v2.0.0 — Cloud reclaim targets as a first-class product

Major release. Output formats have changed — see Breaking changes below before upgrading.

This release follows a correction in what the tool is understood to be. Cloud attribution had been treated as a supporting detail of a dangling-CNAME scanner. It is one of two jobs of equal weight, and the one without a commodity equivalent.

A dangling CNAME names a service, so its intent can be read from DNS. A bare A record cannot. If that address is a cloud IP the owner released, whoever allocates it next controls what is served for that hostname — and DNS gives no signal that this is so. Establishing which A records land in cloud ranges worth pursuing, and where, is what this tool adds.

Assessed against that purpose, the cloud path was unfinished.

Breaking changes

File	Change
csp_matches_*.txt	Prose sentence replaced by structured fields: domain|ip|provider|region|service|prefix|border_group, one record per address
resolution_results_*.txt	May carry a WILDCARD_ZONE| prefix in addition to WILDCARD|
takeover_candidates_*.txt	Gained hop count and full CNAME chain path

Anything parsing v1 output needs updating.

Cloud matches are now actionable

Region, service and AWS network border group are captured from all three providers and written with every match. Previously all of it was discarded at parse time and the output read resolved to aws IPs, which is close to no information: over half of AWS1s ~10,500 published prefixes carry the generic AMAZON tag.

The difference in practice — these are now distinguishable at a glance:

example.com|13.35.163.22|aws|GLOBAL|CLOUDFRONT|13.35.0.0/16|GLOBAL
example.com|3.11.53.7|aws|eu-west-2|EC2|3.8.0.0/14|eu-west-2

Both are "AWS". Only one is worth pursuing. The border group is the boundary an Elastic IP is actually allocated from, which usually mirrors the region but diverges for Local Zones and Wavelength.

Wildcard zones no longer inflate the target list

Two problems, both found by running against real DNS rather than by the test suite.

Catch-all answers were fed to the cloud matcher unmarked, so a wildcarded zone in cloud space emitted one record per enumerated subdomain — the hosting platform1s own addresses burying real findings.

The wildcard test itself asked only whether a resolution matched addresses a probe had observed. Against a large rotating fleet a probe sees a fraction of it, so a later name landed outside the sampled set and was reported as a clean result.

Wildcard status is now reported as two verdicts, because only one of the two questions is reliably answerable. Whether a zone answers for anything is always knowable; whether a particular answer came from that wildcard often is not.

• WILDCARD — addresses matched what the probe observed; a confirmed catch-all.
• WILDCARD_ZONE — the zone answers for anything, but these addresses were not sampled. Could be a catch-all from a larger pool, or a genuine host.

Both are excluded from cloud target counts: in such a zone an address cannot be attributed to the domain rather than to the platform. On one live input this took cloud targets from eight to four, the four removed being a rotating catch-all that had counted as real.

Also

CNAME chain depth and full hop path are recorded on dangling output, so the claimable hop is visible without re-resolving. The end-of-run summary announces cloud-hosted addresses in their own right rather than as a footnote, and groups them by region and service.

AGENTS.md at the repository root states the tool1s purpose and conventions for anyone — human or AI agent — picking the project up, so the misreading this release corrects does not have to be rediscovered.

Note on how these were found

None of the defects fixed here were caught by the test suite, which stayed green throughout at 95% coverage. Two came from running the tool against real DNS, and the framing error came from the maintainer correcting the premise. Coverage measures exercise, not correctness — and a thorough review measuring the wrong thing produces confident, well-supported, wrong conclusions.