{ "Event": { "analysis": "1", "date": "2026-06-22", "extends_uuid": "", "info": "[Threat Intel] DNS Attribution Assessment: the caghi.com \u2013 scrut.my nameserver association", "protected": false, "publish_timestamp": "1782525135", "published": true, "threat_level_id": "2", "timestamp": "1782525135", "uuid": "396e79e8-a6fe-4cd4-a1a7-6b3868c37d02", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"data-breach\"", "relationship_type": "" }, { "colour": "#150050", "local": false, "name": "rectifyq:sub-category=\"report\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#dd2e44", "local": false, "name": "rectifyq:MY-relevancy=\"relevant\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Malaysia\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782391075", "to_ids": false, "type": "link", "uuid": "3f8cd395-1941-44ad-92cc-d17145e44fb7", "value": "https://pendakwah.tech/forensic-caghi/" }, { "category": "Network activity", "comment": "subject of assessment", "deleted": false, "disable_correlation": false, "timestamp": "1782468153", "to_ids": true, "type": "domain", "uuid": "ee32b762-d1d2-412c-b391-b457fdfbfd1c", "value": "caghi.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "nameserver operator (Ifcon Technology Sdn Bhd)", "deleted": false, "disable_correlation": false, "timestamp": "1782468175", "to_ids": true, "type": "domain", "uuid": "655a0478-4bf3-4cc1-88f1-eeaf2ccccf8a", "value": "scrut.my", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "caghi.com Delegation - anonymity-oriented provider", "deleted": false, "disable_correlation": false, "timestamp": "1782468197", "to_ids": true, "type": "hostname", "uuid": "93b15cb9-0607-4942-8017-8a78b54d256c", "value": "1-ceci.njalla.do", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "unrelated, parked domain", "deleted": false, "disable_correlation": false, "timestamp": "1782468219", "to_ids": true, "type": "domain", "uuid": "7853568f-fec8-48b8-b8fe-0146ff6d3c79", "value": "scrut.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "currently delegated to scrut.my (ns1/ns2)", "deleted": false, "disable_correlation": false, "timestamp": "1782468241", "to_ids": true, "type": "domain", "uuid": "90fa16c0-3d54-4f30-ab5c-bb774c8a6d01", "value": "gerantanah.com", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "currently delegated to scrut.my (dns1/dns2)", "deleted": false, "disable_correlation": false, "timestamp": "1782468263", "to_ids": true, "type": "domain", "uuid": "3d8d8797-07ad-4abd-9034-5a340c5ed803", "value": "halalinquiry.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "caghi.com Delegation - early hosting", "deleted": false, "disable_correlation": false, "timestamp": "1782391360", "to_ids": true, "type": "filename", "uuid": "4e9f7026-bd4c-4478-baf1-353ebaf49110", "value": "ns1\u20133.mdnsservice.com" }, { "category": "Network activity", "comment": "caghi.com Delegation - relocated", "deleted": false, "disable_correlation": false, "timestamp": "1782468285", "to_ids": true, "type": "url", "uuid": "b1baaf68-86eb-4f74-8488-7a82a8084f97", "value": "ns3/4.myhostadmin.net", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "caghi.com 2020-12; gerantanah present", "deleted": false, "disable_correlation": false, "timestamp": "1782468307", "to_ids": true, "type": "hostname", "uuid": "427dd48e-fdff-4aa1-b1fa-f91f9d9331b8", "value": "ns1.scrut.my", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "caghi.com 2020-12; gerantanah present", "deleted": false, "disable_correlation": false, "timestamp": "1782468329", "to_ids": true, "type": "hostname", "uuid": "298c8f1d-9a01-4259-a81b-750a8bb8fce3", "value": "ns2.scrut.my", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "caghi.com 2021-02\u21922022-05; halalinquiry present", "deleted": false, "disable_correlation": false, "timestamp": "1782468351", "to_ids": true, "type": "hostname", "uuid": "b77834d3-4311-4f36-8db0-b2db03395279", "value": "dns1.scrut.my", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "caghi.com 