{
    "ok": true,
    "slug": "ma.us-2026-04-05",
    "stats": {
        "subs": 4621,
        "all": 4621,
        "resolved": 2691,
        "live": 1186,
        "takeover": 92,
        "juicy": 134,
        "nuclei": 0,
        "subjack": 0,
        "subjack_vuln": 0,
        "takeover_v4": 1,
        "takeover_hot_claim": 0,
        "takeover_claimed": 0,
        "takeover_telegram_ok": 0,
        "confirmed": false,
        "alert": true,
        "scan_log": true
    },
    "path": "\/www\/wwwroot\/tooldomain\/output\/ma.us-2026-04-05",
    "takeover_candidates": [
        "apps.sca.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32meohed-oars-prod-551728205.us-east-1.elb.amazonaws.com\u001b[0m]",
        "batch.dor.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mprod-external-batch-lb-1038521314.us-east-1.elb.amazonaws.com\u001b[0m]",
        "camis.dcp.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mdcp-pr-cis-alb-501729850.us-east-1.elb.amazonaws.com\u001b[0m]",
        "camisqa.dcp.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32meoanf-camis-qa-alb-879553429.us-east-1.elb.amazonaws.com\u001b[0m]",
        "camistrn.dcp.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mdcp-tr-cis-alb-1491170255.us-east-1.elb.amazonaws.com\u001b[0m]",
        "cbhi-cg-cert.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5ct-cbhi-cg-nlb-a18f0813a3d4d598.elb.us-east-1.amazonaws.com\u001b[0m]",
        "cbhi-cg.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5pr-cbhi-cg-nlb-03bc2bda54356f99.elb.us-east-1.amazonaws.com\u001b[0m]",
        "ccfa.eec.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mdpg3igmswxb45.cloudfront.net\u001b[0m]",
        "cdn.sudbury.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32md2f5muqe6pv4as.cloudfront.net\u001b[0m]",
        "clppp-cg-cert.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5ct-clppp-cg-nlb-0a18086aa7da7f87.elb.us-east-1.amazonaws.com\u001b[0m]",
        "clppp-cg.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5pr-clppp-cg-nlb-70e9db7bb4886491.elb.us-east-1.amazonaws.com\u001b[0m]",
        "csg-tax-stg.dor.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32md-eflmsb3ca4.execute-api.us-east-1.amazonaws.com\u001b[0m]",
        "csg-tax.dor.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32md-do8gzff841.execute-api.us-east-1.amazonaws.com\u001b[0m]",
        "dls-gw-trn.dor.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mdls-gw-train-alb-184827504.us-east-1.elb.amazonaws.com\u001b[0m]",
        "dls-gw.dor.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mdls-gw-prod-lb-1891027233.us-east-1.elb.amazonaws.com\u001b[0m]",
        "dotfeeds-dev.dot.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mdot-dvf-dev-754017412.us-east-1.elb.amazonaws.com\u001b[0m]",
        "dotfeeds.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mdot-dvf-prod-564123557.us-east-1.elb.amazonaws.com\u001b[0m]",
        "earlyedncareop.eec.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32meec-pr-lb-w004-271406022.us-east-1.elb.amazonaws.com\u001b[0m]",
        "earlyedncareopuat.eec.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32meec-ua-wb-w004-2009178373.us-east-1.elb.amazonaws.com\u001b[0m]",
        "ecas-cg-cert.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5ct-ecas-cg-nlb-b56de806130e8528.elb.us-east-1.amazonaws.com\u001b[0m]",
        "ecas-cg.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5pr-ecas-cg-nlb-1d0956865bb4d4d3.elb.us-east-1.amazonaws.com\u001b[0m]",
        "eeadev.eea.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32meeadev-1651958970.us-east-1.elb.amazonaws.com\u001b[0m]",
        "eeaonline.eea.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32meeaonline-356342295.us-east-1.elb.amazonaws.com\u001b[0m]",
        "eecweb.eec.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32meec-pr-lb-w002-1742616516.us-east-1.elb.amazonaws.com\u001b[0m]",
        "eitvp.dph.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mdph-ei-prod-external-alb-204688798.us-east-1.elb.amazonaws.com\u001b[0m]",
        "elr-cg-cert.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5ct-elr-cg-nlb-0643da6a533dea63.elb.us-east-1.amazonaws.com\u001b[0m]",
