{
    "ok": true,
    "slug": "kyiv.ua-2026-04-04",
    "stats": {
        "subs": 35462,
        "all": 35462,
        "resolved": 8835,
        "live": 114,
        "takeover": 82,
        "juicy": 131,
        "nuclei": 0,
        "subjack": 0,
        "subjack_vuln": 0,
        "takeover_v4": 6,
        "takeover_hot_claim": 2,
        "takeover_claimed": 0,
        "takeover_telegram_ok": 0,
        "confirmed": false,
        "alert": true,
        "scan_log": true
    },
    "path": "\/www\/wwwroot\/tooldomain\/output\/kyiv.ua-2026-04-04",
    "takeover_candidates": [
        "bak.nam.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mlanding-nam.netlify.app\u001b[0m]",
        "baraholka.admin.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md35dohi69xqnvt.cloudfront.net\u001b[0m]",
        "baraholka.api.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md-0r5tzet0g1.execute-api.eu-west-1.amazonaws.com\u001b[0m]",
        "baraholka.front.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md2qpcsuo9mtdud.cloudfront.net\u001b[0m]",
        "bo.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md321g7ljdy74fy.cloudfront.net\u001b[0m]",
        "code.webview.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md2k82cg9owksqd.cloudfront.net\u001b[0m]",
        "csmapi.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md-gosjgvip7i.execute-api.eu-west-1.amazonaws.com\u001b[0m]",
        "fc.bot.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md-cwbcblrmnk.execute-api.eu-north-1.amazonaws.com\u001b[0m]",
        "fc.dashboard.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md1vmowxdsshzl9.cloudfront.net\u001b[0m]",
        "fc.front.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md32zz3lw8phva5.cloudfront.net\u001b[0m]",
        "grafana.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mlb-100814443.eu-west-1.elb.amazonaws.com\u001b[0m]",
        "iam.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md2orc0chtb5ozw.cloudfront.net\u001b[0m]",
        "internal.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mdhwgv1460ys9a.cloudfront.net\u001b[0m]",
        "jenkins-gbs.devx.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mdevx-alb-785708851.eu-central-1.elb.amazonaws.com\u001b[0m]",
        "jenkins-higround.devx.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mdevx-alb-785708851.eu-central-1.elb.amazonaws.com\u001b[0m]",
        "jenkins-innerclock.devx.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mdevx-alb-785708851.eu-central-1.elb.amazonaws.com\u001b[0m]",
        "jenkins-jlaudio.devx.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mdevx-alb-785708851.eu-central-1.elb.amazonaws.com\u001b[0m]",
        "jenkins-mmaudio.devx.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mdevx-alb-785708851.eu-central-1.elb.amazonaws.com\u001b[0m]",
        "jenkins-tua.devx.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mdevx-alb-785708851.eu-central-1.elb.amazonaws.com\u001b[0m]",
        "login.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mdnlg8fguv2wt0.cloudfront.net\u001b[0m]",
        "loyality.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md3lhngasdn5hab.cloudfront.net\u001b[0m]",
        "loyalityapi.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mlb-1133277443.eu-north-1.elb.amazonaws.com\u001b[0m]",
        "mag.nam.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mnam-master.netlify.app\u001b[0m]",
        "nfc.devx.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mec2-18-218-16-5.us-east-2.compute.amazonaws.com\u001b[0m]",
        "nmt.lyceum173.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mnmt-lyceum173.web.app\u001b[0m]",
        "payments.api.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md-9ufmithaed.execute-api.eu-west-1.amazonaws.com\u001b[0m]",
        "photo.ghost.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mdomains.smugmug.com\u001b[0m]",
        "portfolio.homestaging.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md1meqd6f7zgrzg.cloudfront.net\u001b[0m]",
        "probanav.a3.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32magentyzmin.github.io\u001b[0m]",
        "reservation.root.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md2rf6t71i8825r.cloudfront.net\u001b[0m]",
        "review.front.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md2oeq9z0rtxsrk.cloudfront.net\u001b[0m]",
        "roadguide.a3.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32magentyzmin.github.io\u001b[0m]",
        "rope-jumping.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mandreyfilko.github.io\u001b[0m]",
        "short.api.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md-47hxxiwfmj.execute-api.eu-west-1.amazonaws.com\u001b[0m]",
        "staff.originstudio.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mcd5de662ed6d13c7.vercel-dns-017.com\u001b[0m]",
        "standard.a3.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md23j594iuxjnup.cloudfront.net\u001b[0m]",
        "storagatake.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md2itr13ac7w6jh.cloudfront.net\u001b[0m]",
        "support.api.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md-p0u1yskbjc.execute-api.eu-west-1.amazonaws.com\u001b[0m]",
