{
    "ok": true,
    "slug": "malwarebytes.com-2026-04-05",
    "stats": {
        "subs": 204,
        "all": 204,
        "resolved": 148,
        "live": 137,
        "takeover": 15,
        "juicy": 15,
        "nuclei": 0,
        "subjack": 0,
        "subjack_vuln": 0,
        "takeover_v4": 0,
        "takeover_hot_claim": 0,
        "takeover_claimed": 0,
        "takeover_telegram_ok": 0,
        "confirmed": false,
        "alert": true,
        "scan_log": true
    },
    "path": "\/www\/wwwroot\/tooldomain\/output\/malwarebytes.com-2026-04-05",
    "takeover_candidates": [
        "ark.malwarebytes.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mupdates-ark-mb-prod-1765428959.us-east-1.elb.amazonaws.com\u001b[0m]",
        "billing-management-business.malwarebytes.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md3rh3e3r83qavm.cloudfront.net\u001b[0m]",
        "buy-stage.malwarebytes.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1cuv7qa78ojo5.cloudfront.net\u001b[0m]",
        "buy.malwarebytes.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1tob568nwk5gw.cloudfront.net\u001b[0m]",
        "emailprivacy.malwarebytes.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mprod-thegreat-133849522.us-east-2.elb.amazonaws.com\u001b[0m]",
        "gslink.cs.malwarebytes.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md3gur9f2gscrv4.cloudfront.net\u001b[0m]",
        "gsnlink.malwarebytes.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md3gur9f2gscrv4.cloudfront.net\u001b[0m]",
        "help.malwarebytes.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mmalwarebytes7709.zendesk.com\u001b[0m]",
        "mwb-cds-dbt-docs.sre.malwarebytes.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mmalwarebytes.github.io\u001b[0m]",
        "my.malwarebytes.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1povkri3il01n.cloudfront.net\u001b[0m]",
        "nebula-befana-cc-prod.cloud.malwarebytes.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mnebula-shared-alb-public-prod-839044460.us-east-1.elb.amazonaws.com\u001b[0m]",
        "prod-www-dynamic.malwarebytes.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdo9sxxa2p3463.cloudfront.net\u001b[0m]",
        "support.malwarebytes.com [\u001b[35mCNAME\u001b[0m] [\u001b[32mdgqacyah6jffk.cloudfront.net\u001b[0m]",
        "telemetry.malwarebytes.com [\u001b[35mCNAME\u001b[0m] [\u001b[32md1lln5uj645yml.cloudfront.net\u001b[0m]",
        "trace.malwarebytes.com [\u001b[35mCNAME\u001b[0m] [\u001b[32malb-public-web-prod-27071997.us-west-2.elb.amazonaws.com\u001b[0m]"
    ],
    "takeover_v4": {
        "domain": "malwarebytes.com",
        "version": 4,
        "generated_at": "2026-04-05T11:05:16.935Z",
        "ai_filter": {
            "engine": "rules_scorer_v1",
            "min_score": 48,
            "llm_pool_min": 38,
            "evaluated": 3,
            "kept_strict": 0,
            "llm_review_pool": 3,
            "dropped_noise": 3,
            "deep_skipped_below_pool": 0
        },
        "candidates": [],
        "llm_review_pool": [
            {
                "host": "gslink.cs.malwarebytes.com",
                "cname": "d3gur9f2gscrv4.cloudfront.net",
                "status": 404,
                "title": "404 Not Found",
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 44,
                "claim_tier": "low",
                "signals": [],
                "hard_noise": false,
                "real_candidate": false,
                "llm_eligible": true,
                "strict_pass": false,
                "llm_verdict": "unlikely",
                "llm_confidence": 0.7,
                "llm_rationale_vi": "CNAME trỏ tới CloudFront nhưng trả về 404. Có thể là endpoint không còn sử dụng nhưng CloudFront distribution vẫn được kiểm soát bởi chủ sở hữu hợp pháp.",
                "llm_labeled_at": "2026-04-05T11:05:24.461Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low"
            },
            {
                "host": "gsnlink.malwarebytes.com",
                "cname": "d3gur9f2gscrv4.cloudfront.net",
                "status": 404,
                "title": "404 Not Found",
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 44,
                "claim_tier": "low",
                "signals": [],
                "hard_noise": false,
                "real_candidate": false,
                "llm_eligible": true,
                "strict_pass": false,
                "llm_verdict": "unlikely",
                "llm_confidence": 0.7,
                "llm_rationale_vi": "Tương tự host khác, CNAME CloudFront, HTTP 404. Không có bằng chứng distribution bị bỏ hoặc có thể chiếm quyền sở hữu.",
                "llm_labeled_at": "2026-04-05T11:05:24.461Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low"
            },
            {
                "host": "telemetry.malwarebytes.com",
                "cname": "d1lln5uj645yml.cloudfront.net",
                "status": 404,
                "title": null,
                "fingerprint": "aws_s3",
                "confidence": "high",
                "claim_score": 44,
                "claim_tier": "low",
                "signals": [],
                "hard_noise": false,
                "real_candidate": false,
                "llm_eligible": true,
                "strict_pass": false,
                "llm_verdict": "unlikely",
                "llm_confidence": 0.7,
                "llm_rationale_vi": "CNAME CloudFront khác, trả về 404. Có khả năng là endpoint telemetry dự phòng hoặc đã ngừng, nhưng khó claim do chủ sở hữu chính vẫn kiểm soát tài nguyên.",
                "llm_labeled_at": "2026-04-05T11:05:24.461Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low"
            }
        ],
        "llm_batch": {
            "provider": "deepseek",
            "base_url": "https:\/\/api.deepseek.com\/v1",
            "model": "deepseek-chat",
            "top_n_requested": 5,
            "batch_hosts": [
                "gslink.cs.malwarebytes.com",
                "gsnlink.malwarebytes.com",
                "telemetry.malwarebytes.com"
            ],
            "batch_sources": [
                "pool",
                "pool",
                "pool"
            ],
            "promote_revived": true,
            "labeled_at": "2026-04-05T11:05:24.461Z",
            "usage": {
                "prompt_tokens": 625,
                "completion_tokens": 272,
                "total_tokens": 897,
                "prompt_tokens_details": {
                    "cached_tokens": 128
                },
                "prompt_cache_hit_tokens": 128,
                "prompt_cache_miss_tokens": 497
            }
        }
    }
}