        "elr-cg.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5pr-elr-cg-nlb-f43f6bbe73a8b89b.elb.us-east-1.amazonaws.com\u001b[0m]",
        "elr.dph.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32malb-elr-prod-1961771951.us-east-1.elb.amazonaws.com\u001b[0m]",
        "epolst-cg-cert.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5pr-epolst-cg-cert-nlb-1637e48eb67e067e.elb.us-east-1.amazonaws.com\u001b[0m]",
        "epolst-cg.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5pr-epolst-cg-nlb-9827234a230b5fc2.elb.us-east-1.amazonaws.com\u001b[0m]",
        "fadsql.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32manf-pr-fad-wdb1.ca4gqbyp3uhm.us-east-1.rds.amazonaws.com\u001b[0m]",
        "foreclosures.dob.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32meohed-multi-services-prod-alb-570276119.us-east-1.elb.amazonaws.com\u001b[0m]",
        "gateway.edu.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32md2559ac19j7bnx.cloudfront.net\u001b[0m]",
        "gatewayccfa.eec.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32md3sd8dyp0rgo7i.cloudfront.net\u001b[0m]",
        "gis.massdot.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mmassdot-prod-1062519567.us-east-1.elb.amazonaws.com\u001b[0m]",
        "gisdev.massdot.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mmassdot-dev-1075078658.us-east-1.elb.amazonaws.com\u001b[0m]",
        "gisprpxy.itd.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32malb-eotss-massgis-pr-arc-1434713016.us-east-1.elb.amazonaws.com\u001b[0m]",
        "gisstg.massdot.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mmassdot-stage-2008900211.us-east-1.elb.amazonaws.com\u001b[0m]",
        "giswebservices.massgis.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32meotss-prd-gis-alb-657761949.us-east-1.elb.amazonaws.com\u001b[0m]",
        "hhsvgapps03-dev.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mhhs-ctc-net-hhsvgapps03-dv-nlb-ce05a08c488b0479.elb.us-east-1.amazonaws.com\u001b[0m]",
        "hhsvgapps03-qa.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mhhs-ctc-net-nonshrweb-nlb-adb4e468791f0eaa.elb.us-east-1.amazonaws.com\u001b[0m]",
        "hhsvgapps03-st.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mhhs-ctc-net-hhsvgapps03-st-nlb-22f8413593a24d2b.elb.us-east-1.amazonaws.com\u001b[0m]",
        "hhsvgapps03-training.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mhhs-ctc-net-hhsvgapps03-tr-nlb-86f7785781bf81fb.elb.us-east-1.amazonaws.com\u001b[0m]",
        "hhsvgapps03.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mhhs-ctc-net-hhsvgapps03-nlb-beff5e38858afd31.elb.us-east-1.amazonaws.com\u001b[0m]",
        "hhsvgapps03var-qa.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5qa-hhsvgapps03var-qa-nlb-7441dd86250e7d62.elb.us-east-1.amazonaws.com\u001b[0m]",
        "hhsvgapps03var.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mhhs-ctc-net-hhsvgapps03var-nlb-26b9b54b0ad77c59.elb.us-east-1.amazonaws.com\u001b[0m]",
        "hhsvgapps04-qa.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mhhs-ctc-net-hhsvgapps04-qa-nlb-b7d2b117df823539.elb.us-east-1.amazonaws.com\u001b[0m]",
        "hhsvgapps04.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mhhs-ctc-net-hhsvgapps04-nlb-f887044dac669da0.elb.us-east-1.amazonaws.com\u001b[0m]",
        "hic.oca.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32meohed-hic-prod-alb-1146643102.us-east-1.elb.amazonaws.com\u001b[0m]",
        "hrcms-prod.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32malb-hrcms-prod-web-redirect-1830826885.us-east-1.elb.amazonaws.com\u001b[0m]",
        "hybrid.dor.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mexchange-public-nlb-cea6e1387318e3f1.elb.us-east-1.amazonaws.com\u001b[0m]",
        "ieats-cg-cert.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5ct-ieats-cg-nlb-728cb53f8b6fbb01.elb.us-east-1.amazonaws.com\u001b[0m]",
        "ieats-cg.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5pr-ieats-cg-nlb-a2841c6ac7381559.elb.us-east-1.amazonaws.com\u001b[0m]",
        "licensing.reg.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32meohed-dpl-lookups-prod-1145462138.us-east-1.elb.amazonaws.com\u001b[0m]",
        "maps.env.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mmapsgis-271666734.us-east-1.elb.amazonaws.com\u001b[0m]",