        "tgbotsell.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md-39b9hzv3sa.execute-api.eu-west-1.amazonaws.com\u001b[0m]",
        "ticket.admin.v3.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md2adywgz33u4i8.cloudfront.net\u001b[0m]",
        "tickets.kurazh.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md10bb5np7iiwe9.cloudfront.net\u001b[0m]",
        "tickets.vyrii.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md22u07g7dz8zo6.cloudfront.net\u001b[0m]",
        "touristroadguide.a3.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32magentyzmin.github.io\u001b[0m]",
        "viyar.teststs.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md2705c33wybf0q.cloudfront.net\u001b[0m]",
        "www.5esrd.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mtuomari-ua.github.io\u001b[0m]",
        "www.amiks.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mcdn.webflow.com\u001b[0m]",
        "www.autopidbir-kyiv-nr-car.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mcname.vercel-dns.com\u001b[0m]",
        "www.bak.nam.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mlanding-nam.netlify.app\u001b[0m]",
        "www.belkin.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mproxy-ssl.webflow.com\u001b[0m]",
        "www.bikelab.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32m4590e74f8f5767ed.vercel-dns-017.com\u001b[0m]",
        "www.cecu.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mcdn.webflow.com\u001b[0m]",
        "www.chara.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mcdn.webflow.com\u001b[0m]",
        "www.charawines.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mcdn.webflow.com\u001b[0m]",
        "www.cheeseopt.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mshops.myshopify.com\u001b[0m]",
        "www.e-yarmarok.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mnediliuk.github.io\u001b[0m]",
        "www.globalshapers.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mb90d772da776f362.vercel-dns-017.com\u001b[0m]",
        "www.goodlaw.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mcdn.webflow.com\u001b[0m]",
        "www.ikonakamura.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mproxy-ssl.webflow.com\u001b[0m]",
        "www.ikra-lemberg.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mfunua.github.io\u001b[0m]",
        "www.intertranslate.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32md1d62b933a75e6c9.vercel-dns-016.com\u001b[0m]",
        "www.kosarevalash.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32msytnychenkoivan.github.io\u001b[0m]",
        "www.logart.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mproxy-ssl.webflow.com\u001b[0m]",
        "www.meshe.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mmeshe-oleksii.netlify.app\u001b[0m]",
        "www.mrcash.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mcdn.webflow.com\u001b[0m]",
        "www.naomy-cleaning.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mcname.vercel-dns.com\u001b[0m]",
        "www.neoweb.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mneoweb24.github.io\u001b[0m]",
        "www.nhd.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mcdn.webflow.com\u001b[0m]",
        "www.ohayno.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mitshelokugaya.github.io\u001b[0m]",
        "www.originstudio.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32me5468c6bad50b7b9.vercel-dns-017.com\u001b[0m]",
        "www.realestate.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mrekyivua.github.io\u001b[0m]",
        "www.stohefest-detroit.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mstohefest-detroit.github.io\u001b[0m]",
        "www.svit-shin-bu.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mproxy-ssl.webflow.com\u001b[0m]",
        "www.svovkotrub.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mserhii-v.github.io\u001b[0m]",
        "www.tabletennis.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32msdemchenko.github.io\u001b[0m]",
        "www.taras.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mtrs-hash.github.io\u001b[0m]",
        "www.thebridge.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mproxy-ssl.webflow.com\u001b[0m]",
        "www.theone.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mcdn.webflow.com\u001b[0m]",
        "www.thezvir.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32maa947639119435ae.vercel-dns-017.com\u001b[0m]",
        "www.unight.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mcdn.webflow.com\u001b[0m]",
        "www.urolog-nagimova.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32murolog-nagimova.netlify.app\u001b[0m]",
        "www.vascularsurgery.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mcdn.webflow.com\u001b[0m]",
        "www.vodovoz.kyiv.ua [\u001b[35mCNAME\u001b[0m] [\u001b[32mdefined-pandsy-vllwqo6hms9rwi062tfewej8.herokudns.com\u001b[0m]"
    ],
    "takeover_v4": {
        "domain": "kyiv.ua",
        "version": 4,
        "generated_at": "2026-04-04T15:16:04.869Z",
        "ai_filter": {
            "engine": "rules_scorer_v1",
            "min_score": 48,
            "llm_pool_min": 38,
            "evaluated": 6,
