{
    "ok": true,
    "slug": "com.eg-2026-03-28",
    "stats": {
        "subs": 12475,
        "all": 12475,
        "resolved": 10369,
        "live": 50,
        "takeover": 43,
        "juicy": 43,
        "nuclei": 0,
        "subjack": 0,
        "subjack_vuln": 0,
        "takeover_v4": 2,
        "takeover_hot_claim": 1,
        "takeover_claimed": 0,
        "takeover_telegram_ok": 0,
        "confirmed": false,
        "alert": true,
        "scan_log": true
    },
    "path": "\/www\/wwwroot\/tooldomain\/output\/com.eg-2026-03-28",
    "takeover_candidates": [
        "account.aroma.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32mshops.myshopify.com\u001b[0m]",
        "assets.aqar.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32md3v3fsgtzkz99y.cloudfront.net\u001b[0m]",
        "assets.aqarmap.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32md2eh85ql99553q.cloudfront.net\u001b[0m]",
        "cc.blackcircles.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32md1cnnj6ryj72o3.cloudfront.net\u001b[0m]",
        "crm.alunaut.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32m4beff0944447e7c6.vercel-dns-017.com\u001b[0m]",
        "crm.argonaut.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32m0f8ab40fb5763a12.vercel-dns-017.com\u001b[0m]",
        "dashboardtuktuk.ala3raf.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32mtuktuk-9c11c.web.app\u001b[0m]",
        "erp.bellfoods.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32md36jclu9lu8y1u.cloudfront.net\u001b[0m]",
        "garage.blackcircles.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32md1cnnj6ryj72o3.cloudfront.net\u001b[0m]",
        "img-0.aqar.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32md3bxis3qk6gzz.cloudfront.net\u001b[0m]",
        "img-0.aqarmap.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32md3bxis3qk6gzz.cloudfront.net\u001b[0m]",
        "img-1.aqar.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32md3bxis3qk6gzz.cloudfront.net\u001b[0m]",
        "img-1.aqarmap.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32md3bxis3qk6gzz.cloudfront.net\u001b[0m]",
        "img-2.aqar.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32md3bxis3qk6gzz.cloudfront.net\u001b[0m]",
        "img-2.aqarmap.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32md3bxis3qk6gzz.cloudfront.net\u001b[0m]",
        "img-3.aqar.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32md3bxis3qk6gzz.cloudfront.net\u001b[0m]",
        "img-3.aqarmap.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32md3bxis3qk6gzz.cloudfront.net\u001b[0m]",
        "img-4.aqar.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32md3bxis3qk6gzz.cloudfront.net\u001b[0m]",
        "img-4.aqarmap.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32md3bxis3qk6gzz.cloudfront.net\u001b[0m]",
        "search-svc.aqarmap.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32macb5cb8202f744e28ad3703c88e35f88-691382165.eu-west-1.elb.amazonaws.com\u001b[0m]",
        "staging.argonaut.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32m3a383c7fa149a919.vercel-dns-016.com\u001b[0m]",
        "www.abb.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32mxc-alb-9aag8556-prod-ext01-1017646772.eu-west-1.elb.amazonaws.com\u001b[0m]",
        "www.ala3raf.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32mala3raf-bbfc1.web.app\u001b[0m]",
        "www.aldoshoes.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32mshops.myshopify.com\u001b[0m]",
        "www.allianz.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32mcdn.webflow.com\u001b[0m]",
        "www.almasrya.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32mcdn.webflow.com\u001b[0m]",
        "www.americantourister.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32mshops.myshopify.com\u001b[0m]",
        "www.aqarmap.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32macb5cb8202f744e28ad3703c88e35f88-691382165.eu-west-1.elb.amazonaws.com\u001b[0m]",
        "www.argonaut.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32m3a383c7fa149a919.vercel-dns-016.com\u001b[0m]",
        "www.aroma.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32mshops.myshopify.com\u001b[0m]",
        "www.asatechnology.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32mcname.vercel-dns.com\u001b[0m]",
        "www.autocycle.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32m403fa92f5ba4b20b.vercel-dns-017.com\u001b[0m]",
        "www.beautify.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32mshops.myshopify.com\u001b[0m]",
        "www.bellezza.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32mcname.vercel-dns.com\u001b[0m]",
