# Domain OSINT Investigation Report - ta551.info

**Generated:** 2026-10-10  
**Case ID:** CASE-2026-10-10-AE96F1  
**Runner:** domain-osint v1.3.8  
**Execution Mode:** Canonical Runner (passive/public sources only)

---

## Executive Summary

This investigation collected **43 evidence records** from 12 public/passive sources to analyze the DNS infrastructure, SSL certificates, hosting information, and historical data for `ta551.info`. 

No ownership attribution was made — all findings are technical observations subject to analyst review. Shared infrastructure (Porkbun, Cloudflare) does not confirm common control or identity.

### Key Findings at a Glance
| Category | Finding | Confidence |
|----------|---------|------------|
| **Domain Status** | Active, registered 2026-06-28, expires 2027-06-28 | High |
| **Registrar/Nameservers** | Porkbun (ns.porkbun.com) / Cloudflare (SOA) | High |
| **Live TLS** | Active on all checked hostnames | High |
| **Hosting IP** | 188.225.35.8 | Medium |
| **SSL Certificate** | Let's Encrypt, issued 2026-07-02, expires 2027-01-02 | Medium |
| **Reputation (VirusTotal)** | 53 harmless / 0 malicious / 39 undetected scans | Medium |

---

## Methodology Coverage

### Sources Consulted

| Source | Access Mode | Credential | Status | Notes |
|--------|-------------|------------|--------|-------|
| RDAP (Identity Digital) | PUBLIC | N/A | OK | Authoritative registry data |
| DNS Lookup | PUBLIC | N/A | OK | Current records |
| Certificate Transparency (crtsh) | PUBLIC | N/A | OK | Historical issuance data |
| Live TLS Validation | DIRECT_PUBLIC | N/A | OK | Handshake test |
| Wayback Machine | PUBLIC | N/a | RATE_LIMITED | HTTP 429, partial coverage |
| urlscan.io | AUTHENTICATED | env | NO_RESULT | No scans found for domain |
| Netlas (domain enrichment) | AUTHENTICATED | env | NO_RESULT | Free plan limits |
| VirusTotal | AUTHENTICATED | env | OK | Reputation context |
| Robtex (passive DNS) | PUBLIC_LIMITED | N/A | OK | Historical DNS observations |
| Censys (host lookup) | AUTHENTICATED | env | OK | Host asset record found |
| Hunt.io | AUTHENTICATED_OPTIONAL | missing | UNAVAILABLE | Requires API key |
| Shodan | AUTHENTICATED | env | UNAVAILABLE | Plan restrictions |
| WHOIS | PUBLIC | N/A | NOT_RUN | Registry format varies |

---

## Technical Findings

### 1. Domain Registration Information (RDAP)

| Field | Value | Confidence |
|-------|-------|------------|
| **Domain** | ta551.info | High |
| **Registration Date** | 2026-06-28T23:33:53.599Z | High |
| **Expiration Date** | 2027-06-28T23:33:53.599Z | High |
| **Last Updated** | 2026-08-11T18:59:20.476Z | High |
| **Status Codes** | clientDeleteProhibited, clientTransferProhibited | High |

> The domain is locked from deletion and transfer operations.

### 2. DNS Infrastructure

#### Nameservers (NS Records)
- `maceio.ns.porkbun.com`
- `curitiba.ns.porkbun.com`
- `salvador.ns.porkbun.com`
- `fortaleza.ns.porkbun.com`

**Corroborated by:** RDAP, DNS dig, Robtex passive DNS, VirusTotal (5 sources) — **PROBABLE technical observation**

> Porkbun provides nameserver delegation. Cloudflare appears in SOA record (dns.cloudflare.com).

#### Mail Exchanger (MX Records)
- `fwd1.porkbun.com` (priority 10)
- `fwd2.porkbun.com` (priority 20)

**Corroborated by:** DNS dig, Robtex passive DNS, VirusTotal — **PROBABLE technical observation**

#### Text Records (TXT)
```
v=spf1 include:_spf.porkbun.com ~all
```

**Purpose:** SPF email authentication using Porkbun's mail relay.

#### SOA Record
- Primary: `curitiba.ns.porkbun.com`
- Secondary: `dns.cloudflare.com`
- Serial: 2412391129
- Refresh: 10000s | Retry: 2400s | Expire: 604800s | Minimum TTL: 1800s

### 3. IP Address Analysis

| Item | Value | Confidence | Source Corroboration |
|------|-------|------------|---------------------|
| **A Record** | `ta551.info` → `188.225.35.8` | High | RDAP, DNS dig (4 sources) |

#### IP: 188.225.35.8

- **Censys:** Host asset record confirmed
- **Robtex Passive DNS:** A record observed continuously since timestamp 1787753384 (~2026-10-29 UTC epoch) through 1791652792
- **VirusTotal:** Included in last DNS records

> **Note:** Single IP with no evidence of multiple hosts or recent changes. Shared hosting detection would require additional IP correlation (e.g., other domains on same IP).

