{
    "ok": true,
    "slug": "auth0.com-2026-03-26",
    "stats": {
        "subs": 38028,
        "all": 38028,
        "resolved": 35290,
        "live": 23,
        "takeover": 24,
        "juicy": 14,
        "nuclei": 0,
        "subjack": 0,
        "subjack_vuln": 0,
        "takeover_v4": 3,
        "takeover_hot_claim": 0,
        "takeover_claimed": 0,
        "takeover_telegram_ok": 0,
        "confirmed": false,
        "alert": true,
        "scan_log": true
    },
    "path": "\/www\/wwwroot\/tooldomain\/output\/auth0.com-2026-03-26",
    "takeover_candidates": [
        "ab-dashboard.it.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdashboard-ab-server.vercel.app\u001b[0m]",
        "apidays.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32madoring-bassi-5e5741.netlify.com\u001b[0m]",
        "ask.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdopdzn8qc5oof.cloudfront.net\u001b[0m]",
        "billing.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mwhispering-scallop-uzrmwgi9p0jn2zkxnqec4djd.herokudns.com\u001b[0m]",
        "blog.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md2yomkvnu3rt2b.cloudfront.net\u001b[0m]",
        "cdn.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdp0wn1kjwhg75.cloudfront.net\u001b[0m]",
        "cdn2.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdp0wn1kjwhg75.cloudfront.net\u001b[0m]",
        "components.lab.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mcname.vercel-dns.com\u001b[0m]",
        "debs.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md2e087qu8hrklx.cloudfront.net\u001b[0m]",
        "explorer.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mcname.vercel-dns.com\u001b[0m]",
        "flows.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mcname.vercel-dns.com\u001b[0m]",
        "growth.it.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mboiling-wolverine-1vxu4ebe3iswhgc7a69731zt.herokudns.com\u001b[0m]",
        "gslink.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md2q3f63p3r144m.cloudfront.net\u001b[0m]",
        "hamburger-software-zendesk-cd-5gmyx2ivz08cdfzf.edge.tenants.eu.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mpvsty8.eu.auth0.com.pivot.prod.auth0edge.com\u001b[0m]",
        "hungryghost-cd-he6dghe0yz1anexx.edge.tenants.uk.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mhungryghost.uk.auth0.com\u001b[0m]",
        "lab.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mcname.vercel-dns.com\u001b[0m]",
        "partners.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32malb-prod2-allbound-com-1982728861.us-west-2.elb.amazonaws.com\u001b[0m]",
        "prod-tally-tri-cd-efpuvqexgd7qeaoq.edge.tenants.eu.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mpvsty8.eu.auth0.com.pivot.prod.auth0edge.com\u001b[0m]",
        "releases.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdu7yibthn53n9.cloudfront.net\u001b[0m]",
        "releases.dev.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md306alqy1wy033.cloudfront.net\u001b[0m]",
        "resources.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1ncf0ptsmdl8p.cloudfront.net\u001b[0m]",
        "styleguide.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdk8ldwhqv3xve.cloudfront.net\u001b[0m]",
        "tally-prod-cd-yvcxyogekdsurppk.edge.tenants.au.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mtally-prod.au.auth0.com\u001b[0m]",
        "test-tally-tri-cd-jnn3mw8wkybno1r0.edge.tenants.eu.auth0.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mpvsty8.eu.auth0.com.pivot.prod.auth0edge.com\u001b[0m]"
    ],
    "takeover_v4": {
        "domain": "auth0.com",
        "version": 5,
        "generated_at": "2026-03-26T02:22:47.711Z",
        "ai_filter": {
            "engine": "rules_scorer_v1",
            "min_score": 48,
            "llm_pool_min": 38,
            "evaluated": 4,
            "kept_strict": 3,
            "llm_review_pool": 0,
            "dropped_noise": 1,
            "deep_skipped_below_pool": 1
        },
        "candidates": [
            {
                "host": "ab-dashboard.it.auth0.com",
                "cname": "dashboard-ab-server.vercel.app",
                "status": 404,
                "title": "Error",
                "fingerprint": "vercel",
                "confidence": "high",
                "claim_score": 56,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "unlikely",
                "llm_confidence": 0.6,
                "llm_rationale_vi": "Vercel app trả về 404, nhưng cấu trúc tên miền phức tạp và có thể là môi trường staging\/internal. Khả năng claim thấp.",
                "llm_labeled_at": "2026-03-26T02:22:57.512Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low",
                "claimed": false,
                "claim_status": "needs_manual",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/ab-dashboard.it.auth0.com\/",
                    "http_status": 404,
                    "title_snippet": "Error",
                    "verify_error": null,
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:llm_priority_low"
            },
            {
                "host": "gslink.auth0.com",
                "cname": "d2q3f63p3r144m.cloudfront.net",
                "status": 404,
                "title": "404 Not Found",
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 54,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "unlikely",
                "llm_confidence": 0.7,
                "llm_rationale_vi": "CloudFront trả về 404, nhưng có thể là bucket S3 chưa cấu hình hoặc đã bị xóa. Tuy nhiên, không có bằng chứng rõ ràng về khả năng claim.",
                "llm_labeled_at": "2026-03-26T02:22:57.512Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low",
                "claimed": false,
                "claim_status": "needs_manual",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/gslink.auth0.com\/",
                    "http_status": 404,
                    "title_snippet": "404 Not Found",
                    "verify_error": null,
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:llm_priority_low"
            },
            {
                "host": "tally-prod-cd-yvcxyogekdsurppk.edge.tenants.au.auth0.com",
                "cname": "tally-prod.au.auth0.com",
                "status": 404,
                "title": null,
                "fingerprint": "tally",
                "confidence": "high",
                "claim_score": 52,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "false_positive",
                "llm_confidence": 0.8,
                "llm_rationale_vi": "CNAME trỏ đến tên miền auth0.com nội bộ (tally-prod.au.auth0.com), đây là cấu hình hợp lệ của Auth0, không phải lỗ hổng claim.",
                "llm_labeled_at": "2026-03-26T02:22:57.512Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low",
                "claimed": false,
                "claim_status": "needs_manual",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/tally-prod-cd-yvcxyogekdsurppk.edge.tenants.au.auth0.com\/",
                    "http_status": 404,
                    "title_snippet": "",
                    "verify_error": null,
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:llm_priority_low"
            }
        ],
        "llm_review_pool": [],
        "llm_batch": {
            "provider": "deepseek",
            "base_url": "https:\/\/api.deepseek.com\/v1",
            "model": "deepseek-chat",
            "top_n_requested": 5,
            "batch_hosts": [
                "ab-dashboard.it.auth0.com",
                "gslink.auth0.com",
                "tally-prod-cd-yvcxyogekdsurppk.edge.tenants.au.auth0.com"
            ],
            "batch_sources": [
                "strict",
                "strict",
                "strict"
            ],
            "promote_revived": true,
            "labeled_at": "2026-03-26T02:22:57.512Z",
            "usage": {
                "prompt_tokens": 623,
                "completion_tokens": 279,
                "total_tokens": 902,
                "prompt_tokens_details": {
                    "cached_tokens": 128
                },
                "prompt_cache_hit_tokens": 128,
                "prompt_cache_miss_tokens": 495
            }
        },
        "v5": {
            "processed_at": "2026-03-26T02:22:57.561Z",
            "auto_claim_enabled": true,
            "telegram_enabled": true,
            "slug": "auth0.com-2026-03-26"
        }
    }
}