        "www.benben.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32mshops.myshopify.com\u001b[0m]",
        "www.bfi.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32mshops.myshopify.com\u001b[0m]",
        "www.blackcircles.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32md2wu2p36fx5vzw.cloudfront.net\u001b[0m]",
        "www.dashboardtuktuk.ala3raf.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32mtuktuk-9c11c.web.app\u001b[0m]",
        "www.dockland.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32mshops.myshopify.com\u001b[0m]",
        "www.eagle.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32meagle-eg.myshopify.com\u001b[0m]",
        "www.hyperone.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32mhyp-service-alb-436916143.eu-west-1.elb.amazonaws.com\u001b[0m]",
        "www.rehlat.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32mrehlategloadbalancer-1152399846.us-east-1.elb.amazonaws.com\u001b[0m]",
        "www.tripadvisor.com.eg [\u001b[35mCNAME\u001b[0m] [\u001b[32md2wb3gpo9o7ows.cloudfront.net\u001b[0m]"
    ],
    "takeover_v4": {
        "domain": "com.eg",
        "version": 5,
        "generated_at": "2026-03-28T17:10:27.379Z",
        "ai_filter": {
            "engine": "rules_scorer_v1",
            "min_score": 48,
            "llm_pool_min": 38,
            "evaluated": 15,
            "kept_strict": 2,
            "llm_review_pool": 6,
            "dropped_noise": 13,
            "deep_skipped_below_pool": 7
        },
        "candidates": [
            {
                "host": "assets.aqar.com.eg",
                "cname": "d3v3fsgtzkz99y.cloudfront.net",
                "status": 502,
                "title": "ERROR: The request could not be satisfied",
                "fingerprint": "aws_s3",
                "confidence": "medium",
                "claim_score": 83,
                "claim_tier": "critical",
                "signals": [
                    "the request could not be satisfied"
                ],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "claim_likely",
                "llm_confidence": 0.8,
                "llm_rationale_vi": "CNAME trỏ tới CloudFront, HTTP 502 với thông báo lỗi AWS 'request could not be satisfied'. Điều này cho thấy phân phối CloudFront chưa được cấu hình đúng, có khả năng chiếm quyền sở hữu.",
                "llm_labeled_at": "2026-03-28T17:10:43.159Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "high",
                "claimed": false,
                "claim_status": "needs_manual",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/assets.aqar.com.eg\/",
                    "http_status": 502,
                    "title_snippet": "ERROR: The request could not be satisfied",
                    "verify_error": null,
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:risky_fingerprint_wrong_status"
            },
            {
                "host": "mail.senior.com.eg",
                "cname": "ghs.googlehosted.com",
                "status": 404,
                "title": "Error 404 (Not Found)!!1",
                "fingerprint": "firebase",
                "confidence": "high",
                "claim_score": 50,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "false_positive",
                "llm_confidence": 0.9,
                "llm_rationale_vi": "CNAME trỏ tới ghs.googlehosted.com (Google Workspace\/G Suite). Lỗi 404 là hành vi bình thường cho subdomain không tồn tại trong tài khoản Google được cấu hình, không thể claim.",
                "llm_labeled_at": "2026-03-28T17:10:43.160Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low",
                "claimed": false,
                "claim_status": "verify_error",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/mail.senior.com.eg\/",
                    "http_status": null,
                    "title_snippet": null,
                    "verify_error": "fetch failed",
                    "webhook_note": "webhook_http_200",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:below_real_score_threshold"
            }
        ],
        "llm_review_pool": [
            {
                "host": "assets.aqarmap.com.eg",
                "cname": "d2eh85ql99553q.cloudfront.net",
                "status": 404,
                "title": "404 Not Found",
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 44,
                "claim_tier": "low",
                "signals": [],
                "hard_noise": false,
                "real_candidate": false,
                "llm_eligible": true,
                "strict_pass": false,
                "llm_verdict": "unlikely",
                "llm_confidence": 0.7,
