Editing Marcotrix.xyz Reconnaissance Report (section)

== Executive Summary ==

<code>marcotrix.xyz</code> is a Namecheap-registered <code>.xyz</code> domain created on <code>2025-11-21</code>. It uses Namecheap/registrar-servers DNS and points its apex to a single OVH Italy VPS address, <code>57.131.38.220</code>. The same address is also used for <code>mail.marcotrix.xyz</code>, <code>jellyfin.marcotrix.xyz</code>, <code>drive.marcotrix.xyz</code>, and <code>money.marcotrix.xyz</code>.

The public surface visible from limited checks includes:

* A static Caddy-served apex website.
* A Caddy reverse-proxied Jellyfin instance on <code>jellyfin.marcotrix.xyz</code>.
* A Caddy reverse-proxied copyparty instance on <code>drive.marcotrix.xyz</code>.
* A broken or misconfigured HTTPS service on <code>money.marcotrix.xyz</code>.
* An HTTPS endpoint for <code>mail.marcotrix.xyz</code> returning <code>502</code>, while mail DNS points MX to the same host.
* <code>5201/tcp</code> open as <code>iperf3</code>.
* <code>123/udp</code> open as NTP v4.
* Strong TLS 1.2/1.3 ciphers on the tested HTTPS names.
* No HSTS on tested HTTPS names.

Most notable observations:

# <code>mail.marcotrix.xyz</code> is the MX target, but SMTP/IMAP/submission ports were filtered or closed in the limited targeted checks. This suggests inbound mail may not work from this vantage point.
# <code>drive.marcotrix.xyz</code> exposes a copyparty service title and unauthenticated landing text.
# <code>jellyfin.marcotrix.xyz</code> exposes public Jellyfin metadata, including version <code>10.11.6</code>, server name <code>marcoserver</code>, a private backend address, and an instance ID.
# <code>5201/tcp</code> is open as <code>iperf3</code>; that is normally a benchmarking service and should be closed or restricted unless intentionally public.
# <code>123/udp</code> is open as NTP v4. If public NTP service is not intentional, restrict it.
# DNSSEC is unsigned, CAA is absent, SPF is softfail, DMARC is monitor-only, and MTA-STS/TLS-RPT were not observed.