{
    "ok": true,
    "slug": "notion.so-2026-03-24",
    "stats": {
        "subs": 83,
        "all": 83,
        "resolved": 57,
        "live": 53,
        "takeover": 17,
        "juicy": 10,
        "nuclei": 0,
        "subjack": 0,
        "subjack_vuln": 0,
        "takeover_v4": 1,
        "takeover_hot_claim": 0,
        "takeover_claimed": 0,
        "takeover_telegram_ok": 0,
        "confirmed": false,
        "alert": true,
        "scan_log": true
    },
    "path": "\/www\/wwwroot\/tooldomain\/output\/notion.so-2026-03-24",
    "takeover_candidates": [
        "admin-dev.notion.so [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-dev-main-usw2-0001-alb-int-724440932.us-west-2.elb.amazonaws.com\u001b[0m]",
        "admin-stg.notion.so [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-stg-main-usw2-0001-alb-int-1229628.us-west-2.elb.amazonaws.com\u001b[0m]",
        "admin.notion.so [\u001b[35mCNAME\u001b[0m] [\u001b[32minternal-prod-main-usw2-0001-alb-int-1439888260.us-west-2.elb.amazonaws.com\u001b[0m]",
        "affiliate.notion.so [\u001b[35mCNAME\u001b[0m] [\u001b[32mgrsm.io\u001b[0m]",
        "aif.notion.so [\u001b[35mCNAME\u001b[0m] [\u001b[32md3hib8ev3xp1ou.cloudfront.net\u001b[0m]",
        "certs.notion.so [\u001b[35mCNAME\u001b[0m] [\u001b[32mcname.tally.so\u001b[0m]",
        "email.updates.notion.so [\u001b[35mCNAME\u001b[0m] [\u001b[32mmailgun.org\u001b[0m]",
        "file-dev.notion.so [\u001b[35mCNAME\u001b[0m] [\u001b[32md2ras2zen3qnct.cloudfront.net\u001b[0m]",
        "file-stg.notion.so [\u001b[35mCNAME\u001b[0m] [\u001b[32md1at3711nhxn04.cloudfront.net\u001b[0m]",
        "file.notion.so [\u001b[35mCNAME\u001b[0m] [\u001b[32md38nlwxb6ltjav.cloudfront.net\u001b[0m]",
        "front-dev.notion.so [\u001b[35mCNAME\u001b[0m] [\u001b[32mcname.vercel-dns.com\u001b[0m]",
        "front-prod.notion.so [\u001b[35mCNAME\u001b[0m] [\u001b[32mcname.vercel-dns.com\u001b[0m]",
        "front-stg.notion.so [\u001b[35mCNAME\u001b[0m] [\u001b[32mcname.vercel-dns.com\u001b[0m]",
        "info.notion.so [\u001b[35mCNAME\u001b[0m] [\u001b[32mcdn.webflow.com\u001b[0m]",
        "mg.mail.notion.so [\u001b[35mCNAME\u001b[0m] [\u001b[32mmailgun.org\u001b[0m]",
        "op-scim-bridge.notion.so [\u001b[35mCNAME\u001b[0m] [\u001b[32mscim-alb-1717619719.us-west-2.elb.amazonaws.com\u001b[0m]",
        "privacycenter.notion.so [\u001b[35mCNAME\u001b[0m] [\u001b[32md3i6lzthcpsxnn.cloudfront.net\u001b[0m]"
    ],
    "takeover_v4": {
        "domain": "notion.so",
        "version": 5,
        "generated_at": "2026-03-24T04:44:29.000Z",
        "ai_filter": {
            "engine": "rules_scorer_v1",
            "min_score": 48,
            "llm_pool_min": 38,
            "evaluated": 6,
            "kept_strict": 1,
            "llm_review_pool": 0,
            "dropped_noise": 5,
            "deep_skipped_below_pool": 5
        },
        "candidates": [
            {
                "host": "certs.notion.so",
                "cname": "cname.tally.so",
                "status": 404,
                "title": "Page Not Found",
                "fingerprint": "tally",
                "confidence": "high",
                "claim_score": 52,
                "claim_tier": "medium",
                "signals": [],
                "real_candidate": true,
                "llm_verdict": "false_positive",
                "llm_confidence": 0.9,
                "llm_rationale_vi": "CNAME trỏ đến dịch vụ Tally, nhưng HTTP 404 'Page Not Found' cho thấy ứng dụng đang hoạt động bình thường, không có dấu hiệu tài nguyên bị bỏ trống để claim.",
                "llm_labeled_at": "2026-03-24T04:44:32.885Z",
                "llm_model": "deepseek-chat",
                "llm_priority": "low",
                "claimed": false,
                "claim_status": "verify_error",
                "claim_details": {
                    "method": "http_verify",
                    "verify_url": "https:\/\/certs.notion.so\/",
                    "http_status": null,
                    "title_snippet": null,
                    "verify_error": "fetch failed",
                    "webhook_note": "no CLAIM_WEBHOOK_URL",
                    "comment": "Automated SaaS claim requires provider API keys — verify manually (Webflow\/Netlify\/…)"
                },
                "telegram_sent": false,
                "telegram_error": "filtered:llm_priority_low"
            }
        ],
        "llm_review_pool": [],
        "llm_batch": {
            "provider": "deepseek",
            "base_url": "https:\/\/api.deepseek.com\/v1",
            "model": "deepseek-chat",
            "top_n_requested": 5,
            "batch_hosts": [
                "certs.notion.so"
            ],
            "batch_sources": [
                "strict"
            ],
            "promote_revived": true,
            "labeled_at": "2026-03-24T04:44:32.885Z",
            "usage": {
                "prompt_tokens": 381,
                "completion_tokens": 100,
                "total_tokens": 481,
                "prompt_tokens_details": {
                    "cached_tokens": 128
                },
                "prompt_cache_hit_tokens": 128,
                "prompt_cache_miss_tokens": 253
            }
        },
        "v5": {
            "processed_at": "2026-03-24T04:44:32.931Z",
            "auto_claim_enabled": true,
            "telegram_enabled": true,
            "slug": "notion.so-2026-03-24"
        }
    }
}