{ "ok": true, "slug": "americanexpress.com-2026-03-25", "stats": { "subs": 46319, "all": 46319, "resolved": 19997, "live": 20, "takeover": 48, "juicy": 48, "nuclei": 0, "subjack": 0, "subjack_vuln": 0, "takeover_v4": 2, "takeover_hot_claim": 0, "takeover_claimed": 0, "takeover_telegram_ok": 0, "confirmed": false, "alert": true, "scan_log": true }, "path": "\/www\/wwwroot\/tooldomain\/output\/americanexpress.com-2026-03-25", "takeover_candidates": [ "authzsidecarawspublic-qaausw2green.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32ma21e19f461f52440b9ff925f7630f078-085a32fbe986d071.elb.us-west-2.amazonaws.com\u001b[0m]", "awsyksanedit-devausw2.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32ma77070c0894f04cbfbecc4e1f0e2054b-cc637e53162a8a43.elb.us-west-2.amazonaws.com\u001b[0m]", "b2bpayments-qa.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md14i4tdwwyne8c.cloudfront.net\u001b[0m]", "b2bpayments.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md23095bzqh8wc4.cloudfront.net\u001b[0m]", "bpp.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1fo1shk7anocb.cloudfront.net\u001b[0m]", "cdn.membership-qa.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md2swk85t701f8t.cloudfront.net\u001b[0m]", "cdn.membership.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md8n2pqb6x2ev8.cloudfront.net\u001b[0m]", "centerapigwwest2-dev.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mf8uvnnwf8e.execute-api.us-west-2.amazonaws.com\u001b[0m]", "customercommunity.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mplatform-prod-ecs-alb-1230283576.us-east-1.elb.amazonaws.com\u001b[0m]", "ddawsintermaxe3apr9-devausw2.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32ma46ab349a7e9941f28b48a8f6e3d651f-b3e34bd96465901d.elb.us-west-2.amazonaws.com\u001b[0m]", "ddawsintermaxe3apr9-qaausw2.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32ma21e19f461f52440b9ff925f7630f078-085a32fbe986d071.elb.us-west-2.amazonaws.com\u001b[0m]", "ekstemporalgrafanadbpdr.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mk8s-monitoring-4d50633e0e-615362302.us-west-1.elb.amazonaws.com\u001b[0m]", "ekstemporalgrafanadr.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mk8s-monitoring-4d50633e0e-615362302.us-west-1.elb.amazonaws.com\u001b[0m]", "ekstemporalprometheusdbpdr.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mk8s-monitoring-4d50633e0e-615362302.us-west-1.elb.amazonaws.com\u001b[0m]", "ekstemporalprometheusdr.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mk8s-monitoring-4d50633e0e-615362302.us-west-1.elb.amazonaws.com\u001b[0m]", "ekstemporalwebdbpdr.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mk8s-monitoring-4d50633e0e-615362302.us-west-1.elb.amazonaws.com\u001b[0m]", "ekstemporalwebdr.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mk8s-monitoring-4d50633e0e-615362302.us-west-1.elb.amazonaws.com\u001b[0m]", "jbinteraws-ause1.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32ma365481d12a2a4f78bbbe4f89c2bb2cc-4307d19d8db9ae54.elb.us-east-1.amazonaws.com\u001b[0m]", "jbinteraws-devausw2.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32ma46ab349a7e9941f28b48a8f6e3d651f-b3e34bd96465901d.elb.us-west-2.amazonaws.com\u001b[0m]", "jbinteraws-qaausw2.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32ma21e19f461f52440b9ff925f7630f078-085a32fbe986d071.elb.us-west-2.amazonaws.com\u001b[0m]", "plan-dev.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mk8s-istioing-gateway-db745bc56c-620873248c4e40fd.elb.us-east-1.amazonaws.com\u001b[0m]", "plan-e1.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md3vfsen76antr7.cloudfront.net\u001b[0m]", "plan-e2.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md17d3b6mu3jdqy.cloudfront.net\u001b[0m]", "plan-e2sl.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdyrruhtfl5r67.cloudfront.net\u001b[0m]", "plan-e3.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md3jt6zlo0254d5.cloudfront.net\u001b[0m]", "plan-e3sl.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1q5vztfr3b8np.cloudfront.net\u001b[0m]", "plan-gdha-e3.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1615341kxt3gj.cloudfront.net\u001b[0m]", "plan-gdha-e3sl.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdtfkyw5ruotmt.cloudfront.net\u001b[0m]", "plan-internal-e1.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-aexp-plan-e1-internal-planapp-855778129.us-east-1.elb.amazonaws.com\u001b[0m]", "plan-internal-e2.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-aexp-plan-e2-internal-planapp-1684898740.us-east-1.elb.amazonaws.com\u001b[0m]", "plan-internal-e2sl.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-aexp-plan-e2sl-internal-planapp-1174701153.us-east-1.elb.amazonaws.com\u001b[0m]", "plan-internal-gdha-e3sl.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-plan-gdhasl-internal-planapp-538094669.us-east-1.elb.amazonaws.com\u001b[0m]", "plan-internal-gdha.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-plan-gdha-internal-planapp-1190812089.us-east-1.elb.amazonaws.com\u001b[0m]", "plan-internal-sl.