{
    "ok": true,
    "slug": "co.cr-2026-03-28",
    "stats": {
        "subs": 43117,
        "all": 43117,
        "resolved": 40797,
        "live": 69,
        "takeover": 57,
        "juicy": 68,
        "nuclei": 0,
        "subjack": 0,
        "subjack_vuln": 0,
        "takeover_v4": 2,
        "takeover_hot_claim": 1,
        "takeover_claimed": 0,
        "takeover_telegram_ok": 2,
        "confirmed": false,
        "alert": true,
        "scan_log": true
    },
    "path": "\/www\/wwwroot\/tooldomain\/output\/co.cr-2026-03-28",
    "takeover_candidates": [
        "account.crateandbarrel.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mshops.myshopify.com\u001b[0m]",
        "app.controles.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32md3ntkhtd11a7xo.cloudfront.net\u001b[0m]",
        "asocarplus.acc.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mupbeat-montalcini-29319b.netlify.app\u001b[0m]",
        "beta.amway.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mdhudsgij53jfb.cloudfront.net\u001b[0m]",
        "congreso.acc.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mcheerful-rolypoly-5ce9f4.netlify.app\u001b[0m]",
        "constructora.convisa.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mhelpful-paletas-2281c9.netlify.app\u001b[0m]",
        "elearning.acc.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32md2lnilbnmfgjll.cloudfront.net\u001b[0m]",
        "email.m.cerostress.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mmailgun.org\u001b[0m]",
        "email.mkt.am.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mmailgun.org\u001b[0m]",
        "enlinea.cinepolis.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32md1wnm2kcrvdyjy.cloudfront.net\u001b[0m]",
        "examen.contador.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mcname.tally.so\u001b[0m]",
        "ngcom.qa.amway.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mdbh9s4liuuudv.cloudfront.net\u001b[0m]",
        "ngcom.uat.amway.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mdqtgj33fbl310.cloudfront.net\u001b[0m]",
        "origin-cwh-int.bridgestone.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mint-alb-global-1343479506.us-east-1.elb.amazonaws.com\u001b[0m]",
        "origin-cwh-qa.bridgestone.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mqa-alb-global-730299947.us-east-1.elb.amazonaws.com\u001b[0m]",
        "origin-cwh-uat.bridgestone.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32muat-alb-consumer-latam-1733821095.us-east-1.elb.amazonaws.com\u001b[0m]",
        "origin-int.bridgestonecomercial.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mint-alb-global-1343479506.us-east-1.elb.amazonaws.com\u001b[0m]",
        "origin-qa.bridgestonecomercial.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mqa-alb-global-730299947.us-east-1.elb.amazonaws.com\u001b[0m]",
        "origin-uat.bridgestonecomercial.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32muat-alb-commercial-latam-1481023027.us-east-1.elb.amazonaws.com\u001b[0m]",
        "origin.bridgestone.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mprod-alb-consumer-latam-1951920626.us-east-1.elb.amazonaws.com\u001b[0m]",
        "origin.bridgestonecomercial.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mprod-alb-commercial-latam-1256624610.us-east-1.elb.amazonaws.com\u001b[0m]",
        "payment.amway.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32md1x3vskvnbod58.cloudfront.net\u001b[0m]",
        "payment.ngcom.qa.amway.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32md2uhayfhydub5t.cloudfront.net\u001b[0m]",
        "payment.ngcom.uat.amway.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32md3vlv8r7j21i82.cloudfront.net\u001b[0m]",
        "preview.amway.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mdhudsgij53jfb.cloudfront.net\u001b[0m]",
        "stage.cinepolis.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mdualstack.alb-webapp-stage-v00-954022348.us-east-1.elb.amazonaws.com\u001b[0m]",
        "staging.bein.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mtf-lb-2024100313332184080000000a-1140537937.us-east-1.elb.amazonaws.com\u001b[0m]",
        "stg.beta.amway.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mdhudsgij53jfb.cloudfront.net\u001b[0m]",
        "stg.ngcom.qa.amway.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mdbh9s4liuuudv.cloudfront.net\u001b[0m]",
        "stg.ngcom.uat.amway.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mdqtgj33fbl310.cloudfront.net\u001b[0m]",
        "timbres.contador.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mfrozen-tulip-wa59vbd1hemh4r8k3po1xuuo.herokudns.com\u001b[0m]",
        "uat.amway.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mdqtgj33fbl310.cloudfront.net\u001b[0m]",
        "webapp.confia.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32md2xhwqcpcvx1t2.cloudfront.net\u001b[0m]",
        "www.ajax.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mcplbp01-f202461456e2d7fe.elb.us-east-1.amazonaws.com\u001b[0m]",
        "www.alfidepa.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mproxy-ssl.webflow.com\u001b[0m]",
        "www.arcavida.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mcdn.webflow.com\u001b[0m]",
        "www.arkisur.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mfc1cae23636ea080.vercel-dns-017.com\u001b[0m]",
        "www.axion.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mcplbp01-f202461456e2d7fe.elb.us-east-1.amazonaws.com\u001b[0m]",
        "www.babymagic.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mcplbp01-f202461456e2d7fe.elb.us-east-1.amazonaws.com\u001b[0m]",
        "www.bikestation.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mshops.myshopify.com\u001b[0m]",
        "www.bioeffect.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mshops.myshopify.com\u001b[0m]",
        "www.burgerking.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mbkworld-production-2-1486619507.us-east-1.elb.amazonaws.com\u001b[0m]",
