{ "ok": true, "slug": "exxonmobil.com-2026-03-31", "stats": { "subs": 2239, "all": 2239, "resolved": 1309, "live": 573, "takeover": 56, "juicy": 66, "nuclei": 0, "subjack": 0, "subjack_vuln": 0, "takeover_v4": 0, "takeover_hot_claim": 0, "takeover_claimed": 0, "takeover_telegram_ok": 0, "confirmed": false, "alert": true, "scan_log": true }, "path": "\/www\/wwwroot\/tooldomain\/output\/exxonmobil.com-2026-03-31", "takeover_candidates": [ "acpt-help.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mcx360-uat.zendesk.com\u001b[0m]", "akupdate.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mnaresponse-alb-1279607872.us-west-2.elb.amazonaws.com\u001b[0m]", "api.1.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-dev-prv-api-alb-790013124.eu-central-1.elb.amazonaws.com\u001b[0m]", "api.2.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-qa-prv-api-alb-280156166.eu-central-1.elb.amazonaws.com\u001b[0m]", "api.3.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-cat-prv-api-alb-1302550630.eu-central-1.elb.amazonaws.com\u001b[0m]", "api.4.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-preprod-prv-api-alb-1335054612.eu-central-1.elb.amazonaws.com\u001b[0m]", "api.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-prd-prv-api-alb-1415996543.eu-central-1.elb.amazonaws.com\u001b[0m]", "apig.1.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md-m7c1zntlng.execute-api.eu-central-1.amazonaws.com\u001b[0m]", "apig.2.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md-1jji1qggb8.execute-api.eu-central-1.amazonaws.com\u001b[0m]", "apig.3.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md-oxtfibdrq3.execute-api.eu-central-1.amazonaws.com\u001b[0m]", "apig.4.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md-qnwthuafmc.execute-api.eu-central-1.amazonaws.com\u001b[0m]", "apig.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md-do552495g5.execute-api.eu-central-1.amazonaws.com\u001b[0m]", "apil.1.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md-zuotdk8kgd.execute-api.eu-central-1.amazonaws.com\u001b[0m]", "apil.2.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md-a9z3r9a2te.execute-api.eu-central-1.amazonaws.com\u001b[0m]", "apil.3.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md-4gm3amel44.execute-api.eu-central-1.amazonaws.com\u001b[0m]", "apil.4.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md-13wcb61o7d.execute-api.eu-central-1.amazonaws.com\u001b[0m]", "apil.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md-5bkkr8oz16.execute-api.eu-central-1.amazonaws.com\u001b[0m]", "apim.1.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md-uskp23pnvk.execute-api.eu-central-1.amazonaws.com\u001b[0m]", "apim.2.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md-c4mdiqv31j.execute-api.eu-central-1.amazonaws.com\u001b[0m]", "apim.3.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md-63wkzqurj9.execute-api.eu-central-1.amazonaws.com\u001b[0m]", "apim.4.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md-c4mdiqv31j.execute-api.eu-central-1.amazonaws.com\u001b[0m]", "apim.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md-hnoredc6kh.execute-api.eu-central-1.amazonaws.com\u001b[0m]", "basestockoffer.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md2f5gn3a5iyn93.cloudfront.net\u001b[0m]", "cdn.1.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md15q4gujj3crrg.cloudfront.net\u001b[0m]", "cdn.2.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md3hx5ugl8yo5td.cloudfront.net\u001b[0m]", "cdn.3.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md31tnhxv05w60w.cloudfront.net\u001b[0m]", "cdn.4.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md3r9xbmd1az3f3.cloudfront.net\u001b[0m]", "cdn.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md2v2j81fgiig7p.cloudfront.net\u001b[0m]", "emia.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdy7wswezguqoj.cloudfront.net\u001b[0m]", "emid.