https://twiiit.com/mork1e/status/2040478966616637945

nitter

 IP . I had never heard of fastly but it looked to be something similar to vercel, so I figured maybe they had custom deployment links like vercel does.

That’s their CDN bucket on AWS. They currently have it setup so that any invalid endpoints redirect back to index.html

I went on a hunch and figured that they’d probably already have their production app stored somewhere in the CDN ready for deployment

 )and ffuf to try out over 20k different combinations on this URL.

After some sleuthing, BINGO!! I found these two files:

The important one here that immediately caught my eye was “live.html”. That sounded like a prod deployment.

 site will look like on the day the faucet goes live:

It turns out the entire faucet will be revealed to just be a promotion scheme to get you to buy a bitkey and use cash app.

There is no faucet - at least in the sense most were expecting.

bitcoin

The Bitcoin Faucet is Back - jack

Scoresby

[From X](https://x.com/mork1e/status/2040478966616637945)


> Ok so.. they left their CDN exposed. 
>  
> If you ping the domain, you get this ip:
>  
> 151.101.129.49
>  
> It turns out this is a [http://fastly.com](https://t.co/wqDjtIZMEy) IP . I had never heard of fastly but it looked to be something similar to vercel, so I figured maybe they had custom deployment links like vercel does.
>  
> Tried a few different combos and BINGO:
>  
> [http://btc.day.global.prod.fastly.net](https://t.co/VUGl0CQFJm)
>  
> This took me to this:
>  
> [https://d325bmwzjz2yc7.cloudfront.net](https://t.co/EaQKYxNtOy)
>  
> That’s their CDN bucket on AWS. They currently have it setup so that any invalid endpoints redirect back to index.html
>  
> I went on a hunch and figured that they’d probably already have their production app stored somewhere in the CDN ready for deployment
>  
> I used SECLISTs ([https://github.com/danielmiessler/SecLists](https://t.co/gafGrACoMC) )and ffuf to try out over 20k different combinations on this URL.
>  
> After some sleuthing, BINGO!! I found these two files:
>  
> > live.html
> > .DS_STORE
>  
> The important one here that immediately caught my eye was “live.html”. That sounded like a prod deployment. 
>  
>  
> And sure enough, it was!
>  
> This is what the [http://btc.day](https://t.co/eY5zWkX10Z) site will look like on the day the faucet goes live:
>  
> [http://d325bmwzjz2yc7.cloudfront.net/live.html](https://t.co/vXn9H24Gvj)
[http://d325bmwzjz2yc7.cloudfront.net/bitkey.html](https://t.co/M7ExI8pQym)
>  
> It turns out the entire faucet will be revealed to just be a promotion scheme to get you to buy a bitkey and use cash app.
>  
> There is no faucet - at least in the sense most were expecting.