{ "ok": true, "slug": "buffer.com-2026-03-27", "stats": { "subs": 201, "all": 201, "resolved": 92, "live": 92, "takeover": 25, "juicy": 25, "nuclei": 0, "subjack": 0, "subjack_vuln": 0, "takeover_v4": 0, "takeover_hot_claim": 0, "takeover_claimed": 0, "takeover_telegram_ok": 0, "confirmed": false, "alert": true, "scan_log": true }, "path": "\/www\/wwwroot\/tooldomain\/output\/buffer.com-2026-03-27", "takeover_candidates": [ "analyze-api.dev.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbuffer-k3-staging-non-prod-group-975058177.us-east-1.elb.amazonaws.com\u001b[0m]", "api.dev.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbuffer-k3-staging-non-prod-group-975058177.us-east-1.elb.amazonaws.com\u001b[0m]", "buffer-customerio-webhook.prod-bibes.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbuffer-k3-bibes-2-185443587.us-east-1.elb.amazonaws.com\u001b[0m]", "buffer-reader.prod-bibes.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbuffer-k3-bibes-2-185443587.us-east-1.elb.amazonaws.com\u001b[0m]", "buffertools-dot-com.prod-bibes.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbuffer-k3-bibes-2-185443587.us-east-1.elb.amazonaws.com\u001b[0m]", "components.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1hrbuowp1adcb.cloudfront.net\u001b[0m]", "graph.dev.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbuffer-k3-staging-non-prod-group-975058177.us-east-1.elb.amazonaws.com\u001b[0m]", "graphql-api-docs.prod-bibes.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbuffer-k3-bibes-2-185443587.us-east-1.elb.amazonaws.com\u001b[0m]", "graphql-changelog.prod-bibes.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbuffer-k3-bibes-2-185443587.us-east-1.elb.amazonaws.com\u001b[0m]", "graphql-playground.prod-bibes.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbuffer-k3-bibes-2-185443587.us-east-1.elb.amazonaws.com\u001b[0m]", "images.dev.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbuffer-k3-staging-non-prod-group-975058177.us-east-1.elb.amazonaws.com\u001b[0m]", "legacy-web.dev.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbuffer-k3-staging-non-prod-group-975058177.us-east-1.elb.amazonaws.com\u001b[0m]", "links.dev.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbuffer-k3-staging-non-prod-group-975058177.us-east-1.elb.amazonaws.com\u001b[0m]", "open-api.dev.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbuffer-k3-staging-non-prod-group-975058177.us-east-1.elb.amazonaws.com\u001b[0m]", "publish-api.prod-bibes.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbuffer-k3-bibes-2-185443587.us-east-1.elb.amazonaws.com\u001b[0m]", "publish-cdn.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdxgoesq69f2gt.cloudfront.net\u001b[0m]", "sa.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md5xtqpchjkt55.cloudfront.net\u001b[0m]", "sapi.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1x0z6wpgb5vkm.cloudfront.net\u001b[0m]", "scraper.dev.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mk3-static-ip-scraper-alb-1927854712.us-east-1.elb.amazonaws.com\u001b[0m]", "segment-analytics.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md5xtqpchjkt55.cloudfront.net\u001b[0m]", "segment-api.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1x0z6wpgb5vkm.cloudfront.net\u001b[0m]", "shopgrid-reverseproxy.prod-bibes.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbuffer-k3-bibes-2-185443587.us-east-1.elb.amazonaws.com\u001b[0m]", "vpn.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdualstack.buffervpn-1802671786.us-east-1.elb.amazonaws.com\u001b[0m]", "vpnmanager-client.prod-bibes.