{
    "ok": true,
    "slug": "aircanada.com-2026-03-25",
    "stats": {
        "subs": 1419,
        "all": 1419,
        "resolved": 958,
        "live": 813,
        "takeover": 57,
        "juicy": 81,
        "nuclei": 0,
        "subjack": 0,
        "subjack_vuln": 0,
        "takeover_v4": 9,
        "takeover_hot_claim": 1,
        "takeover_claimed": 0,
        "takeover_telegram_ok": 0,
        "confirmed": false,
        "alert": true,
        "scan_log": true
    },
    "path": "\/www\/wwwroot\/tooldomain\/output\/aircanada.com-2026-03-25",
    "takeover_candidates": [
        "atlantis.digital.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32matlantis-1727441650.us-east-2.elb.amazonaws.com\u001b[0m]",
        "auth.clogin-bat.digital.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md26muhyn2tkgy2.cloudfront.net\u001b[0m]",
        "auth.clogin-crt.digital.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md8n6fb1snqbql.cloudfront.net\u001b[0m]",
        "auth.clogin-int.digital.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md87ex9oag882.cloudfront.net\u001b[0m]",
        "auth.clogin-preprod.digital.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md2ykhonplime2l.cloudfront.net\u001b[0m]",
        "brochures.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md3u4720i0nzxs3.cloudfront.net\u001b[0m]",
        "cdn.message.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdobvmnppnqopc.cloudfront.net\u001b[0m]",
        "cdn.stage-message.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdobvmnppnqopc.cloudfront.net\u001b[0m]",
        "citylist-appsync-int.api-gw-int.dbaas.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mddvega6lpczcj.cloudfront.net\u001b[0m]",
        "giftcard.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mprodu-webno-160qk8ybwwca3-143907533.us-west-2.elb.amazonaws.com\u001b[0m]",
        "m.ausmail.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-mkt-prod3-dycts-1138717219.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "m.chemail.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-mkt-prod3-dycts-1138717219.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "m.cybermail.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-mkt-prod3-dycts-1138717219.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "m.deumail.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-mkt-prod3-dycts-1138717219.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "m.framail.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-mkt-prod3-dycts-1138717219.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "m.gbrmail.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-mkt-prod3-dycts-1138717219.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "m.hkgmail.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-mkt-prod3-dycts-1138717219.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "m.info.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-rt-prod4-bl3dy-95276535.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "m.infocargo.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-rt-prod4-bl3dy-95276535.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "m.itamail.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-mkt-prod3-dycts-1138717219.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "m.mail.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-mkt-prod3-dycts-1138717219.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "m6.info.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-rt-prod6-infoaircanada-1739097277.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "password-reset.ac-iam-crt.cloud.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdy3v0ljp4u6cm.cloudfront.net\u001b[0m]",
        "password-reset.ac-iam-int.cloud.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md2alwnskz4z6mw.cloudfront.net\u001b[0m]",
        "password-reset.ac-iam-uat.cloud.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md3dx5vcuz2qycp.cloudfront.net\u001b[0m]",
        "premiumcoatcheck.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md12u7r3mwkloz6.cloudfront.net\u001b[0m]",
        "reroute-api.ops-airport-crt.cloud.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md2spwxez9w7byw.cloudfront.net\u001b[0m]",
        "reroute-api.ops-airport-int.cloud.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md14j4tzczx4y3h.cloudfront.net\u001b[0m]",
        "reroute-api.ops-airport.cloud.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md2k2mxprfq6cas.cloudfront.net\u001b[0m]",
        "reroute.ops-airport-crt.cloud.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1njccz7nxrmx6.cloudfront.net\u001b[0m]",
        "reroute.ops-airport-int.cloud.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdckzjfohimj1p.cloudfront.net\u001b[0m]",
        "reroute.ops-airport.cloud.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md5wwfkycvkbat.cloudfront.net\u001b[0m]",
        "res6.info.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md5el8j180t2kc.cloudfront.net\u001b[0m]",
        "session-context.ac-iam-crt.cloud.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md3v5if74h8ov3z.cloudfront.net\u001b[0m]",
        "session-context.ac-iam-int.cloud.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md3vtmpo5ihytt2.cloudfront.net\u001b[0m]",
        "session-context.ac-iam-uat.cloud.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdw1p1mjam5k6.cloudfront.net\u001b[0m]",
        "t.ausmail.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-mkt-prod3-dycts-1138717219.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "t.chemail.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-mkt-prod3-dycts-1138717219.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "t.cybermail.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-mkt-prod3-dycts-1138717219.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "t.deumail.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-mkt-prod3-dycts-1138717219.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "t.emails.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md2naccpqid5345.cloudfront.net\u001b[0m]",
