Banked 2026-06-12 from Web2 passive recon on Taiko (taiko.xyz, L2). This is the retry of a lane that previously died to a transient API overload - and the SAME failure recurred, so the fix is now doctrine.
This session crt.sh returned HTTP 404 then HTTP 000 (connect timeout) on EVERY query, for multiple subdomain forms (%.taiko.xyz, taiko.xyz, with/without output=json). That is the exact failure mode that killed the prior attempt. crt.sh is frequently overloaded/rate-limited and cannot be the only CT source.
Rule: when crt.sh returns 404/000/empty, immediately fail over to a second CT source before declaring "no subdomains":
- certspotter (used here, worked instantly): curl -s "https://api.certspotter.com/v1/issuances?domain=DOMAIN&include_subdomains=true&expand=dns_names" then jq -r '.[].dns_names[]'. Free, no auth, JSON, fast.
- Other failovers: web.archive CDX, subfinder (not installed on this box), Censys/Shodan if keyed.
A "0 subdomains" result from crt.sh alone is NEVER trustworthy - it is far more often a crt.sh outage than a real empty CT log. certspotter returned 98 subdomains where crt.sh returned 0.
The banked dangling-CNAME rule (NXDOMAIN/empty-CNAME = zero surface) filters the EASY no-takeover cases. But a CNAME that resolves can still be a takeover if the third-party resource is unclaimed (the provider returns its generic 404/"no such site" page). So the real per-service filter is:
- Fetch the host and look for the PROVIDER'S unclaimed-fingerprint string ("There isn't a GitHub Pages site here", Discourse "Site temporarily", Vercel "DEPLOYMENT_NOT_FOUND", etc.).
- If instead the host serves the TARGET'S OWN content (right <title>, real app), it is CLAIMED -> no takeover.
On Taiko, all 22 CNAMEs resolved AND served Taiko's own content (GitHub Pages "PICO/Taiko", live Discourse, Instatus "OPERATIONAL", Vercel apps with correct titles) -> all CLAIMED, zero takeover.
<name>-<uuid>.saas.atlassian.com "Page Unavailable" is NOT a takeover.jira / jira.internal pointed to per-tenant UUID-bound Atlassian hosts returning "Atlassian Cloud Notifications - Page Unavailable". This is an inactive product on an already-verified tenant, not a registerable site name, and Atlassian gates custom-domain remap behind TXT ownership verification. Do not chase it as a takeover. Informational at most.
swap.taiko.xyz returned HTTP 200 on /.git/config, /.env, /actuator/* - all FP. Confirm with a random nonsense path: if a diff -q against /.env is IDENTICAL (same byte size, same body), it is the SPA index.html fallback, not a real artifact. The byte-size column is the filter; a constant 200/size across every path = catch-all. Substring matches like "UP" or "SECRET" inside minified CSS/JS are noise, not env vars.