### 4. SSL/TLS Analysis

#### Live TLS Validation Results
All three hostnames tested returned active, valid TLS:

| Hostname | Status | Certificate Expiry | Server IPs |
|----------|--------|-------------------|------------|
| `ta551.info` | ✅ Active | Jan 2, 2027 18:10:22 GMT | 188.225.35.8 |
| `www.ta551.info` | ✅ Active | Jan 2, 2027 18:10:22 GMT | 188.225.35.8 |
| `italia.ta551.info` | ✅ Active | Jan 2, 2027 18:10:22 GMT | 188.225.35.8 |

#### Certificate Details (CT & Live TLS)

- **Issuer:** Let's Encrypt (C=US, O=Let's Encrypt)
- **Certificate Common Name / SANS:** ta551.info, www.ta551.info, italia.ta551.info
- **Not Before:** 2026-07-02T17:11:00Z
- **Not After:** 2027-01-02T18:10:22Z (approx. 4 months from registration)

**Observation:** Certificate issued ~1 month after domain registration — consistent with Let's Encrypt automation for new domains.

### 5. Reputation Context (VirusTotal)

| Metric | Value |
|--------|-------|
| **Total Scans** | 92 |
| **Harmless** | 53 |
| **Malicious** | 0 |
| **Suspicious** | 0 |
| **Undetected** | 39 |

> Clean reputation with no malicious classifications. Some domains may be flagged as "undetected" due to domain age or minimal content.

### 6. Historical Data

#### Certificate Transparency (CT Log)

Three hostnames observed in CT logs:

- `ta551.info` — 3 unique certificates
- `www.ta551.info` — 3 unique certificates  
- `italia.ta551.info` — 3 unique certificates

All issued by Let's Encrypt (YE1), dates align with certificate above.

#### Wayback Machine

Attempted archival scan returned HTTP 429 (Rate Limited). Historical archives may be unavailable due to:
- Robots.txt exclusions
- Server blocking of crawlers
- Domain age (<6 months)

---

## Candidate Technical Relationships (No Attribution)

The following are **technical observations**, not ownership claims. All infrastructure shares common providers but does not prove identity or control.

| Artifact | Provider(s) | Corroborated By | Confidence |
|----------|-------------|-----------------|------------|
| `curitiba.ns.porkbun.com` (NS) | Porkbun, Cloudflare | dig, rdap, robtex, virustotal | PROBABLE |
| `fortaleza.ns.porkbun.com` (NS) | Porkbun, Cloudflare | dig, rdap, robtex, virustotal | PROBABLE |
| `fwd1.fwd2.porkbun.com` (MX) | Porkbun | dig, robtex, virustotal | PROBABLE |
| `maceio.ns.porkbun.com` (NS) | Porkbun, Cloudflare | dig, rdap, robtex, virustotal | PROBABLE |
| `salvador.ns.porkbun.com` (NS) | Porkbun, Cloudflare | dig, rdap, robtex, virustotal | PROBABLE |
| `188.225.35.8` (IP) | Unknown | censys, dig, robtex, virustotal | MODERATE |

> **Important:** Porkbun and Cloudflare are shared infrastructure providers used by thousands of unrelated domains. Common presence does not indicate common operation or identity.

---

## Evidence Summary Table

| Evidence ID | Type | Source | Finding | Signal | Confidence |
|-------------|------|--------|---------|--------|------------|
| E0001-E0004 | Domain Events | RDAP | Registration/expiration timestamps | strong | high |
| E0005-E0009 | Nameservers | RDAP/DNS | Porkbun NS delegation | moderate | high |
| E0010-E0017 | DNS Records | dig | MX, TXT, SOA records | moderate | high |
| E0020-E0025 | CT Certificates | crtsh | Let's Encrypt certs for 3 hostnames | moderate | medium |
| E0023-E0025 | Live TLS | live-tls | Active HTTPS on all hostnames | moderate | high |
| E0026 | Reputation | VirusTotal | Clean VT score, no malicious flags | moderate | medium |
| E0036-E0043 | Passive DNS | Robtex/Censys | Historical IP and record observations | moderate | medium |

**Total Evidence Records:** 43 (table shows first entries)

---

## Unknowns & Gaps

- **Domain Owner:** Not discoverable from public sources
- **Registrant Contact:** Not available in RDAP output (privacy protection)
- **Hosting Provider:** IP address observed but not tied to specific hosting provider without additional data
- **Content Analysis:** urlscan and Wayback yielded no results/limited coverage
- **Associated Accounts:** No username correlation performed (Sherlock requires seed usernames)
- **Shodan Enrichment:** Unavailable due to API access restrictions

---

## Conclusion

**ta551.info** is an active domain with:
- Standard DNS configuration via Porkbun/Cloudflare
- Valid Let's Encrypt SSL certificate
- Clean security reputation on VirusTotal
- No publicly available ownership information

This report represents **passive, public-source collection only**. For deeper analysis (hosting provider identification, content analysis, owner discovery), additional authorized tools or sources would be required.

---

## Raw Artifacts & Case Files

| Path | Description |
|------|-------------|
| `/home/kali/.hermes/skills/research/osint-hybrid-investigation/cases/CASE-2026-10-10-AE96F1/` | Full case directory |
| `case.yaml` | Case metadata and adapter status |
| `evidence.jsonl` | Normalized evidence (all 43 records) |
| `findings.yaml` | Candidate technical relationships |
| `graph.mmd` | Mermaid graph of relationships |
| `raw/` | Original CLI/API responses |

---

**Report generated by osint-hybrid-investigation v1.3.8**  
**No active scanning or intrusive testing was performed.**