v1.12.0 — Wildcard detection and fewer false positives

Focused on making results trustworthy: two classes of false positive removed, wildcard zones detected, and the fingerprint set half again as large. Test count 186 to 243.

Added

Wildcard DNS detection. A zone serving *.example.com answers for every name beneath it, so an enumerated list returns thousands of "resolved" domains that are not real hosts. Each zone is now probed with a couple of random labels; if those resolve, the zone answers for anything and its addresses are recorded. Domains resolving only to that set are marked WILDCARD| and counted separately in the summary.

A host answering with any address outside the set is treated as real and left unflagged. Results are cached per zone, so a scan costs one probe round per zone rather than one per domain, and zones without a wildcard are untouched.

30 further takeover fingerprints (60 to 90), covering Webflow, Help Scout, Intercom, Campaign Monitor, Thinkific, Kajabi, Canny, Frontify, Aha!, ReadMe, SmugMug, Kinsta, Short.io and others. An unrecognised target is reported unknown, so a missing fingerprint turns a real finding into an unactionable line.

Fixed

Non-existent domains are no longer reported as takeover candidates. Any domain lacking A, AAAA, MX and NS records was written as a dangling CNAME whether or not a CNAME existed. A live run of 15 hosts announced "9 TAKEOVER CANDIDATE(S) DETECTED — REVIEW IMMEDIATELY"; all nine were plain NXDOMAIN names with no CNAME at all. On a real enumeration, where most candidate subdomains do not exist, that noise buries genuine findings. A CNAME must now actually be observed; names that simply do not resolve are reported as unresolved.

Housekeeping

The container build pipeline (Dockerfile, ECR workflow) has been removed — the Lambda image is maintained in a separate deployment project, and the workflow failed on every release tag for want of credentials this repository does not hold. lambda_handler.py remains as a reference entry point and stays covered by tests.

The README now links to the roadmap rather than duplicating it, states known limitations explicitly, and the certificate-transparency one-liner is a proper script (helper/crtsh_domains.sh) that retries, fails loudly rather than emitting a partial list, and filters out the certificate common names crt.sh returns alongside hostnames.

All outstanding dependency updates are merged.

Note on verification

Both false-positive fixes and the wildcard IPv6 gap were found by running the tool against real DNS, not by the test suite — which passed throughout. Coverage sits at 95% and did not catch any of them.