2021-02\u21922022-05; halalinquiry present", "deleted": false, "disable_correlation": false, "timestamp": "1782468374", "to_ids": true, "type": "hostname", "uuid": "f8e29277-4ba0-4742-9a11-6d7fcdf86061", "value": "dns2.scrut.my", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "caghi.com via Cloudflare, Jan 2021", "deleted": false, "disable_correlation": false, "timestamp": "1782468396", "to_ids": true, "type": "ip-dst", "uuid": "1e525802-a6d6-44da-bc2a-8cde56bb33c8", "value": "172.67.214.142", "Tag": [ { "colour": "#c4bd10", "local": false, "name": "asn:asn=\"13335\"", "relationship_type": "" }, { "colour": "#60003e", "local": false, "name": "asn:as-owner=\"CLOUDFLARENET\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "caghi.com via Cloudflare, Jan 2021", "deleted": false, "disable_correlation": false, "timestamp": "1782468419", "to_ids": true, "type": "ip-dst", "uuid": "8e5ea7f6-f4af-4d0c-8779-a5af59b45a0d", "value": "104.21.59.51", "Tag": [ { "colour": "#c4bd10", "local": false, "name": "asn:asn=\"13335\"", "relationship_type": "" }, { "colour": "#60003e", "local": false, "name": "asn:as-owner=\"CLOUDFLARENET\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "caghi.com via Cloudflare, Jan 2021", "deleted": false, "disable_correlation": false, "timestamp": "1782468441", "to_ids": true, "type": "ip-dst", "uuid": "6a1e1f47-c518-4583-834d-1890ebb623a1", "value": "104.27.135.41", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "caghi.com via Cloudflare, 2022", "deleted": false, "disable_correlation": false, "timestamp": "1782468464", "to_ids": true, "type": "ip-dst", "uuid": "bef052bb-93bd-456e-bd20-d10ed6d635fb", "value": "172.67.69.191", "Tag": [ { "colour": "#c4bd10", "local": false, "name": "asn:asn=\"13335\"", "relationship_type": "" }, { "colour": "#60003e", "local": false, "name": "asn:as-owner=\"CLOUDFLARENET\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "caghi.com via Cloudflare, 2022", "deleted": false, "disable_correlation": false, "timestamp": "1782468486", "to_ids": true, "type": "ip-dst", "uuid": "958866b9-5c30-485f-afbf-f2015c9cdfe2", "value": "104.26.1.90", "Tag": [ { "colour": "#c4bd10", "local": false, "name": "asn:asn=\"13335\"", "relationship_type": "" }, { "colour": "#60003e", "local": false, "name": "asn:as-owner=\"CLOUDFLARENET\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "caghi.com via Cloudflare, 2022", "deleted": false, "disable_correlation": false, "timestamp": "1782468508", "to_ids": true, "type": "ip-dst", "uuid": "51331059-a33d-4ba9-9c75-3b20cfa61874", "value": "104.26.0.90", "Tag": [ { "colour": "#c4bd10", "local": false, "name": "asn:asn=\"13335\"", "relationship_type": "" }, { "colour": "#60003e", "local": false, "name": "asn:as-owner=\"CLOUDFLARENET\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "caghi.com via Cloudflare, 2022\u20132024", "deleted": false, "disable_correlation": false, "timestamp": "1782468531", "to_ids": true, "type": "ip-dst", "uuid": "02a6472c-abea-460b-964c-26d1b440f828", "value": "104.21.90.138", "Tag": [ { "colour": "#c4bd10", "local": false, "name": "asn:asn=\"13335\"", "relationship_type": "" }, { "colour": "#60003e", "local": false, "name": "asn:as-owner=\"CLOUDFLARENET\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "caghi.com via Cloudflare, 2022\u20132024", "deleted": false, "disable_correlation": false, "timestamp": "1782468553", "to_ids": true, "type": "ip-dst", "uuid": "98174edb-6a11-4ee9-9e8d-2dc5a1762f96", "value": "172.67.156.196", "Tag": [ { "colour": "#c4bd10", "local": false, "name": "asn:asn=\"13335\"", "relationship_type": "" }, { "colour": "#60003e", "local": false, "name": "asn:as-owner=\"CLOUDFLARENET\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Person", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782391193", "to_ids": false, "type": "phone-number", "uuid": "dc2fdeae-db22-4fcf-b14e-64fc3c63fbf3", "value": "202012" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782468575", "to_ids": true, "type": "hostname", "uuid": "a0aa19b5-3562-414c-b699-46fb24ccbe6f", "value": "2-nest.pipe.ma", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782468597", "to_ids": true, "type": "hostname", "uuid": "36844573-2646-470a-bdd2-20c887ec4377", "value": "3-pas.njalla.in", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "EventReport": [ { "content": "**TLP:AMBER** \u00b7 Limited Disclosure \u2014 Recipient Organisation Only \u00b7 PT-FI-2026-0617\r\n\r\n# Pendakwah Teknologi\r\n**Digital Forensics & Threat Intelligence**\r\nForensic Intelligence Practice\r\nSelangor, Malaysia\r\n[email protected]\r\n\r\n---\r\n**Confidential \u00b7 Investigative Assessment \u00b7 TLP:AMBER**\r\n# DNS Attribution Assessment: the caghi.com \u2013 scrut.my nameserver association\r\nAn evidentiary evaluation of whether infrastructure records support the claim that the operator of **scrut.my** maintained **caghi.com**.\r\n\r\n**Facts**\r\n* **Report Ref.** PT-FI-2026-0617\r\n* **Version** 1.2 \u2014 Final\r\n* **Date of Issue** 22 Jun 2026\r\n* **Handling** TLP:AMBER\r\n* **Discipline** OSINT / DNS Forensics\r\n* **Subjects** caghi.com \u00b7 scrut.my\r\n* **Confidence** Moderate\u2013High\r\n* **Pages** Single deliverable\r\n\r\n---\r\n\r\n## Section 1: Key Judgments\r\nThe following judgments use estimative language. Confidence reflects source reliability, corroboration across independent datasets, and the strength of competing explanations.\r\n\r\n* **KJ-1 | High confidence:** The sole artefact linking caghi.com to scrut.my is a **registrant-controlled nameserver delegation** recorded in historical WHOIS. This value can be set unilaterally by any party controlling caghi.com and does not, by itself, evidence operation or maintenance by scrut.my.\r\n* **KJ-2 | Moderate\u2013High confidence:** Across three independent datasets \u2014 passive DNS, certificate transparency, and web archival \u2014 caghi.com shows **no observable resolution or service activity** throughout the ~15-month period it was delegated to `dns1/dns2.scrut.my` (Feb 2021 \u2013 May 2022).\r\n* **KJ-3 | High confidence:** caghi.com's only verifiable operational periods occurred on **Cloudflare** infrastructure, both before and after its scrut.my delegation. Every observed resolution maps to Cloudflare address space.\r\n* **KJ-4 | Moderate confidence:** The claim \"caghi.com is maintained by the owner of scrut.my\" is **not substantiated** by the available evidence and is equally consistent with a benign or adversarial third party naming scrut.my infrastructure to manufacture a false association.\r\n* **KJ-5 | High confidence:** Internet Archive captures are not self-validating: the Wayback Machine's **Save Page Now** facility lets any anonymous party force a timestamped capture on demand. One caghi.com capture (17 Jan 2021) is confirmed **manually triggered** (`spn2` source). However, **zero captures of any kind exist within the scrut.my delegation window**, and the one triggered capture falls in a Cloudflare period \u2014 so the archive was **not** used to manufacture evidence implicating scrut.my. See Appendix B.\r\n* **KJ-6 | Moderate\u2013High confidence:** The content caghi.com served was a **rebranded clone of scrut.my's landing page** \u2014 identical page title, scrut.my's own CDN assets, copied press citations, and only a partial \"scrut \u2192 caghi\" text substitution (dozens of residual `scrut` strings remain). scrut.my is the demonstrable original (archived since 2019, full multi-page site); caghi.com is the derivative copy. This establishes caghi.com as an **impersonation of scrut.my** \u2014 the inverse of the asserted relationship. See Appendix C.\r\n\r\n## Section 2: Scope & Objective\r\nThis practice was tasked to determine, using open-source infrastructure data, whether a claimed operational relationship between caghi.com and scrut.my can be supported on evidence. The assessment is confined to DNS, WHOIS, certificate, and archival records. It makes no finding on the content, lawfulness, or purpose of any domain, and attributes conduct to no named individual.