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbuffer-k3-bibes-2-185443587.us-east-1.elb.amazonaws.com\u001b[0m]", "zendesk-advocates.prod-bibes.buffer.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbuffer-k3-bibes-2-185443587.us-east-1.elb.amazonaws.com\u001b[0m]" ], "takeover_v4": { "domain": "buffer.com", "version": 4, "generated_at": "2026-03-27T10:29:49.731Z", "ai_filter": { "engine": "rules_scorer_v1", "min_score": 48, "llm_pool_min": 38, "evaluated": 5, "kept_strict": 0, "llm_review_pool": 4, "dropped_noise": 5, "deep_skipped_below_pool": 1 }, "candidates": [], "llm_review_pool": [ { "host": "sa.buffer.com", "cname": "d5xtqpchjkt55.cloudfront.net", "status": 404, "title": null, "fingerprint": "aws_s3", "confidence": "high", "claim_score": 44, "claim_tier": "low", "signals": [], "hard_noise": false, "real_candidate": false, "llm_eligible": true, "strict_pass": false, "llm_verdict": "false_positive", "llm_confidence": 0.7, "llm_rationale_vi": "CNAME trỏ tới CloudFront nhưng trả về 404, có thể là endpoint chưa cấu hình của ứng dụng chính chủ, không phải tài nguyên bị bỏ rơi.", "llm_labeled_at": "2026-03-27T10:30:02.246Z", "llm_model": "deepseek-chat", "llm_priority": "low" }, { "host": "sapi.buffer.com", "cname": "d1x0z6wpgb5vkm.cloudfront.net", "status": 404, "title": null, "fingerprint": "aws_s3", "confidence": "high", "claim_score": 44, "claim_tier": "low", "signals": [], "hard_noise": false, "real_candidate": false, "llm_eligible": true, "strict_pass": false, "llm_verdict": "false_positive", "llm_confidence": 0.7, "llm_rationale_vi": "Tương tự các host khác, CNAME CloudFront và HTTP 404. Đây có thể là cấu hình dự phòng hoặc chưa triển khai, không cho thấy khả năng chiếm quyền.", "llm_labeled_at": "2026-03-27T10:30:02.246Z", "llm_model": "deepseek-chat", "llm_priority": "low" }, { "host": "segment-analytics.buffer.com", "cname": "d5xtqpchjkt55.cloudfront.net", "status": 404, "title": null, "fingerprint": "aws_s3", "confidence": "high", "claim_score": 44, "claim_tier": "low", "signals": [], "hard_noise": false, "real_candidate": false, "llm_eligible": true, "strict_pass": false, "llm_verdict": "false_positive", "llm_confidence": 0.7, "llm_rationale_vi": "Chia sẻ CNAME giống sa.buffer.com, trạng thái 404 nhất quán. Khả năng cao là cấu hình hợp lệ của chủ sở hữu, không phải tài nguyên có thể claim.", "llm_labeled_at": "2026-03-27T10:30:02.246Z", "llm_model": "deepseek-chat", "llm_priority": "low" }, { "host": "segment-api.buffer.com", "cname": "d1x0z6wpgb5vkm.cloudfront.net", "status": 404, "title": null, "fingerprint": "aws_s3", "confidence": "high", "claim_score": 44, "claim_tier": "low", "signals": [], "hard_noise": false, "real_candidate": false, "llm_eligible": true, "strict_pass": false, "llm_verdict": "false_positive", "llm_confidence": 0.7, "llm_rationale_vi": "CNAME CloudFront và phản hồi 404. Mẫu này phù hợp với cấu hình subdomain chưa active của dịch vụ chính chủ, không phải false negative.", "llm_labeled_at": "2026-03-27T10:30:02.246Z", "llm_model": "deepseek-chat", "llm_priority": "low" } ], "llm_batch": { "provider": "deepseek", "base_url": "https:\/\/api.deepseek.com\/v1", "model": "deepseek-chat", "top_n_requested": 5, "batch_hosts": [ "sa.buffer.com", "sapi.buffer.com", "segment-analytics.buffer.com", "segment-api.buffer.com" ], "batch_sources": [ "pool", "pool", "pool", "pool" ], "promote_revived": true, "labeled_at": "2026-03-27T10:30:02.246Z", "usage": { "prompt_tokens": 719, "completion_tokens": 324, "total_tokens": 1043, "prompt_tokens_details": { "cached_tokens": 128 }, "prompt_cache_hit_tokens": 128, "prompt_cache_miss_tokens": 591 } } } }