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1eutjqkok4xhy.cloudfront.net\u001b[0m]", "emif.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdnzogqdi0vxmd.cloudfront.net\u001b[0m]", "emip.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdjcssusl8bjts.cloudfront.net\u001b[0m]", "emir.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1tbapfid50k2y.cloudfront.net\u001b[0m]", "emiv.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1cqtgorv4xv29.cloudfront.net\u001b[0m]", "emiy.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1yj0avhgf0udv.cloudfront.net\u001b[0m]", "events.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mnaresponse-alb-1279607872.us-west-2.elb.amazonaws.com\u001b[0m]", "k2-za.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mprd-ue2-k2five-za-nlb-3339ab9d60cee28d.elb.us-east-2.amazonaws.com.exxonmobil.com\u001b[0m]", "k2acc-za.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mtst-us-east-2-sp-za-dmz-nlb-74e5a9afc034662d.elb.us-east-2.amazonaws.com\u001b[0m]", "lb.1.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-dev-prv-lb-alb-39041621.eu-central-1.elb.amazonaws.com\u001b[0m]", "lb.2.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-qa-prv-lb-alb-639888498.eu-central-1.elb.amazonaws.com\u001b[0m]", "lb.3.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-cat-prv-lb-alb-373490342.eu-central-1.elb.amazonaws.com\u001b[0m]", "lb.4.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-preprod-prv-lb-alb-467603926.eu-central-1.elb.amazonaws.com\u001b[0m]", "lb.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-prd-prv-lb-alb-1637304723.eu-central-1.elb.amazonaws.com\u001b[0m]", "quasaracc.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32msecureauth-nlb-dee69d2da2291456.elb.us-east-2.amazonaws.com\u001b[0m]", "spsharing1acctemp.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mtst-us-east-2-sp-za-dmz-nlb-74e5a9afc034662d.elb.us-east-2.amazonaws.com\u001b[0m]", "spsharing1temp.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mprd-us-east-2-sp-za-dmz-nlb-8c696c2abe90f1a3.elb.us-east-2.amazonaws.com\u001b[0m]", "support.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mcx360.zendesk.com\u001b[0m]", "svca.apiproxy.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md3hi4xjkb1cimg.cloudfront.net\u001b[0m]", "svca.apiproxydev.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md3oo5m233ili73.cloudfront.net\u001b[0m]", "svca.apiproxyuat.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1bpbo7bk5szji.cloudfront.net\u001b[0m]", "update.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mnaresponse-alb-1279607872.us-west-2.elb.amazonaws.com\u001b[0m]", "ws.1.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mws-lb-exxon-1820132949.eu-central-1.elb.amazonaws.com\u001b[0m]", "ws.2.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mws-lb-exxon-qa-1155361631.eu-central-1.elb.amazonaws.com\u001b[0m]", "ws.3.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mcat-pub-ws-alb-1627846118.eu-central-1.elb.amazonaws.com\u001b[0m]", "ws.4.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mpreprod-pub-ws-alb-2108127259.eu-central-1.elb.amazonaws.com\u001b[0m]", "ws.fuelmas.exxonmobil.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mprd-pub-ws-alb-666007988.eu-central-1.elb.amazonaws.com\u001b[0m]" ], "takeover_v4": { "domain": "exxonmobil.com", "version": 4, "generated_at": "2026-03-31T06:59:36.285Z", "ai_filter": { "engine": "rules_scorer_v1", "min_score": 48, "llm_pool_min": 38, "evaluated": 12, "kept_strict": 0, "llm_review_pool": 7, "dropped_noise": 12, "deep_skipped_below_pool": 5 }, "candidates": [], "llm_review_pool": [ { "host": "emia.exxonmobil.com", "cname": "dy7wswezguqoj.cloudfront.net", "status": 404, "title": null, "fingerprint": "aws_s3", "confidence": "high", "claim_score": 