Editing 430.ch Reconnaissance Report (section)

== Executive Summary ==

<code>430.ch</code> is hosted on Infomaniak infrastructure and uses Infomaniak for registrar/DNS. The apex site is a small Caddy-served static site with a public image directory under <code>/m/</code> and a public contact page. Mail is delegated to Migadu.

The currently live externally visible surface consists of:

* Apex/static host: <code>430.ch</code>, <code>staging.430.ch</code>, and <code>wiki.430.ch</code> on <code>83.228.241.21</code> / <code>2001:1600:18:102::167</code>.
* Separate <code>ov.430.ch</code> host on <code>83.228.241.25</code> / <code>2001:1600:18:102::26f</code>.
* HTTPS on all live hostnames, backed by Caddy.
* <code>ov.430.ch</code> and <code>wiki.430.ch</code> are MediaWiki installations behind Caddy and Apache.
* SSH exposed on both discovered hosts.
* <code>ov.430.ch</code> exposes additional ports: <code>5355/tcp</code>, <code>6567/tcp</code>, and <code>8080/tcp</code> on IPv6.

Most notable owner-action items:

# <code>5355/tcp</code> is open on <code>ov.430.ch</code>. This is unusual on the public Internet because port 5355 is normally associated with LLMNR. Close or restrict it unless there is a deliberate use.
# <code>8080/tcp</code> is open on IPv6 for <code>ov.430.ch</code> and exposes Apache/MediaWiki directly. It is filtered on IPv4. If this is meant to be only a backend listener behind Caddy, bind it to loopback or firewall it on IPv6.
# <code>6567/tcp</code> is open on <code>ov.430.ch</code>, and <code>6567/udp</code> is <code>open|filtered</code>. This matches the common Mindustry game-server port. Confirm whether it is intentional.
# HSTS is not configured on the HTTPS services.
# The apex CORS policy is broad: it reflects arbitrary <code>Origin</code> and sets <code>Access-Control-Allow-Credentials: true</code>. The current root site is static, so impact is limited, but the policy is unnecessarily permissive if not intentional.
# Mail DNS is mostly reasonable but could be improved with CAA, MTA-STS, and TLS-RPT.
# <code>ov.430.ch</code> exposes public MediaWiki site information, users, rights changes, versions, and extension metadata. That may be acceptable for a public wiki, but it is worth reviewing.