        "maps.massgis.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32malb-eotss-gis-pr-maps-alb-2110575688.us-east-1.elb.amazonaws.com\u001b[0m]",
        "massfinance.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mindep-prod-massfinance-alb-web-1722749248.us-east-1.elb.amazonaws.com\u001b[0m]",
        "masshealth.ehs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mmasshealth-ehs-com-119497926.us-east-1.elb.amazonaws.com\u001b[0m]",
        "masshiway-services.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5pr-masshiway-services-nlb-21ff04245bfc244a.elb.us-east-1.amazonaws.com\u001b[0m]",
        "mcr-cg-cert.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5ct-mcr-cg-nlb-66c10b57f1175fca.elb.us-east-1.amazonaws.com\u001b[0m]",
        "mcr-cg.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5pr-mcr-cg-nlb-49aab300ddc7f88c.elb.us-east-1.amazonaws.com\u001b[0m]",
        "miis-cg-cert.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5ct-miis-cg-cert-nb-50d28a7d4a9b4a96.elb.us-east-1.amazonaws.com\u001b[0m]",
        "miis-cg.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5pr-miis-cg-nlb-a83f2e9e9c692bab.elb.us-east-1.amazonaws.com\u001b[0m]",
        "mmars.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32malb-mmars-prod-ext-2023545886.us-east-1.elb.amazonaws.com\u001b[0m]",
        "mmis.ehs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-ehspr-mis-web-alb-1935367545.us-east-1.elb.amazonaws.com\u001b[0m]",
        "mtc.dor.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mprod-external-load-balancer-2072098918.us-east-1.elb.amazonaws.com\u001b[0m]",
        "newmmis.ehs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-ehspr-mis-web-alb-1935367545.us-east-1.elb.amazonaws.com\u001b[0m]",
        "payinfo.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mindep-prod-payinfo-alb-web-144570225.us-east-1.elb.amazonaws.com\u001b[0m]",
        "pubinfo.dlr.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mdls-mgmt-internet-facing-248356031.us-east-1.elb.amazonaws.com\u001b[0m]",
        "public.dep.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mpublicdep-1291749838.us-east-1.elb.amazonaws.com\u001b[0m]",
        "qaccfa.eec.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-eec-alb-qa-web-ccfa-1915466166.us-east-1.elb.amazonaws.com\u001b[0m]",
        "qagatewayccfa.eec.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-eec-alb-qa-gateway-ccfa-1106989745.us-east-1.elb.amazonaws.com\u001b[0m]",
        "services.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5pr-services-nlb-e3ff9bc488a02ae9.elb.us-east-1.amazonaws.com\u001b[0m]",
        "sso-qa.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5qa-sso-qa-nlb-5676fa30a4ddd389.elb.us-east-1.amazonaws.com\u001b[0m]",
        "sso-training.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5tr-sso-nlb-d2cf9653cd3767d8.elb.us-east-1.amazonaws.com\u001b[0m]",
        "sso.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5pr-sso-nlb-107b8b21b872f621.elb.us-east-1.amazonaws.com\u001b[0m]",
        "syndromic-cg-cert.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5ct-syndromic-cg-nlb-5d36b3e093d9560d.elb.us-east-1.amazonaws.com\u001b[0m]",
        "syndromic-cg.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5pr-syndromic-cg-nlb-d28bb136dea4e5fb.elb.us-east-1.amazonaws.com\u001b[0m]",
        "tableau-qa.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5qa-tableau-qa-nlb-06ccf2f0d89bd442.elb.us-east-1.amazonaws.com\u001b[0m]",
        "tableau.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5pr-tableau-nlb-3e0701b90424a062.elb.us-east-1.amazonaws.com\u001b[0m]",
        "tas.dor.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mstg-external-load-balancer-1443423680.us-east-1.elb.amazonaws.com\u001b[0m]",
        "tenv.eea.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mtenv-1405002290.us-east-1.elb.amazonaws.com\u001b[0m]",
        "tools.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32malb-hhs-prod-tools-587371270.us-east-1.elb.amazonaws.com\u001b[0m]",
        "ua.eec.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32meec-ua-lb-w002-1494560711.us-east-1.elb.amazonaws.com\u001b[0m]",