        "t.framail.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-mkt-prod3-dycts-1138717219.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "t.gbrmail.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-mkt-prod3-dycts-1138717219.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "t.hkgmail.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-mkt-prod3-dycts-1138717219.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "t.info.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-rt-prod4-bl3dy-95276535.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "t.infocargo.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-rt-prod4-bl3dy-95276535.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "t.itamail.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-mkt-prod3-dycts-1138717219.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "t.mail.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-mkt-prod3-dycts-1138717219.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "t6.info.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32maircanada-rt-prod6-infoaircanada-1739097277.ca-central-1.elb.amazonaws.com\u001b[0m]",
        "vacations-preprod-threeds-events.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md2a0my567vm5pi.cloudfront.net\u001b[0m]",
        "vacations-preprod.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1nzoeh5w1pvd9.cloudfront.net\u001b[0m]",
        "vacations-qa.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md3o67n0fz7r208.cloudfront.net\u001b[0m]",
        "vacations-qasup.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1oa3s0wde3y34.cloudfront.net\u001b[0m]",
        "vacations-threeds-events.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md-6xecm9buze.execute-api.ca-central-1.amazonaws.com\u001b[0m]",
        "vacations-uat.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1uakgo7helmr0.cloudfront.net\u001b[0m]",
        "vacations.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md2wsmowl2ldkyo.cloudfront.net\u001b[0m]",
        "www.giftcard.aircanada.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mprodu-webno-160qk8ybwwca3-143907533.us-west-2.elb.amazonaws.com\u001b[0m]"
    ],
    "takeover_v4": {
        "domain": "aircanada.com",
        "version": 5,
        "generated_at": "2026-03-24T22:05:12.320Z",
        "ai_filter": {
            "engine": "rules_scorer_v1",
            "min_score": 48,
            "llm_pool_min": 38,
            "evaluated": 21,
            "kept_strict": 9,
            "llm_review_pool": 0,
            "dropped_noise": 12,
            "deep_skipped_below_pool": 12
        },
        "candidates": [
            {
                "host": "t.emails.aircanada.com",
                "cname": "d2naccpqid5345.cloudfront.net",
                "status": 504,
                "title": "ERROR: The request could not be satisfied",
                "fingerprint": "aws_s3",
                "confidence": "medium",
                "claim_score": 70,
                "claim_tier": "high",
                "signals": [
                    "the request could not be satisfied"
                ],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "unlikely",
                "llm_confidence": 0.7,
                "llm_rationale_vi": "CloudFront phân phối lỗi 504, có thể là cấu hình sai hoặc backend không phản hồi, không phải tài nguyên bị bỏ trống có thể claim.",
                "llm_labeled_at": "2026-03-24T22:05:25.935Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low",
                "claimed": false,
                "claim_status": "verify_error",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/t.emails.aircanada.com\/",
                    "http_status": null,
                    "title_snippet": null,
                    "verify_error": "fetch failed",
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:llm_priority_low"
            },
            {
                "host": "citylist-appsync-int.api-gw-int.dbaas.aircanada.com",
                "cname": "ddvega6lpczcj.cloudfront.net",
                "status": 404,
                "title": null,
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 54,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "false_positive",
                "llm_confidence": 0.8,
                "llm_rationale_vi": "CNAME trỏ tới CloudFront nhưng trả về 404, có thể là endpoint nội bộ hoặc môi trường dev đã tắt, không phải lỗ hổng claim công khai.",
                "llm_labeled_at": "2026-03-24T22:05:25.935Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low",
                "claimed": false,
                "claim_status": "needs_manual",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/citylist-appsync-int.api-gw-int.dbaas.aircanada.com\/",
                    "http_status": 404,
                    "title_snippet": "",
                    "verify_error": null,
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:llm_priority_low"
            },
            {
                "host": "password-reset.ac-iam-crt.cloud.aircanada.com",
                "cname": "dy3v0ljp4u6cm.cloudfront.net",
                "status": 404,
                "title": null,
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 54,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "false_positive",
                "llm_confidence": 0.8,
                "llm_rationale_vi": "Cấu trúc tên miền cho môi trường cloud (crt), 404 có thể do ứng dụng chưa triển khai hoặc endpoint riêng tư, không phải claim được.",
                "llm_labeled_at": "2026-03-24T22:05:25.935Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low",
                "claimed": false,
                "claim_status": "needs_manual",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/password-reset.ac-iam-crt.cloud.aircanada.com\/",
                    "http_status": 404,
                    "title_snippet": "",
                    "verify_error": null,
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:llm_priority_low"
            },
            {
                "host": "password-reset.ac-iam-int.cloud.aircanada.com",
                "cname": "d2alwnskz4z6mw.cloudfront.net",