                "llm_rationale_vi": "CNAME trỏ tới CloudFront nhưng lỗi 404 chung. Có thể phân phối đã bị xóa hoặc cấu hình sai, nhưng không có tín hiệu rõ ràng về khả năng claim trực tiếp.",
                "llm_labeled_at": "2026-03-28T17:10:43.160Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low"
            },
            {
                "host": "img-0.aqarmap.com.eg",
                "cname": "d3bxis3qk6gzz.cloudfront.net",
                "status": 404,
                "title": "404 Not Found",
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 44,
                "claim_tier": "low",
                "signals": [],
                "hard_noise": false,
                "real_candidate": false,
                "llm_eligible": true,
                "strict_pass": false,
                "llm_verdict": "unlikely",
                "llm_confidence": 0.7,
                "llm_rationale_vi": "Tương tự assets.aqarmap.com.eg, CNAME CloudFront với lỗi 404. Không có bằng chứng mạnh về việc có thể claim, có thể chỉ là cấu hình sai.",
                "llm_labeled_at": "2026-03-28T17:10:43.160Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low"
            },
            {
                "host": "img-1.aqarmap.com.eg",
                "cname": "d3bxis3qk6gzz.cloudfront.net",
                "status": 404,
                "title": "404 Not Found",
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 44,
                "claim_tier": "low",
                "signals": [],
                "hard_noise": false,
                "real_candidate": false,
                "llm_eligible": true,
                "strict_pass": false,
                "llm_verdict": "unlikely",
                "llm_confidence": 0.7,
                "llm_rationale_vi": "Chia sẻ CNAME CloudFront giống img-0, lỗi 404. Tình huống giống hệt, khả năng claim thấp do thiếu tín hiệu xác nhận cụ thể.",
                "llm_labeled_at": "2026-03-28T17:10:43.160Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low"
            },
            {
                "host": "img-2.aqarmap.com.eg",
                "cname": "d3bxis3qk6gzz.cloudfront.net",
                "status": 404,
                "title": "404 Not Found",
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 44,
                "claim_tier": "low",
                "signals": [],
                "hard_noise": false,
                "real_candidate": false,
                "llm_eligible": true,
                "strict_pass": false
            },
            {
                "host": "img-3.aqarmap.com.eg",
                "cname": "d3bxis3qk6gzz.cloudfront.net",
                "status": 404,
                "title": "404 Not Found",
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 44,
                "claim_tier": "low",
                "signals": [],
                "hard_noise": false,
                "real_candidate": false,
                "llm_eligible": true,
                "strict_pass": false
            },
            {
                "host": "img-4.aqarmap.com.eg",
                "cname": "d3bxis3qk6gzz.cloudfront.net",
                "status": 404,
                "title": "404 Not Found",
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 44,
                "claim_tier": "low",
                "signals": [],
                "hard_noise": false,
                "real_candidate": false,
                "llm_eligible": true,
                "strict_pass": false
            }
        ],
        "llm_batch": {
            "provider": "deepseek",
            "base_url": "https:\/\/api.deepseek.com\/v1",
            "model": "deepseek-chat",
            "top_n_requested": 5,
            "batch_hosts": [
                "assets.aqar.com.eg",
                "mail.senior.com.eg",
                "assets.aqarmap.com.eg",
                "img-0.aqarmap.com.eg",
                "img-1.aqarmap.com.eg"
            ],
            "batch_sources": [
                "strict",
                "strict",
                "pool",
                "pool",
                "pool"
            ],
            "promote_revived": true,
            "labeled_at": "2026-03-28T17:10:43.160Z",
            "usage": {
                "prompt_tokens": 875,
                "completion_tokens": 483,
                "total_tokens": 1358,
                "prompt_tokens_details": {
                    "cached_tokens": 128
                },
                "prompt_cache_hit_tokens": 128,
                "prompt_cache_miss_tokens": 747
            }
        },
        "v5": {
            "processed_at": "2026-03-28T17:10:43.240Z",
            "auto_claim_enabled": true,
            "telegram_enabled": true,
            "slug": "com.eg-2026-03-28"
        }
    }
}