        "www.cinepolis.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mdualstack.alb-webapp-v00-2144697106.us-east-1.elb.amazonaws.com\u001b[0m]",
        "www.citroenorigins.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mpsa-alb-origins-1808123541.eu-west-1.elb.amazonaws.com\u001b[0m]",
        "www.colgate-palmolive.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mcplbp01-f202461456e2d7fe.elb.us-east-1.amazonaws.com\u001b[0m]",
        "www.colgate.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mcplbp01-f202461456e2d7fe.elb.us-east-1.amazonaws.com\u001b[0m]",
        "www.colgate360.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mcplbp01-f202461456e2d7fe.elb.us-east-1.amazonaws.com\u001b[0m]",
        "www.colgateluminous.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mcplbp01-f202461456e2d7fe.elb.us-east-1.amazonaws.com\u001b[0m]",
        "www.colgatepalmolive.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mcplbp01-f202461456e2d7fe.elb.us-east-1.amazonaws.com\u001b[0m]",
        "www.colgatesensitiveproalivio.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mcplbp01-f202461456e2d7fe.elb.us-east-1.amazonaws.com\u001b[0m]",
        "www.colgatetotal.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mcplbp01-f202461456e2d7fe.elb.us-east-1.amazonaws.com\u001b[0m]",
        "www.columbiasportswear.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mdm4sohibitrl5.cloudfront.net\u001b[0m]",
        "www.controles.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32md2jbzp4suuv17l.cloudfront.net\u001b[0m]",
        "www.corbegourmet.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mshops.myshopify.com\u001b[0m]",
        "www.cordilleraproducts.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mshops.myshopify.com\u001b[0m]",
        "www.crateandbarrel.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mshops.myshopify.com\u001b[0m]",
        "www.uat.amway.co.cr [\u001b[35mCNAME\u001b[0m] [\u001b[32mdqtgj33fbl310.cloudfront.net\u001b[0m]"
    ],
    "takeover_v4": {
        "domain": "co.cr",
        "version": 5,
        "generated_at": "2026-03-28T07:51:20.758Z",
        "ai_filter": {
            "engine": "rules_scorer_v1",
            "min_score": 48,
            "llm_pool_min": 38,
            "evaluated": 13,
            "kept_strict": 2,
            "llm_review_pool": 0,
            "dropped_noise": 11,
            "deep_skipped_below_pool": 11
        },
        "candidates": [
            {
                "host": "constructora.convisa.co.cr",
                "cname": "helpful-paletas-2281c9.netlify.app",
                "status": 404,
                "title": null,
                "fingerprint": "netlify",
                "confidence": "high",
                "claim_score": 77,
                "claim_tier": "high",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "claim_likely",
                "llm_confidence": 0.85,
                "llm_rationale_vi": "CNAME trỏ tới Netlify subdomain chung, HTTP 404, không có nội dung ứng dụng. Netlify cho phép claim subdomain chưa được gắn với site nào.",
                "llm_labeled_at": "2026-03-28T07:51:27.584Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "high",
                "claimed": false,
                "claim_status": "verify_error",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/constructora.convisa.co.cr\/",
                    "http_status": null,
                    "title_snippet": null,
                    "verify_error": "fetch failed",
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": true,
                "telegram_error": null
            },
            {
                "host": "examen.contador.co.cr",
                "cname": "cname.tally.so",
                "status": 404,
                "title": "Tally - Create Beautiful Forms for Free | Unlimited Forms & Submissions",
                "fingerprint": "tally",
                "confidence": "high",
                "claim_score": 67,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "false_positive",
                "llm_confidence": 0.9,
                "llm_rationale_vi": "CNAME trỏ tới Tally, HTTP 404 nhưng title hiển thị trang chủ Tally (ứng dụng đang live). Đây là trang lỗi 404 mặc định của Tally, không thể claim.",
                "llm_labeled_at": "2026-03-28T07:51:27.584Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low",
                "claimed": false,
                "claim_status": "needs_manual",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/examen.contador.co.cr\/",
                    "http_status": 404,
                    "title_snippet": "Tally - Create Beautiful Forms for Free | Unlimited Forms & Submissions",
                    "verify_error": null,
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": true,
                "telegram_error": null
            }
        ],
        "llm_review_pool": [],
        "llm_batch": {
            "provider": "deepseek",
            "base_url": "https:\/\/api.deepseek.com\/v1",
            "model": "deepseek-chat",
            "top_n_requested": 5,
            "batch_hosts": [
                "constructora.convisa.co.cr",
                "examen.contador.co.cr"
            ],
            "batch_sources": [
                "strict",
                "strict"
            ],
            "promote_revived": true,
            "labeled_at": "2026-03-28T07:51:27.584Z",
            "usage": {
                "prompt_tokens": 510,
                "completion_tokens": 190,
                "total_tokens": 700,
                "prompt_tokens_details": {
                    "cached_tokens": 128
                },
                "prompt_cache_hit_tokens": 128,
                "prompt_cache_miss_tokens": 382
            }
        },
        "v5": {
            "processed_at": "2026-03-28T07:51:27.662Z",
            "auto_claim_enabled": true,
            "telegram_enabled": true,
            "slug": "co.cr-2026-03-28"
        }
    }
}