Your cloud accounts. Bind AWS, GCP, Azure, or Cloudflare vault config to turn a provider on.
Optionally list domains to skip.
How It Works
Builds a scan config from the clouds you enabled, then looks for DNS names that still point at gone infrastructure.
Results
Dangling names, the cloud they pointed at, and report.json.
Overview
Cloud and SaaS tear-downs leave DNS behind. The record still sits in your zone, the resource is gone, and anyone who claims that hostname can serve content on a name your users and certificates already trust. Public fingerprint scanners catch many of those records. They miss gone cloud infra that never matches a can-i-take-over-xyz signature.
This is a standing check for exposure management. You enable the clouds you care about, run BHUSA 2026 Arsenal findmytakeover for zone-diff dangling detection, and get a findings report you can re-run on a schedule when cloud accounts or zones change.
It sits next to the library Subdomain Takeover Scanner (public fingerprint bar). This Collection unit is the Arsenal multi-cloud path: vault variables and secrets for AWS, GCP, Azure, and Cloudflare feed a config assembler, then findmytakeover. You can also edit the bind scripts directly. Clouds stay off until you turn them on; the report says so instead of returning a silent empty result.
Pipeline
Optional bind scripts pull vault flags and secrets for AWS, GCP, Azure, and Cloudflare (FMT_* variables and secret tokens).
Optional excludes-domains supplies domains to skip.
assemble-fmt-config merges bind folders and excludes into a findmytakeover config file.
findmytakeover runs with that config and verify-dns defaulting to true (resolve third-party SaaS fingerprints to confirm NXDOMAIN).
report turns the findmytakeover folder into the findings evidence report.
Inputs
Vault variables (FMT_*_ENABLED, accounts). Non-secret switches and account identifiers that enable each cloud provider path. Defaults leave providers off until you set them, or you edit the bind scripts.
Vault secrets (FMT_ keys and tokens).* Credentials for the providers you enable. Vault chips are already wired; you can also paste values on the node.
excludes-domains. Optional list of domains to omit from the scan.
verify-dns. Default true on findmytakeover. Leave on unless you mean to skip DNS verification of SaaS fingerprints.
Outputs
findmytakeover findings folder. Raw Arsenal tool output for the configured cloud DNS paths.
Findings report. Scripted report over that folder for review and export.
Incomplete-config signal. When no provider is enabled yet, the report surfaces cloud_config_required rather than pretending the multi-cloud check completed.
Sample shape from a smoke-style pack when cloud providers are still disabled (not a live KPI).
tool
severity
title
kind
remediation
workflow
mode
note
findmytakeover
medium
FindMyTakeover cloud config required
gate
Enable FMT_*_ENABLED for the providers you want, mount vault secrets or edit the bind scripts, and re-run.
null
null
null
null
null
null
null
null
multi-cloud-dangling-dns
default
No cloud enabled yet
Once a provider is on, findings name dangling zone or SaaS targets from that cloud.
FAQ
How is this different from Subdomain Takeover Scanner?
That workflow is the public fingerprint bar: subfinder, dnsx, subzy, and nuclei takeover templates. This Collection unit is Arsenal findmytakeover against cloud DNS you enable through vault bind scripts or by editing those scripts.
What happens if I do not supply cloud credentials?
Providers stay off and the report says cloud config is required, instead of a silent empty multi-cloud result. Set Vault FMT_* or edit the bind scripts, then run again.
Does a finding mean the subdomain is claimable?
No. The run surfaces dangling or takeover candidates from findmytakeover. Whether a hostname is claimable depends on the provider registration rules. Treat output as triage input, not a claimability verdict.
How often should I run this?
On a schedule when cloud DNS and accounts change often enough to leave stale records. Weekly or tighter for active multi-cloud estates. Re-run after large decommissions.
Does this send traffic to the target?
findmytakeover talks to the cloud DNS and infra APIs you enable. With verify-dns on, it also resolves third-party SaaS fingerprints (NXDOMAIN checks). It is not a mass HTTP crawl of your web estate.
Related workflows
Subdomain Takeover Scanner. Reach for this instead when you only need the public fingerprint path and do not want multi-cloud vault bindings.
Subdomain Enumeration Workflow. Reach for this instead when you need a complete subdomain list first, because dangling checks only mean something against an inventory you trust.