                "status": 404,
                "title": null,
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 54,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "false_positive",
                "llm_confidence": 0.8,
                "llm_rationale_vi": "Tương tự các host khác, đây là môi trường tích hợp (int), 404 không chỉ ra tài nguyên CloudFront có thể chiếm đoạt.",
                "llm_labeled_at": "2026-03-24T22:05:25.935Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low",
                "claimed": false,
                "claim_status": "needs_manual",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/password-reset.ac-iam-int.cloud.aircanada.com\/",
                    "http_status": 404,
                    "title_snippet": "",
                    "verify_error": null,
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:llm_priority_low"
            },
            {
                "host": "password-reset.ac-iam-uat.cloud.aircanada.com",
                "cname": "d3dx5vcuz2qycp.cloudfront.net",
                "status": 404,
                "title": null,
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 54,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "false_positive",
                "llm_confidence": 0.8,
                "llm_rationale_vi": "Môi trường UAT, lỗi 404 phổ biến, không có dấu hiệu cho thấy bucket S3 hoặc CloudFront bị bỏ trống để claim.",
                "llm_labeled_at": "2026-03-24T22:05:25.935Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low",
                "claimed": false,
                "claim_status": "needs_manual",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/password-reset.ac-iam-uat.cloud.aircanada.com\/",
                    "http_status": 404,
                    "title_snippet": "",
                    "verify_error": null,
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:llm_priority_low"
            },
            {
                "host": "reroute-api.ops-airport.cloud.aircanada.com",
                "cname": "d2k2mxprfq6cas.cloudfront.net",
                "status": 404,
                "title": null,
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 54,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "claimed": false,
                "claim_status": "needs_manual",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/reroute-api.ops-airport.cloud.aircanada.com\/",
                    "http_status": 404,
                    "title_snippet": "",
                    "verify_error": null,
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:below_telegram_threshold"
            },
            {
                "host": "session-context.ac-iam-crt.cloud.aircanada.com",
                "cname": "d3v5if74h8ov3z.cloudfront.net",
                "status": 404,
                "title": null,
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 54,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "claimed": false,
                "claim_status": "needs_manual",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/session-context.ac-iam-crt.cloud.aircanada.com\/",
                    "http_status": 404,
                    "title_snippet": "",
                    "verify_error": null,
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:below_telegram_threshold"
            },
            {
                "host": "session-context.ac-iam-int.cloud.aircanada.com",
                "cname": "d3vtmpo5ihytt2.cloudfront.net",
                "status": 404,
                "title": null,
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 54,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "claimed": false,
                "claim_status": "needs_manual",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/session-context.ac-iam-int.cloud.aircanada.com\/",
                    "http_status": 404,
                    "title_snippet": "",
                    "verify_error": null,
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:below_telegram_threshold"
            },
            {
                "host": "session-context.ac-iam-uat.cloud.aircanada.com",
                "cname": "dw1p1mjam5k6.cloudfront.net",
                "status": 404,
                "title": null,
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 54,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "claimed": false,
                "claim_status": "needs_manual",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/session-context.ac-iam-uat.cloud.aircanada.com\/",
                    "http_status": 404,
                    "title_snippet": "",
                    "verify_error": null,
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:below_telegram_threshold"
            }
        ],
        "llm_review_pool": [],
        "llm_batch": {
            "provider": "deepseek",
            "base_url": "https:\/\/api.deepseek.com\/v1",
            "model": "deepseek-chat",
            "top_n_requested": 5,
            "batch_hosts": [
                "t.emails.aircanada.com",
                "citylist-appsync-int.api-gw-int.dbaas.aircanada.com",
                "password-reset.ac-iam-crt.cloud.aircanada.com",
                "password-reset.ac-iam-int.cloud.aircanada.com",
                "password-reset.ac-iam-uat.cloud.aircanada.com"
            ],
            "batch_sources": [
                "strict",
                "strict",
                "strict",
                "strict",
                "strict"
            ],
            "promote_revived": true,
            "labeled_at": "2026-03-24T22:05:25.935Z",
            "usage": {
                "prompt_tokens": 887,
                "completion_tokens": 445,
                "total_tokens": 1332,
                "prompt_tokens_details": {
                    "cached_tokens": 128
                },
                "prompt_cache_hit_tokens": 128,
                "prompt_cache_miss_tokens": 759
            }
        },
        "v5": {
            "processed_at": "2026-03-24T22:05:25.984Z",
            "auto_claim_enabled": true,
            "telegram_enabled": true,
            "slug": "aircanada.com-2026-03-25"
        }
    }
}