{ "ok": true, "slug": "mn.us-2026-04-06", "stats": { "subs": 28389, "all": 28389, "resolved": 11237, "live": 65, "takeover": 30, "juicy": 72, "nuclei": 0, "subjack": 0, "subjack_vuln": 0, "takeover_v4": 2, "takeover_hot_claim": 0, "takeover_claimed": 0, "takeover_telegram_ok": 0, "confirmed": false, "alert": true, "scan_log": true }, "path": "\/www\/wwwroot\/tooldomain\/output\/mn.us-2026-04-06", "takeover_candidates": [ "account.msrs.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mp2e-ao-lb-1744495793.us-east-2.elb.amazonaws.com\u001b[0m]", "app.dps.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mapp-lb-462354986.us-east-2.elb.amazonaws.com\u001b[0m]", "app2.dps.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mapp2-lb-1231743315.us-east-2.elb.amazonaws.com\u001b[0m]", "assets.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32md2cp583pfeq1vm.cloudfront.net\u001b[0m]", "aurora.msrs.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mp2e-aurora-lb-2145991789.us-east-2.elb.amazonaws.com\u001b[0m]", "callcentervoicemail.web.health.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32md3u1wxr7hx43tw.cloudfront.net\u001b[0m]", "casecontact.web.health.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32md33x48cjppisri.cloudfront.net\u001b[0m]", "dbf.dot.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mlb-w2-tr-global-1082410622.us-west-2.elb.amazonaws.com\u001b[0m]", "employers.msrs.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mmsrs-website-lb-fe-1606572523.us-east-2.elb.amazonaws.com\u001b[0m]", "energy-assistance.nonprod.commerce.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mdtbudahd9slgr.cloudfront.net\u001b[0m]", "energy-assistance.web.commerce.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32md1tu78hhxen5ne.cloudfront.net\u001b[0m]", "external.gitlab.health.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mexternal-gitlab-alb-256933105.us-east-2.elb.amazonaws.com\u001b[0m]", "ftp.aurora.msrs.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mp2e-sftp-lb-336d2ae60454229e.elb.us-east-2.amazonaws.com\u001b[0m]", "grafana.health.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mdualstack.internal-grafana-1996364358.us-east-2.elb.amazonaws.com\u001b[0m]", "inmates.co.roseau.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32minmates.co.roseau.mn.us.s3-website.us-east-2.amazonaws.com\u001b[0m]", "learningcenter.dps.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mlearningcenter-lb-1796457731.us-east-2.elb.amazonaws.com\u001b[0m]", "maps.co.washington.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mmaps-co-washington-mn-us-1709304190.us-east-1.elb.amazonaws.com\u001b[0m]", "moodle.blueearth.k12.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32muh-beas-1-1042713973.us-east-2.elb.amazonaws.com\u001b[0m]", "payments.nonprod.commerce.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32md3oj7fgaia5xuo.cloudfront.net\u001b[0m]", "pulse-staging.mpls.k12.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mpulse-staging-load-balancer-286514212.us-east-2.elb.amazonaws.com\u001b[0m]", "pulse.mpls.k12.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32medfi20180-odsapilo-1aenszfpvfkwm-1877179527.us-east-2.elb.amazonaws.com\u001b[0m]", "redcap.health.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mredcap-alb-1620091923.us-east-2.elb.amazonaws.com\u001b[0m]", "taniumtest.mnit.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-taniumtest-internalloadbalancer-1283152828.us-east-2.elb.amazonaws.com\u001b[0m]", "vaccinecounts-download.web.health.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32md2781usajtxktp.cloudfront.net\u001b[0m]", "warrants.co.roseau.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mwarrants.co.roseau.mn.us.s3-website.us-east-2.amazonaws.com\u001b[0m]", "www.ci.minneapolis.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mdhxh60wkc9vp3.cloudfront.net\u001b[0m]", "www.menahga.k12.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mrst7-lb-public-prod-9ca6932e6d15504f.elb.us-west-2.amazonaws.com\u001b[0m]", "www.msrs.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mmsrs-website-lb-fe-1606572523.us-east-2.elb.amazonaws.com\u001b[0m]", "www.post.state.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mdps-mn-gov-lb-1440522849.us-east-2.elb.amazonaws.com\u001b[0m]", "www.ssd.k12.mn.us [\u001b[35mCNAME\u001b[0m] [\u001b[32mrst7-lb-public-prod-9ca6932e6d15504f.elb.us-west-2.amazonaws.com\u001b[0m]" ], "takeover_v4": { "domain": "mn.us", "version": 4, "generated_at": "2026-04-06T01:17:05.504Z", "ai_filter": { "engine": "rules_scorer_v1", "min_score": 48, "llm_pool_min": 38, "evaluated": 4, "kept_strict": 2, "llm_review_pool": 0, "dropped_noise": 2, "deep_skipped_below_pool": 2 }, "candidates": [ { "host": "in.forestlake.k12.mn.us", "cname": "ghs.googlehosted.com", "status": 404, "title": "Error 404 (Not Found)!!1", "fingerprint": "firebase", "confidence": "high", "claim_score": 50, "claim_tier": "medium", "signals": [], "hard_noise": false, "real_candidate": true, "llm_verdict": "unlikely", "llm_confidence": 0.7, "llm_rationale_vi": "CNAME trỏ đến ghs.googlehosted.com nhưng trả về lỗi 404. Đây có thể là cấu hình Google Workspace chưa hoàn tất hoặc trang không còn tồn tại, nhưng không rõ ràng là có thể chiếm quyền sở hữu trực tiếp.", "llm_labeled_at": "2026-04-06T01:17:11.074Z", "llm_model": "deepseek-chat", "llm_priority": "low" }, { "host": "mail.osakis.k12.mn.us", "cname": "ghs.googlehosted.com", "status": 404, "title": "Error 404 (Not Found)!!1", "fingerprint": "firebase", "confidence": "high", "claim_score": 50, "claim_tier": "medium", "signals": [], "hard_noise": false, "real_candidate": true, "llm_verdict": "unlikely", "llm_confidence": 0.7, "llm_rationale_vi": "Tương tự, CNAME đến ghs.googlehosted.com với lỗi 404. Có khả năng là miền phụ được cấu hình cho dịch vụ Google nhưng chưa được thiết lập đầy đủ, không phải lỗ hổng claim rõ ràng.", "llm_labeled_at": "2026-04-06T01:17:11.074Z", "llm_model": "deepseek-chat", "llm_priority": "low" } ], "llm_review_pool": [], "llm_batch": { "provider": "deepseek", "base_url": "https:\/\/api.deepseek.com\/v1", "model": "deepseek-chat", "top_n_requested": 5, "batch_hosts": [ "in.forestlake.k12.mn.us", "mail.osakis.k12.mn.us" ], "batch_sources": [ "strict", "strict" ], "promote_revived": true, "labeled_at": "2026-04-06T01:17:11.074Z", "usage": { "prompt_tokens": 506, "completion_tokens": 228, "total_tokens": 734, "prompt_tokens_details": { "cached_tokens": 128 }, "prompt_cache_hit_tokens": 128, "prompt_cache_miss_tokens": 378 } } } }