        "ust.dor.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32meust-prod-lb-2057610354.us-east-1.elb.amazonaws.com\u001b[0m]",
        "vg5pr-cognos.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5pr-cognos-nlb-0ed2fa72b1b3190c.elb.us-east-1.amazonaws.com\u001b[0m]",
        "vg5qa-gw.hhs.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mvg5qa-gw-qa-nlb-75417d068e6e45c2.elb.us-east-1.amazonaws.com\u001b[0m]",
        "web.dor.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mshared-prod-lb-1229307801.us-east-1.elb.amazonaws.com\u001b[0m]",
        "www.eec.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32meec-pr-lb-w002-1742616516.us-east-1.elb.amazonaws.com\u001b[0m]",
        "www.eservices.hrd.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32meoanf-prod-esv-external-alb-1848508613.us-east-1.elb.amazonaws.com\u001b[0m]",
        "www.sfi.eth.state.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32malb-ethics-prod-web-external-897857074.us-east-1.elb.amazonaws.com\u001b[0m]",
        "www.westwood.k12.ma.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mskyworld-alb-1724430657.us-east-2.elb.amazonaws.com\u001b[0m]"
    ],
    "takeover_v4": {
        "domain": "ma.us",
        "version": 4,
        "generated_at": "2026-04-05T08:39:38.899Z",
        "ai_filter": {
            "engine": "rules_scorer_v1",
            "min_score": 48,
            "llm_pool_min": 38,
            "evaluated": 3,
            "kept_strict": 1,
            "llm_review_pool": 1,
            "dropped_noise": 2,
            "deep_skipped_below_pool": 1
        },
        "candidates": [
            {
                "host": "thepiper.k12.somerville.ma.us",
                "cname": "ghs.googlehosted.com",
                "status": 404,
                "title": "Error 404 (Not Found)!!1",
                "fingerprint": "firebase",
                "confidence": "high",
                "claim_score": 50,
                "claim_tier": "medium",
                "signals": [],
                "hard_noise": false,
                "real_candidate": true,
                "llm_verdict": "claim_likely",
                "llm_confidence": 0.85,
                "llm_rationale_vi": "CNAME trỏ tới ghs.googlehosted.com, dịch vụ Firebase, HTTP 404. Tài nguyên Google có thể chưa được gắn với tenant cụ thể, cho phép claim thông qua nhà cung cấp.",
                "llm_labeled_at": "2026-04-05T08:39:44.072Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "high"
            }
        ],
        "llm_review_pool": [
            {
                "host": "cdn.sudbury.ma.us",
                "cname": "d2f5muqe6pv4as.cloudfront.net",
                "status": 404,
                "title": "Page not found » Sudbury",
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 44,
                "claim_tier": "low",
                "signals": [],
                "hard_noise": false,
                "real_candidate": false,
                "llm_eligible": true,
                "strict_pass": false,
                "llm_verdict": "false_positive",
                "llm_confidence": 0.75,
                "llm_rationale_vi": "CNAME trỏ tới CloudFront, HTTP 404 nhưng tiêu đề trang là 'Page not found » Sudbury' cho thấy ứng dụng đang hoạt động đúng, chỉ là trang cụ thể không tồn tại.",
                "llm_labeled_at": "2026-04-05T08:39:44.072Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low"
            }
        ],
        "llm_batch": {
            "provider": "deepseek",
            "base_url": "https:\/\/api.deepseek.com\/v1",
            "model": "deepseek-chat",
            "top_n_requested": 5,
            "batch_hosts": [
                "thepiper.k12.somerville.ma.us",
                "cdn.sudbury.ma.us"
            ],
            "batch_sources": [
                "strict",
                "pool"
            ],
            "promote_revived": true,
            "labeled_at": "2026-04-05T08:39:44.072Z",
            "usage": {
                "prompt_tokens": 512,
                "completion_tokens": 204,
                "total_tokens": 716,
                "prompt_tokens_details": {
                    "cached_tokens": 128
                },
                "prompt_cache_hit_tokens": 128,
                "prompt_cache_miss_tokens": 384
            }
        }
    }
}