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-aexp-plan-e3sl-internal-planapp-1716609137.us-east-1.elb.amazonaws.com\u001b[0m]", "plan-internal.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-aexp-plan-e3-internal-planapp-871477430.us-east-1.elb.amazonaws.com\u001b[0m]", "plan-prod.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mk8s-istioing-gateway-0ec48d6716-9a4540ddba5b4525.elb.us-east-1.amazonaws.com\u001b[0m]", "plan-qa.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mk8s-istioing-gateway-4b9122cfd3-edbd633b3375de39.elb.us-east-1.amazonaws.com\u001b[0m]", "plan-sl.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mk8s-istioing-gateway-1bf8425514-c30040e7c66e3ed1.elb.us-east-1.amazonaws.com\u001b[0m]", "plan.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md3jt6zlo0254d5.cloudfront.net\u001b[0m]", "planinsights-dev.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mk8s-istioing-gateway-db745bc56c-620873248c4e40fd.elb.us-east-1.amazonaws.com\u001b[0m]", "planinsights-qa.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mk8s-istioing-gateway-4b9122cfd3-edbd633b3375de39.elb.us-east-1.amazonaws.com\u001b[0m]", "planinsights-sl.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mk8s-istioing-gateway-1bf8425514-c30040e7c66e3ed1.elb.us-east-1.amazonaws.com\u001b[0m]", "planinsights.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mk8s-istioing-gateway-0ec48d6716-9a4540ddba5b4525.elb.us-east-1.amazonaws.com\u001b[0m]", "plansl.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1q5vztfr3b8np.cloudfront.net\u001b[0m]", "swtfesingle26-ause1.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32ma07d9b8cabea544859f747bfb00ad9e2-536ab74b40c24df4.elb.us-east-1.amazonaws.com\u001b[0m]", "swtfesingle26-devausw2.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32ma77070c0894f04cbfbecc4e1f0e2054b-cc637e53162a8a43.elb.us-west-2.amazonaws.com\u001b[0m]", "swtfesingle5-devausw2.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32ma77070c0894f04cbfbecc4e1f0e2054b-cc637e53162a8a43.elb.us-west-2.amazonaws.com\u001b[0m]", "test14491-devausw2.americanexpress.com [\u001b[35mCNAME\u001b[0m] [\u001b[32ma77070c0894f04cbfbecc4e1f0e2054b-cc637e53162a8a43.elb.us-west-2.amazonaws.com\u001b[0m]" ], "takeover_v4": { "domain": "americanexpress.com", "version": 5, "generated_at": "2026-03-25T06:09:39.922Z", "ai_filter": { "engine": "rules_scorer_v1", "min_score": 48, "llm_pool_min": 38, "evaluated": 8, "kept_strict": 2, "llm_review_pool": 0, "dropped_noise": 6, "deep_skipped_below_pool": 6 }, "candidates": [ { "host": "plan-gdha-e3.americanexpress.com", "cname": "d1615341kxt3gj.cloudfront.net", "status": 404, "title": null, "fingerprint": "aws_s3", "confidence": "high", "claim_score": 54, "claim_tier": "medium", "signals": [], "hard_noise": false, "real_candidate": true, "llm_verdict": "false_positive", "llm_confidence": 0.9, "llm_rationale_vi": "CNAME trỏ tới CloudFront nhưng HTTP 404 có thể là trang lỗi mặc định của ứng dụng đang hoạt động, không phải tài nguyên bị bỏ trống.", "llm_labeled_at": "2026-03-25T06:09:46.925Z", "llm_model": "deepseek-chat", "llm_priority": "low", "claimed": false, "claim_status": "needs_manual", "claim_details": { "method": "http_verify", "verify_url": "https:\/\/plan-gdha-e3.americanexpress.com\/", "http_status": 404, "title_snippet": "", "verify_error": null, "webhook_note": "webhook_http_200", "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)" }, "telegram_sent": false, "telegram_error": "filtered:llm_priority_low" }, { "host": "plan-gdha-e3sl.americanexpress.com", "cname": "dtfkyw5ruotmt.cloudfront.net", "status": 404, "title": null, "fingerprint": "aws_s3", "confidence": "high", "claim_score": 54, "claim_tier": "medium", "signals": [], "hard_noise": false, "real_candidate": true, "llm_verdict": "false_positive", "llm_confidence": 0.9, "llm_rationale_vi": "Tương tự, CNAME CloudFront với 404, có khả năng là cấu hình ứng dụng hợp lệ của chủ sở hữu, không cho thấy có thể chiếm quyền.", "llm_labeled_at": "2026-03-25T06:09:46.925Z", "llm_model": "deepseek-chat", "llm_priority": "low", "claimed": false, "claim_status": "needs_manual", "claim_details": { "method": "http_verify", "verify_url": "https:\/\/plan-gdha-e3sl.americanexpress.com\/", "http_status": 404, "title_snippet": "", "verify_error": null, "webhook_note": "webhook_http_200", "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)" }, "telegram_sent": false, "telegram_error": "filtered:llm_priority_low" } ], "llm_review_pool": [], "llm_batch": { "provider": "deepseek", "base_url": "https:\/\/api.deepseek.com\/v1", "model": "deepseek-chat", "top_n_requested": 5, "batch_hosts": [ "plan-gdha-e3.americanexpress.com", "plan-gdha-e3sl.americanexpress.com" ], "batch_sources": [ "strict", "strict" ], "promote_revived": true, "labeled_at": "2026-03-25T06:09:46.925Z", "usage": { "prompt_tokens": 505, "completion_tokens": 179, "total_tokens": 684, "prompt_tokens_details": { "cached_tokens": 128 }, "prompt_cache_hit_tokens": 128, "prompt_cache_miss_tokens": 377 } }, "v5": { "processed_at": "2026-03-25T06:09:46.971Z", "auto_claim_enabled": true, "telegram_enabled": true, "slug": "americanexpress.com-2026-03-25" } } }