{ "ok": true, "slug": "crowdstrike.com-2026-03-29", "stats": { "subs": 437, "all": 437, "resolved": 225, "live": 192, "takeover": 47, "juicy": 47, "nuclei": 0, "subjack": 0, "subjack_vuln": 0, "takeover_v4": 0, "takeover_hot_claim": 0, "takeover_claimed": 0, "takeover_telegram_ok": 0, "confirmed": false, "alert": true, "scan_log": true }, "path": "\/www\/wwwroot\/tooldomain\/output\/crowdstrike.com-2026-03-29", "takeover_candidates": [ "11286978.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdh4a7106wn09a.cloudfront.net\u001b[0m]", "2fassets-public.falcon.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mphoenixui01-blue-1479480985.us-west-1.elb.amazonaws.com\u001b[0m]", "api.eu-1.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mlion-lanner-dmz-p-apigw-nlb-fd7ca48a496d19f1.elb.eu-central-1.amazonaws.com\u001b[0m]", "api.us-2.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mmav-gyr-dmz-p-apigw-nlb-5b36f1bc7a7d23ac.elb.us-west-2.amazonaws.com\u001b[0m]", "assets-falcon-recon-public.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md2myjdo8qp1xd2.cloudfront.net\u001b[0m]", "assets-public.falcon.us-2.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md243azj5tufory.cloudfront.net\u001b[0m]", "assets.falcon.us-2.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md15cyzpxu8kyii.cloudfront.net\u001b[0m]", "cf.falcon.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mphoenixui01-blue-1479480985.us-west-1.elb.amazonaws.com\u001b[0m]", "cmp.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mviper-util-main-p-cloudmarket-1b2de8be3e1027da.elb.us-west-2.amazonaws.com\u001b[0m]", "container-upload.eu-1.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mlion-lanner-dmz-p-cwpp-is-lb-54995c39aed59a31.elb.eu-central-1.amazonaws.com\u001b[0m]", "container-upload.us-1.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbeta-barb-dmz-p-cwpp-is-lb-1614dc36974a6838.elb.us-west-1.amazonaws.com\u001b[0m]", "container-upload.us-2.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mmav-gyr-dmz-p-cwpp-is-lb-485eb283213c72eb.elb.us-west-2.amazonaws.com\u001b[0m]", "donate.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mec2-44-226-104-174.us-west-2.compute.amazonaws.com\u001b[0m]", "falcon.eu-1.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mlion-lanner-dmz-p-falconui-nlb-47c9df1e2fce1dd4.elb.eu-central-1.amazonaws.com\u001b[0m]", "falcon.us-2.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mmav-gyr-dmz-p-falconui-nlb-197654117991daac.elb.us-west-2.amazonaws.com\u001b[0m]", "falconapi.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mfalconapi01-b-763040050.us-west-1.elb.amazonaws.com\u001b[0m]", "falconapi.eu-1.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mlion-lanner-dmz-p-falconapi-nlb-90d051ffdfb80a90.elb.eu-central-1.amazonaws.com\u001b[0m]", "falconapi.us-2.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mmav-gyr-dmz-p-falconapi-nlb-6d4e4d8c2e494d5b.elb.us-west-2.amazonaws.com\u001b[0m]", "ffcng.eu-1.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mlion-ffcng-d41d8cd98f00b204e9800-a6e142e43a9859be.elb.eu-central-1.amazonaws.com\u001b[0m]", "ffcng.us-2.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mmav-ffcng-d41d8cd98f00b204e9800-211c15b455f0e23b.elb.us-west-2.amazonaws.com\u001b[0m]", "ffcps.us-1.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbeta-barb-ffcps-d41d8cd98f00b-c9e375e577170fc3.elb.us-west-1.amazonaws.com\u001b[0m]", "firehose.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mnlb-falconhose2-beta-blue-80b6a82f08d95ab6.elb.us-west-1.amazonaws.com\u001b[0m]", "firehose.eu-1.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mlion-lanner-dmz-p-falconhose-nlb-aeb945f5a53af194.elb.eu-central-1.amazonaws.com\u001b[0m]", "firehose.us-2.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mmav-gyr-dmz-p-falconhose-nlb-b1c66e64168022cb.elb.us-west-2.amazonaws.com\u001b[0m]", "flc-api.eu-1.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mlion-lanner-dmz-p-ngsiem-proxy-3b702b7a5dd0ffeb.elb.eu-central-1.amazonaws.com\u001b[0m]", "flc-api.us-2.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mmav-gyr-dmz-p-ngsiem-proxy-42df12a8eabfece8.elb.us-west-2.amazonaws.com\u001b[0m]", "grid.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md2samyi7oajt2f.cloudfront.net\u001b[0m]", "gslink.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdh4a7106wn09a.cloudfront.net\u001b[0m]", "gsnlink.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdixaonh8nobyu.cloudfront.net\u001b[0m]", "ingestion.aspm.eu-1.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mlion-lanner-main-s001-aspmingst-f7bf030ea1307ef8.elb.eu-central-1.amazonaws.com\u001b[0m]", "ingestion.aspm.us-1.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbeta-barb-main-s001-aspm-ingest-7b66b33891818ada.elb.us-west-1.amazonaws.com\u001b[0m]", "ingestion.aspm.us-2.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mmav-gyr-main-s001-aspm-ingest-b3ee36d4915a1f63.elb.us-west-2.amazonaws.com\u001b[0m]", "ios-enrollment.falcon.