44, "claim_tier": "low", "signals": [], "hard_noise": false, "real_candidate": false, "llm_eligible": true, "strict_pass": false, "llm_verdict": "false_positive", "llm_confidence": 0.8, "llm_rationale_vi": "CNAME trỏ tới CloudFront nhưng HTTP 404 có thể là trang lỗi mặc định của ứng dụng đang hoạt động, không phải tài nguyên chưa claim.", "llm_labeled_at": "2026-03-31T06:59:49.127Z", "llm_model": "deepseek-chat", "llm_priority": "low" }, { "host": "emid.exxonmobil.com", "cname": "d1eutjqkok4xhy.cloudfront.net", "status": 404, "title": null, "fingerprint": "aws_s3", "confidence": "high", "claim_score": 44, "claim_tier": "low", "signals": [], "hard_noise": false, "real_candidate": false, "llm_eligible": true, "strict_pass": false, "llm_verdict": "false_positive", "llm_confidence": 0.8, "llm_rationale_vi": "Tương tự, CloudFront với 404 có thể là cấu hình ứng dụng hợp lệ, không có dấu hiệu rõ ràng về tài nguyên bị bỏ trống.", "llm_labeled_at": "2026-03-31T06:59:49.128Z", "llm_model": "deepseek-chat", "llm_priority": "low" }, { "host": "emif.exxonmobil.com", "cname": "dnzogqdi0vxmd.cloudfront.net", "status": 404, "title": null, "fingerprint": "aws_s3", "confidence": "high", "claim_score": 44, "claim_tier": "low", "signals": [], "hard_noise": false, "real_candidate": false, "llm_eligible": true, "strict_pass": false, "llm_verdict": "false_positive", "llm_confidence": 0.8, "llm_rationale_vi": "Cấu trúc host có vẻ hệ thống nội bộ, 404 từ CloudFront thường là false positive khi không có bằng chứng claim được.", "llm_labeled_at": "2026-03-31T06:59:49.128Z", "llm_model": "deepseek-chat", "llm_priority": "low" }, { "host": "emip.exxonmobil.com", "cname": "djcssusl8bjts.cloudfront.net", "status": 404, "title": null, "fingerprint": "aws_s3", "confidence": "high", "claim_score": 44, "claim_tier": "low", "signals": [], "hard_noise": false, "real_candidate": false, "llm_eligible": true, "strict_pass": false, "llm_verdict": "false_positive", "llm_confidence": 0.8, "llm_rationale_vi": "Điểm claim thấp, HTTP 404 trên CloudFront không đủ để kết luận có thể takeover, có thể ứng dụng đang chạy.", "llm_labeled_at": "2026-03-31T06:59:49.128Z", "llm_model": "deepseek-chat", "llm_priority": "low" }, { "host": "emir.exxonmobil.com", "cname": "d1tbapfid50k2y.cloudfront.net", "status": 404, "title": null, "fingerprint": "aws_s3", "confidence": "high", "claim_score": 44, "claim_tier": "low", "signals": [], "hard_noise": false, "real_candidate": false, "llm_eligible": true, "strict_pass": false, "llm_verdict": "false_positive", "llm_confidence": 0.8, "llm_rationale_vi": "Mẫu host giống nhau, tất cả đều có khả năng là false positive do cấu hình hợp lệ dẫn đến trang lỗi 404.", "llm_labeled_at": "2026-03-31T06:59:49.128Z", "llm_model": "deepseek-chat", "llm_priority": "low" }, { "host": "emiv.exxonmobil.com", "cname": "d1cqtgorv4xv29.cloudfront.net", "status": 404, "title": null, "fingerprint": "aws_s3", "confidence": "high", "claim_score": 44, "claim_tier": "low", "signals": [], "hard_noise": false, "real_candidate": false, "llm_eligible": true, "strict_pass": false }, { "host": "emiy.exxonmobil.com", "cname": "d1yj0avhgf0udv.cloudfront.net", "status": 404, "title": null, "fingerprint": "aws_s3", "confidence": "high", "claim_score": 44, "claim_tier": "low", "signals": [], "hard_noise": false, "real_candidate": false, "llm_eligible": true, "strict_pass": false } ], "llm_batch": { "provider": "deepseek", "base_url": "https:\/\/api.deepseek.com\/v1", "model": "deepseek-chat", "top_n_requested": 5, "batch_hosts": [ "emia.exxonmobil.com", "emid.exxonmobil.com", "emif.exxonmobil.com", "emip.exxonmobil.com", "emir.exxonmobil.com" ], "batch_sources": [ "pool", "pool", "pool", "pool", "pool" ], "promote_revived": true, "labeled_at": "2026-03-31T06:59:49.128Z", "usage": { "prompt_tokens": 836, "completion_tokens": 389, "total_tokens": 1225, "prompt_tokens_details": { "cached_tokens": 128 }, "prompt_cache_hit_tokens": 128, "prompt_cache_miss_tokens": 708 } } } }