Editing Marcotrix.xyz Reconnaissance Report (section)

=== High Priority ===

==== Review <code>5201/tcp</code> iperf3 exposure ====

Finding:

<pre>
5201/tcp open iperf3
</pre>

Why it matters:

* <code>iperf3</code> is normally for bandwidth testing, not a public application surface.
* If left public, it can be abused for unwanted traffic generation or resource consumption.

Recommendation:

* Close it if not in active use.
* Restrict it to trusted source IPs if needed.

==== Confirm inbound mail behavior ====

Finding:

* MX points to <code>mail.marcotrix.xyz</code>.
* <code>mail.marcotrix.xyz</code> resolves to <code>57.131.38.220</code>.
* <code>25/tcp</code> was filtered from this vantage point.
* IMAP/submission ports were closed.
* <code>https://mail.marcotrix.xyz/</code> returned <code>502</code>.

Why it matters:

* The domain advertises mail service but may not accept inbound mail.
* DMARC report address is <code>mail@marcotrix.xyz</code>; if mail is broken, aggregate reports may not be received.

Recommendation:

* Confirm intended mail architecture.
* If self-hosting, ensure SMTP and mailbox services are intentionally reachable and hardened.
* If not self-hosting, update MX/SPF/DMARC to match the actual provider.

==== Review Jellyfin public exposure ====

Finding:

<pre>
{
  "ServerName": "marcoserver",
  "Version": "10.11.6",
  "LocalAddress": "http://172.20.0.3:8096",
  "Id": "5b94a56e8601405d8a399c3960d5c546"
}
</pre>

Why it matters:

* Jellyfin version and instance metadata are publicly visible.
* Media servers are common targets for credential attacks and known-version vulnerability checks.

Recommendation:

* Keep Jellyfin current.
* Require strong authentication.
* Disable public signups if enabled.
* Consider restricting access through VPN, SSO, or source allowlists.
* Monitor authentication logs.