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mddb6q9u898go3.cloudfront.net\u001b[0m]", "m365.saas-security.falcon.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mphoenixui01-blue-1479480985.us-west-1.elb.amazonaws.com\u001b[0m]", "mpp.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mviper-util-main-p-mpproxy2-51854647b33bbcfa.elb.us-west-2.amazonaws.com\u001b[0m]", "pluto.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mpluto-util-main-p-chef-sngl-ext-649302747.us-west-2.elb.amazonaws.com\u001b[0m]", "pre-authorize.oidc.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md2ppil04j2cqej.cloudfront.net\u001b[0m]", "registry.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mcrowdstrike-registry-63dc1b91d356ea5b.elb.us-west-2.amazonaws.com\u001b[0m]", "relay.ingestion.aspm.eu-1.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mlion-lanner-main-s001-aspmrprxy-244c7ecdda93712d.elb.eu-central-1.amazonaws.com\u001b[0m]", "relay.ingestion.aspm.us-1.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mbeta-barb-main-s001-aspm-rproxy-70752a4d3a35eaac.elb.us-west-1.amazonaws.com\u001b[0m]", "relay.ingestion.aspm.us-2.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mmav-gyr-dmz-s001-aspm-rproxy-81ad8ae0d8ea7dcf.elb.us-west-2.amazonaws.com\u001b[0m]", "universal.eu-1.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mlion-lanner-dmz-p-apigw-nlb-fd7ca48a496d19f1.elb.eu-central-1.amazonaws.com\u001b[0m]", "universal.us-2.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mmav-gyr-dmz-p-apigw-nlb-5b36f1bc7a7d23ac.elb.us-west-2.amazonaws.com\u001b[0m]", "update-crx.falcon.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1mmrnt27nvaj0.cloudfront.net\u001b[0m]", "www.saas-security-api.falcon.eu-1.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mlion-lanner-dmz-p-falconui-nlb-47c9df1e2fce1dd4.elb.eu-central-1.amazonaws.com\u001b[0m]", "www.saas-security.falcon.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mphoenixui01-blue-1479480985.us-west-1.elb.amazonaws.com\u001b[0m]", "www.saas-security.falcon.eu-1.crowdstrike.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mlion-lanner-dmz-p-falconui-nlb-47c9df1e2fce1dd4.elb.eu-central-1.amazonaws.com\u001b[0m]" ], "takeover_v4": { "domain": "crowdstrike.com", "version": 4, "generated_at": "2026-03-29T10:35:33.942Z", "ai_filter": { "engine": "rules_scorer_v1", "min_score": 48, "llm_pool_min": 38, "evaluated": 9, "kept_strict": 0, "llm_review_pool": 3, "dropped_noise": 9, "deep_skipped_below_pool": 6 }, "candidates": [], "llm_review_pool": [ { "host": "11286978.crowdstrike.com", "cname": "dh4a7106wn09a.cloudfront.net", "status": 404, "title": "404 Not Found", "fingerprint": "aws_s3", "confidence": "high", "claim_score": 44, "claim_tier": "low", "signals": [], "hard_noise": false, "real_candidate": false, "llm_eligible": true, "strict_pass": false, "llm_verdict": "unlikely", "llm_confidence": 0.7, "llm_rationale_vi": "CNAME trỏ tới CloudFront nhưng HTTP 404. Có thể là bucket\/tài nguyên đã bị gỡ hoặc cấu hình sai, nhưng không đủ bằng chứng cho thấy có thể claim trực tiếp.", "llm_labeled_at": "2026-03-29T10:35:44.162Z", "llm_model": "deepseek-chat", "llm_priority": "low" }, { "host": "gslink.crowdstrike.com", "cname": "dh4a7106wn09a.cloudfront.net", "status": 404, "title": "404 Not Found", "fingerprint": "aws_s3", "confidence": "high", "claim_score": 44, "claim_tier": "low", "signals": [], "hard_noise": false, "real_candidate": false, "llm_eligible": true, "strict_pass": false, "llm_verdict": "unlikely", "llm_confidence": 0.7, "llm_rationale_vi": "Tương tự host khác, CNAME CloudFront với 404. Không có tín hiệu rõ ràng về việc có thể chiếm quyền sở hữu (takeover) qua nhà cung cấp.", "llm_labeled_at": "2026-03-29T10:35:44.163Z", "llm_model": "deepseek-chat", "llm_priority": "low" }, { "host": "gsnlink.crowdstrike.com", "cname": "dixaonh8nobyu.cloudfront.net", "status": 404, "title": "404 Not Found", "fingerprint": "aws_s3", "confidence": "high", "claim_score": 44, "claim_tier": "low", "signals": [], "hard_noise": false, "real_candidate": false, "llm_eligible": true, "strict_pass": false, "llm_verdict": "unlikely", "llm_confidence": 0.7, "llm_rationale_vi": "Cấu hình CloudFront khác nhưng vẫn trả về 404. Khả năng cao là cấu hình dư thừa hoặc chưa triển khai, không phải lỗ hổng claim được.", "llm_labeled_at": "2026-03-29T10:35:44.163Z", "llm_model": "deepseek-chat", "llm_priority": "low" } ], "llm_batch": { "provider": "deepseek", "base_url": "https:\/\/api.deepseek.com\/v1", "model": "deepseek-chat", "top_n_requested": 5, "batch_hosts": [ "11286978.crowdstrike.com", "gslink.crowdstrike.com", "gsnlink.crowdstrike.com" ], "batch_sources": [ "pool", "pool", "pool" ], "promote_revived": true, "labeled_at": "2026-03-29T10:35:44.163Z", "usage": { "prompt_tokens": 622, "completion_tokens": 281, "total_tokens": 903, "prompt_tokens_details": { "cached_tokens": 128 }, "prompt_cache_hit_tokens": 128, "prompt_cache_miss_tokens": 494 } } } }