP 404 với thông báo chuẩn, có khả năng là ứng dụng hợp lệ đang chạy, không nghi ngờ takeover.",
                "llm_labeled_at": "2026-03-24T17:05:59.855Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low",
                "claimed": false,
                "claim_status": "needs_manual",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/proxy.geo.admin.ch\/",
                    "http_status": 404,
                    "title_snippet": "404 Not Found",
                    "verify_error": null,
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:llm_priority_low"
            },
            {
                "host": "redirect-bit.geo.admin.ch",
                "cname": "dewnooqqs82u8.cloudfront.net",
                "status": 404,
                "title": null,
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 54,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "claimed": false,
                "claim_status": "needs_manual",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/redirect-bit.geo.admin.ch\/",
                    "http_status": 404,
                    "title_snippet": "",
                    "verify_error": null,
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:below_telegram_threshold"
            },
            {
                "host": "template.geo.admin.ch",
                "cname": "d1i8k9ou9tdnsd.cloudfront.net",
                "status": 404,
                "title": null,
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 54,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "claimed": false,
                "claim_status": "needs_manual",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/template.geo.admin.ch\/",
                    "http_status": 404,
                    "title_snippet": "",
                    "verify_error": null,
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:below_telegram_threshold"
            }
        ],
        "llm_review_pool": [],
        "llm_batch": {
            "provider": "deepseek",
            "base_url": "https:\/\/api.deepseek.com\/v1",
            "model": "deepseek-chat",
            "top_n_requested": 5,
            "batch_hosts": [
                "www-tmp-r.bag.admin.ch",
                "api.geo.admin.ch",
                "control.geo.admin.ch",
                "internal.geo.admin.ch",
                "proxy.geo.admin.ch"
            ],
            "batch_sources": [
                "strict",
                "strict",
                "strict",
                "strict",
                "strict"
            ],
            "promote_revived": true,
            "labeled_at": "2026-03-24T17:05:59.855Z",
            "usage": {
                "prompt_tokens": 855,
                "completion_tokens": 385,
                "total_tokens": 1240,
                "prompt_tokens_details": {
                    "cached_tokens": 128
                },
                "prompt_cache_hit_tokens": 128,
                "prompt_cache_miss_tokens": 727
            }
        },
        "v5": {
            "processed_at": "2026-03-24T17:05:59.902Z",
            "auto_claim_enabled": true,
            "telegram_enabled": true,
            "slug": "admin.ch-2026-03-24"
        }
    }
}