{ "ok": true, "slug": "gob.es-2026-04-01", "stats": { "subs": 2786, "all": 2786, "resolved": 1926, "live": 1474, "takeover": 63, "juicy": 77, "nuclei": 0, "subjack": 0, "subjack_vuln": 0, "takeover_v4": 3, "takeover_hot_claim": 1, "takeover_claimed": 0, "takeover_telegram_ok": 0, "confirmed": false, "alert": true, "scan_log": true }, "path": "\/www\/wwwroot\/tooldomain\/output\/gob.es-2026-04-01", "takeover_candidates": [ "acme.educacion.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32modilo-alb-a3w-eu-1539654300.eu-west-1.elb.amazonaws.com\u001b[0m]", "api.sannar.inclusion.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32md-g9jzhrx670.execute-api.eu-west-1.amazonaws.com\u001b[0m]", "api.sannar.int.inclusion.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32md-oec6taaim7.execute-api.eu-west-1.amazonaws.com\u001b[0m]", "backend.fpconecta.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mdualstack.ex-test-cloud-front-flare-alb-1915903951.eu-south-2.elb.amazonaws.com\u001b[0m]", "beneficiarios.2024.bonoculturajoven.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mk8s-culturebonuspubli-c4197f36e6-237438374.eu-central-1.elb.amazonaws.com\u001b[0m]", "chatmni.fiap.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mchatmni-fiap-1040351541.eu-west-1.elb.amazonaws.com\u001b[0m]", "cibim.transportes.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32md3a78bpuzszdig.cloudfront.net\u001b[0m]", "cvp.mitma.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mlb-waf-4af405ec29fb28c4.elb.eu-south-2.amazonaws.com\u001b[0m]", "data.mitma.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mlb-waf-4af405ec29fb28c4.elb.eu-south-2.amazonaws.com\u001b[0m]", "dataia.mapa.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32md6u4cnkv17fv8.cloudfront.net\u001b[0m]", "esmovilidad.transportes.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mlb-waf-4af405ec29fb28c4.elb.eu-south-2.amazonaws.com\u001b[0m]", "estadisticas.contrataciondelsectorpublico.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mbalancer-externo-1519022019.eu-south-2.elb.amazonaws.com\u001b[0m]", "file.sannar.inclusion.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mmissm.s3.eu-west-1.amazonaws.com\u001b[0m]", "funcionpublica.digital.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32md2g57ybdiidp4v.cloudfront.net\u001b[0m]", "ipv6.digital.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32md3c9rh1zgxmpmp.cloudfront.net\u001b[0m]", "jenkins-admin.fpconecta.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mdualstack.ex-test-cloud-front-flare-alb-1915903951.eu-south-2.elb.amazonaws.com\u001b[0m]", "keycloak-admin.fpconecta.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mdualstack.ex-test-cloud-front-flare-alb-1915903951.eu-south-2.elb.amazonaws.com\u001b[0m]", "leyarquitectura.mivau.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mlb-waf-4af405ec29fb28c4.elb.eu-south-2.amazonaws.com\u001b[0m]", "lssi.digital.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32md3uc7ycasl7ai5.cloudfront.net\u001b[0m]", "mantis-admin.fpconecta.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mdualstack.ex-test-cloud-front-flare-alb-1915903951.eu-south-2.elb.amazonaws.com\u001b[0m]", "mapaoficialcarreteras.transportes.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mlb-waf-4af405ec29fb28c4.elb.eu-south-2.amazonaws.com\u001b[0m]", "mapas-movilidad.transportes.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mlb-waf-4af405ec29fb28c4.elb.eu-south-2.amazonaws.com\u001b[0m]", "mapatrafico.transportes.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32md3gk0w3095yj9f.cloudfront.net\u001b[0m]", "masinformacioncarpeta.carpetaciudadana.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32md1atwmyyigkvbu.cloudfront.net\u001b[0m]", "matomo-admin.fpconecta.