            "kept_strict": 6,
            "llm_review_pool": 0,
            "dropped_noise": 0,
            "deep_skipped_below_pool": 0
        },
        "candidates": [
            {
                "host": "www.chara.kyiv.ua",
                "cname": "cdn.webflow.com",
                "status": 404,
                "title": "404 - Page not found",
                "fingerprint": "webflow",
                "confidence": "high",
                "claim_score": 71,
                "claim_tier": "high",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "claim_likely",
                "llm_confidence": 0.85,
                "llm_rationale_vi": "CNAME trỏ tới CDN Webflow, HTTP 404. Webflow cho phép claim subdomain nếu chưa gắn site. Điểm claim cao, không có tín hiệu live.",
                "llm_labeled_at": "2026-04-04T15:16:15.401Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "high"
            },
            {
                "host": "www.charawines.kyiv.ua",
                "cname": "cdn.webflow.com",
                "status": 404,
                "title": "404 - Page not found",
                "fingerprint": "webflow",
                "confidence": "high",
                "claim_score": 71,
                "claim_tier": "high",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "claim_likely",
                "llm_confidence": 0.85,
                "llm_rationale_vi": "Tương tự chara, CNAME Webflow, 404. Cấu hình giống hệt, khả năng cao chưa gắn tenant và có thể claim.",
                "llm_labeled_at": "2026-04-04T15:16:15.401Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "high"
            },
            {
                "host": "www.svovkotrub.kyiv.ua",
                "cname": "serhii-v.github.io",
                "status": 404,
                "title": "Site not found · GitHub Pages",
                "fingerprint": "github_pages",
                "confidence": "high",
                "claim_score": 62,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "claim_possible",
                "llm_confidence": 0.75,
                "llm_rationale_vi": "CNAME GitHub Pages, 404. GitHub Pages cho phép claim nếu repo chưa tồn tại. Điểm claim trung bình, cần xác minh thêm nhưng có tiềm năng.",
                "llm_labeled_at": "2026-04-04T15:16:15.401Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "medium"
            },
            {
                "host": "www.chaklun.kyiv.ua",
                "cname": "ghs.googlehosted.com",
                "status": 404,
                "title": "Error 404 (Not Found)!!1",
                "fingerprint": "firebase",
                "confidence": "high",
                "claim_score": 50,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "unlikely",
                "llm_confidence": 0.65,
                "llm_rationale_vi": "CNAME Google (Firebase), 404. Firebase có thể claim nhưng cấu hình mặc định thường an toàn. Điểm trung bình, khả năng claim thấp hơn.",
                "llm_labeled_at": "2026-04-04T15:16:15.401Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low"
            },
            {
                "host": "www.liceum205.kyiv.ua",
                "cname": "ghs.googlehosted.com",
                "status": 404,
                "title": "Error 404 (Not Found)!!1",
                "fingerprint": "firebase",
                "confidence": "high",
                "claim_score": 50,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "unlikely",
                "llm_confidence": 0.65,
                "llm_rationale_vi": "Tương tự chaklun, CNAME Firebase, 404. Cấu hình Google thường chặn claim trừ khi misconfig rõ. Khả năng thấp.",
                "llm_labeled_at": "2026-04-04T15:16:15.401Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low"
            },
            {
                "host": "www.lyceum205.kyiv.ua",
                "cname": "ghs.googlehosted.com",
                "status": 404,
                "title": "Error 404 (Not Found)!!1",
                "fingerprint": "firebase",
                "confidence": "high",
                "claim_score": 50,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true
            }
        ],
        "llm_review_pool": [],
        "llm_batch": {
            "provider": "deepseek",
            "base_url": "https:\/\/api.deepseek.com\/v1",
            "model": "deepseek-chat",
            "top_n_requested": 5,
            "batch_hosts": [
                "www.chara.kyiv.ua",
                "www.charawines.kyiv.ua",
                "www.svovkotrub.kyiv.ua",
                "www.chaklun.kyiv.ua",
                "www.liceum205.kyiv.ua"
            ],
            "batch_sources": [
                "strict",
                "strict",
                "strict",
                "strict",
                "strict"
            ],
            "promote_revived": true,
            "labeled_at": "2026-04-04T15:16:15.401Z",
            "usage": {
                "prompt_tokens": 846,
                "completion_tokens": 433,
                "total_tokens": 1279,
                "prompt_tokens_details": {
                    "cached_tokens": 128
                },
                "prompt_cache_hit_tokens": 128,
                "prompt_cache_miss_tokens": 718
            }
        }
    }
}