{
    "ok": true,
    "slug": "co.ls-2026-03-28",
    "stats": {
        "subs": 36520,
        "all": 36520,
        "resolved": 28081,
        "live": 36,
        "takeover": 32,
        "juicy": 19,
        "nuclei": 0,
        "subjack": 0,
        "subjack_vuln": 0,
        "takeover_v4": 1,
        "takeover_hot_claim": 0,
        "takeover_claimed": 0,
        "takeover_telegram_ok": 0,
        "confirmed": false,
        "alert": true,
        "scan_log": true
    },
    "path": "\/www\/wwwroot\/tooldomain\/output\/co.ls-2026-03-28",
    "takeover_candidates": [
        "admin.webberprinting.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32m43d8f0761ebd2344.vercel-dns-017.com\u001b[0m]",
        "app.utrack.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32mcname.vercel-dns.com\u001b[0m]",
        "cache.standardlesothobank.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32md3qjub878mrnj5.cloudfront.net\u001b[0m]",
        "cdn.standardlesothobank.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32md225aragd2pedw.cloudfront.net\u001b[0m]",
        "fin.standardlesothobank.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32md306r53txfvstu.cloudfront.net\u001b[0m]",
        "finuat.standardlesothobank.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32mfinuat-standardlesothobank-co-ls-1502512534.eu-west-1.elb.amazonaws.com\u001b[0m]",
        "islotto.haraka.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32mlotto-prd-public-alb-1861186239.eu-west-1.elb.amazonaws.com\u001b[0m]",
        "orders.galitos.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32mcname.vercel-dns.com\u001b[0m]",
        "prod.simregistration.etl.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32msim-prod-lb-2027056752.af-south-1.elb.amazonaws.com\u001b[0m]",
        "rent.mosoholdings.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32md3ul5mfo9xt4gx.cloudfront.net\u001b[0m]",
        "simregistration.etl.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32msim-prod-lb-2027056752.af-south-1.elb.amazonaws.com\u001b[0m]",
        "smartshopper.picknpay.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32mprod-ssportal-1572107676.eu-west-1.elb.amazonaws.com\u001b[0m]",
        "tbcv.pmg.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32m34a7818dfda2980f.vercel-dns-017.com\u001b[0m]",
        "uat.simregistration.etl.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32msim-uat-lb-704119630.af-south-1.elb.amazonaws.com\u001b[0m]",
        "www.cloudalign.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32mcname.vercel-dns.com\u001b[0m]",
        "www.coretechstrategies.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32m8763aab2ad857bd6.vercel-dns-017.com\u001b[0m]",
        "www.countrylifefoundationlesotho.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32mbe844da299028a98.vercel-dns-017.com\u001b[0m]",
        "www.ecobonanza.etl.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32meconet-git-main-lumminydevs.vercel.app\u001b[0m]",
        "www.ironmountain.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32mcname.vercel-dns.com\u001b[0m]",
        "www.ishop.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32mshops.myshopify.com\u001b[0m]",
        "www.kes.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32m0ee51db5d2862c39.vercel-dns-017.com\u001b[0m]",
        "www.mmpsychologicalservices.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32m7728ff442eaf5b8b.vercel-dns-017.com\u001b[0m]",
        "www.moshoeshoewalk.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32mf0bf5bf7688cae6b.vercel-dns-017.com\u001b[0m]",
        "www.pmg.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32mc429ef6c453acbe1.vercel-dns-017.com\u001b[0m]",
        "www.pokerstars.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32mredirects-tier-1-alb-723314737.eu-west-1.elb.amazonaws.com\u001b[0m]",
        "www.propmarket.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32mcname.vercel-dns.com\u001b[0m]",
        "www.reptilefleet.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32mef364bb13d8fa404.vercel-dns-017.com\u001b[0m]",
        "www.sekhametsi.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32mcname.vercel-dns.com\u001b[0m]",
        "www.trinitysound.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32m1beb9db21883d25b.vercel-dns-017.com\u001b[0m]",
        "www.utrack.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32mcname.vercel-dns.com\u001b[0m]",
        "www.webberprinting.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32m556f3bfa10cd7960.vercel-dns-017.com\u001b[0m]",
        "www3.standardlesothobank.co.ls [\u001b[35mCNAME\u001b[0m] [\u001b[32mdxfwun9yiec5s.cloudfront.net\u001b[0m]"
    ],
    "takeover_v4": {
        "domain": "co.ls",
        "version": 4,
        "generated_at": "2026-03-28T09:37:53.029Z",
        "ai_filter": {
            "engine": "rules_scorer_v1",
            "min_score": 48,
            "llm_pool_min": 38,
            "evaluated": 2,
            "kept_strict": 1,
            "llm_review_pool": 0,
            "dropped_noise": 1,
            "deep_skipped_below_pool": 1
        },
        "candidates": [
            {
                "host": "api.tablr.co.ls",
                "cname": "ghs.googlehosted.com",
                "status": 404,
                "title": null,
                "fingerprint": "firebase",
                "confidence": "high",
                "claim_score": 50,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "false_positive",
                "llm_confidence": 0.8,
                "llm_rationale_vi": "CNAME trỏ đến ghs.googlehosted.com (Google Sites) nhưng HTTP 404. Tuy nhiên, Google Sites thường không cho phép claim tài khoản từ subdomain người khác, và 404 có thể chỉ là trang chưa được cấu hình. Không có bằng chứng rõ ràng về khả năng claim.",
                "llm_labeled_at": "2026-03-28T09:37:58.289Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low"
            }
        ],
        "llm_review_pool": [],
        "llm_batch": {
            "provider": "deepseek",
            "base_url": "https:\/\/api.deepseek.com\/v1",
            "model": "deepseek-chat",
            "top_n_requested": 5,
            "batch_hosts": [
                "api.tablr.co.ls"
            ],
            "batch_sources": [
                "strict"
            ],
            "promote_revived": true,
            "labeled_at": "2026-03-28T09:37:58.289Z",
            "usage": {
                "prompt_tokens": 381,
                "completion_tokens": 127,
                "total_tokens": 508,
                "prompt_tokens_details": {
                    "cached_tokens": 128
                },
                "prompt_cache_hit_tokens": 128,
                "prompt_cache_miss_tokens": 253
            }
        }
    }
}