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mdualstack.ex-test-cloud-front-flare-alb-1915903951.eu-south-2.elb.amazonaws.com\u001b[0m]", "nap.transportes.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mlb-waf-4af405ec29fb28c4.elb.eu-south-2.amazonaws.com\u001b[0m]", "observatoriotransporte.mitma.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mlb-waf-4af405ec29fb28c4.elb.eu-south-2.amazonaws.com\u001b[0m]", "openfire-admin.fpconecta.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mdualstack.ex-test-cloud-front-flare-alb-1915903951.eu-south-2.elb.amazonaws.com\u001b[0m]", "openfire.fpconecta.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mdualstack.ex-test-cloud-front-flare-alb-1915903951.eu-south-2.elb.amazonaws.com\u001b[0m]", "otle.transportes.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32md661g5bted0nz.cloudfront.net\u001b[0m]", "plantl.digital.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32md2jj8yjs8iovd7.cloudfront.net\u001b[0m]", "plinur.mitma.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mlb-waf-4af405ec29fb28c4.elb.eu-south-2.amazonaws.com\u001b[0m]", "portal.gestion.sedepkd.red.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mk8s-ingressn-ingressn-3835e42535-680440673.eu-west-1.elb.amazonaws.com\u001b[0m]", "portalweb.fomento.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mlb-waf-4af405ec29fb28c4.elb.eu-south-2.amazonaws.com\u001b[0m]", "publicaciones.transportes.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mlb-waf-4af405ec29fb28c4.elb.eu-south-2.amazonaws.com\u001b[0m]", "retos.innovacion.csd.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32md1a89fuxnv2gkd.cloudfront.net\u001b[0m]", "retransmisiones.hacienda.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32md204h6yqvvs08l.cloudfront.net\u001b[0m]", "sanfrancisco.desafia.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mcdn.webflow.com\u001b[0m]", "sannar.inclusion.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32ma-p-ew1-alb-menores-001-1829296495.eu-west-1.elb.amazonaws.com\u001b[0m]", "sannar.int.inclusion.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32ma-d-ew1-alb-menores-001-78135044.eu-west-1.elb.amazonaws.com\u001b[0m]", "sede.fomento.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mlb-waf-4af405ec29fb28c4.elb.eu-south-2.amazonaws.com\u001b[0m]", "sede.mitma.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mlb-waf-4af405ec29fb28c4.elb.eu-south-2.amazonaws.com\u001b[0m]", "sede.transportes.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mlb-waf-4af405ec29fb28c4.elb.eu-south-2.amazonaws.com\u001b[0m]", "serpavi.mivau.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mlb-waf-4af405ec29fb28c4.elb.eu-south-2.amazonaws.com\u001b[0m]", "seu.portdebarcelona.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mpro-public-alb-1196585909.eu-west-1.elb.amazonaws.com\u001b[0m]", "seupre2.portdebarcelona.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mpre-public-alb-1813389522.eu-west-1.elb.amazonaws.com\u001b[0m]", "sirde.mitma.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mlb-waf-4af405ec29fb28c4.elb.eu-south-2.amazonaws.com\u001b[0m]", "subvenciones.mitma.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mlb-waf-4af405ec29fb28c4.elb.eu-south-2.amazonaws.com\u001b[0m]", "television.digital.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mdilfb7bnohem5.cloudfront.net\u001b[0m]", "veranojoven.transportes.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mdenyrs6h7xcz8.cloudfront.net\u001b[0m]", "www.berlin.desafia.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mproxy-ssl.webflow.com\u001b[0m]", "www.coronavirus.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32md2v23rzu40csc8.cloudfront.net\u001b[0m]", "www.covid-19.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32md23844kk4dgc5z.cloudfront.net\u001b[0m]", "www.covid19.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32md28dvxbpxz60s6.cloudfront.net\u001b[0m]", "www.digital.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32md2g57ybdiidp4v.cloudfront.net\u001b[0m]", "www.facturae.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mddvo6m0bbwll3.cloudfront.net\u001b[0m]", "www.formacioncodi.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32melb-fcodi-mds-58957560.eu-south-2.elb.amazonaws.com\u001b[0m]", "www.fpconecta.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32md5uwjbvg57z8z.cloudfront.net\u001b[0m]", "www.newyork.desafia.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mproxy-ssl.webflow.com\u001b[0m]", "www.nuevayork.desafia.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mproxy-ssl.webflow.com\u001b[0m]", "www.radarcovid.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mdtaotcx8kzwdb.cloudfront.net\u001b[0m]", "www.sanfrancisco.desafia.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32mcdn.webflow.com\u001b[0m]", "www.transportes.gob.es [\u001b[35mCNAME\u001b[0m] [\u001b[32md1jf6rwvoud9aw.cloudfront.net\u001b[0m]" ], "takeover_v4": { "domain": "gob.es", "version": 4, "generated_at": "2026-04-01T13:19:12.023Z", "ai_filter": { "engine": "rules_scorer_v1", "min_score": 48, "llm_pool_min": 38, "evaluated": 4, "kept_strict": 3, "llm_review_pool": 0, "dropped_noise": 1, "deep_skipped_below_pool": 1 }, "candidates": [ { "host": "www.covid19.gob.es", "cname": "d28dvxbpxz60s6.cloudfront.net", "status": 502, "title": "ERROR: The request could not be satisfied", "fingerprint": "aws_s3", "confidence": "medium", "claim_score": 83, "claim_tier": "critical", "signals": [ "the request could not be satisfied" ], "hard_noise": false, "real_candidate": true, "llm_verdict": "claim_likely", "llm_confidence": 0.85, "llm_rationale_vi": "CNAME trỏ tới CloudFront nhưng HTTP 502 với thông báo lỗi từ AWS, cho thấy phân phối chưa được gán đúng hoặc đã bị xóa.", "llm_labeled_at": "2026-04-01T13:19:20.789Z", "llm_model": "deepseek-chat", "llm_priority": "high" }, { "host": "defensa.buscador.gob.es", "cname": "ghs.googlehosted.com", "status": 404, "title": "404 Page not found", "fingerprint": "firebase", "confidence": "high", "claim_score": 50, "claim_tier": "medium", "signals": [], "hard_noise": false, "real_candidate": true, "llm_verdict": "false_positive", "llm_confidence": 0.9, "llm_rationale_vi": "CNAME trỏ tới Google nhưng HTTP 404 là phản hồi chung của Google Hosted, không chứng minh được khả năng chiếm quyền điều khiển.", "llm_labeled_at": "2026-04-01T13:19:20.790Z", "llm_model": "deepseek-chat", "llm_priority": "low" }, { "host": "sepe.buscador.gob.es", "cname": "ghs.googlehosted.com", "status": 404, "title": "404 Page not found", "fingerprint": "firebase", "confidence": "high", "claim_score": 50, "claim_tier": "medium", "signals": [], "hard_noise": false, "real_candidate": true, "llm_verdict": "false_positive", "llm_confidence": 0.9, "llm_rationale_vi": "Tương tự host 2, CNAME Google và 404 chung, không có bằng chứng resource bị bỏ hoang để claim.", "llm_labeled_at": "2026-04-01T13:19:20.790Z", "llm_model": "deepseek-chat", "llm_priority": "low" } ], "llm_review_pool": [], "llm_batch": { "provider": "deepseek", "base_url": "https:\/\/api.deepseek.com\/v1", "model": "deepseek-chat", "top_n_requested": 5, "batch_hosts": [ "www.covid19.gob.es", "defensa.buscador.gob.es", "sepe.buscador.gob.es" ], "batch_sources": [ "strict", "strict", "strict" ], "promote_revived": true, "labeled_at": "2026-04-01T13:19:20.790Z", "usage": { "prompt_tokens": 627, "completion_tokens": 243, "total_tokens": 870, "prompt_tokens_details": { "cached_tokens": 128 }, "prompt_cache_hit_tokens": 128, "prompt_cache_miss_tokens": 499 } } } }