\r\n\r\n> **Analytic standard:** Findings apply the distinction between **delegation** (how a domain is configured \u2014 mutable and forgeable) and **function** (whether infrastructure demonstrably operated \u2014 observable and corroborable). Only the latter can support an operational attribution.\r\n\r\n## Section 3: Sources & Reliability Grading\r\nSources graded on the Admiralty scale (reliability A\u2013F / credibility 1\u20136).\r\n\r\n| Source | Collection | Grade | Applied to |\r\n| :--- | :--- | :--- | :--- |\r\n| Registry / Registrar WHOIS (Tucows, Namecheap, MYNIC) | Authoritative public | A2 | registration, current delegation |\r\n| WhoisXML \u2014 Reverse WHOIS & WHOIS History | Commercial aggregation | B2 | associated domains, delegation timeline |\r\n| Mnemonic PassiveDNS v3 | Sensor network | B2 | observed historical resolutions |\r\n| crt.sh (Certificate Transparency) | Authoritative public logs | A1 | certificate issuance record |\r\n| Internet Archive \u2014 Wayback CDX | Authoritative public archive | A2 | page-capture history |\r\n| Direct DNS resolution (dig) | First-party query | A1 | present-state verification |\r\n\r\n## Section 4: Subjects & Related Infrastructure\r\n\r\n| Domain | Registrar | Created | Registrant (public) | Nameservers (present) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| `caghi.com` | Tucows | `2020-12-22` | Redacted \u2014 privacy | Njalla (`1-ceci.njalla.do`) |\r\n| `scrut.my` | Exabytes / MYNIC | \u2014 | **Ifcon Technology Sdn Bhd**, Selangor | Cloudflare (`mary` / `miles`) |\r\n| `scrut.com` | Namecheap | `2004-08-30` | Redacted \u2014 Iceland privacy | registrar-servers (parked) |\r\n| `gerantanah.com` | Namecheap | `2026-06-20` | Redacted \u2014 privacy | scrut.my (`ns1` / `ns2`) |\r\n| `halalinquiry.com` | Namecheap | `2026-06-20` | Redacted \u2014 privacy | scrut.my (`dns1` / `dns2`) |\r\n\r\n`scrut.com` is an unrelated, parked domain. The operative entity is `scrut.my` (Ifcon Technology Sdn Bhd), which operates two nameserver prefix styles \u2014 `ns1/ns2` and `dns1/dns2`.\r\n\r\n## Section 5: Domains Delegated to scrut.my\r\nComplete reverse-WHOIS result set (term: \"scrut.my\").\r\n\r\n| Domain | scrut.my nameservers | Window | Present status |\r\n| :--- | :--- | :--- | :--- |\r\n| `caghi.com` | `ns1/ns2 \u2192 dns1/dns2` | `2020-12 \u2192 2022-05` | migrated to Njalla, 2026-06-21 |\r\n| `gerantanah.com` | `ns1/ns2.scrut.my` | `2026-06-20 \u2192 present` | active |\r\n| `halalinquiry.com` | `dns1/dns2.scrut.my` | `2026-06-20 \u2192 present` | active |\r\n| `scrut.my` | self | \u2014 | Cloudflare since 2022-10-23 |\r\n\r\ncaghi.com appears only in the **historic** set. The two currently-delegated domains were both registered on 2026-06-20 and are unrelated in age to caghi.com.\r\n\r\n## Section 6: caghi.com Delegation Timeline\r\n* **2011-04-17:** **ns1\u20133.mdnsservice.com** (early hosting)\r\n* **2012-11-12:** **ns3/4.myhostadmin.net** (relocated)\r\n* **2013-05-12:** ***-domain-expired.myhostadmin.net** (domain lapsed)\r\n* **2020-12-23:** **ns1.scrut.my / ns2.scrut.my** (first scrut.my delegation (~9 days))\r\n* **2021-01-01:** **Cloudflare (darl / val)** (resolution observed)\r\n* **2021-02-04:** **dns1.scrut.my / dns2.scrut.my** (~15 months \u2014 no resolution observed)\r\n* **2022-05-14:** **Cloudflare (aragorn/dawn \u2192 alexia/rory)** (resolution observed)\r\n* **2026-06-21:** **Njalla (1-ceci.njalla.do \u2026)** (anonymity-oriented provider)\r\n\r\n## Section 7: Corroboration of Function\r\nDelegation windows were tested against three independent records of whether caghi.com actually resolved and served.\r\n\r\n| Period | Delegation | Resolved & served | Infrastructure |\r\n| :--- | :--- | :--- | :--- |\r\n| `2021-01-05 \u2192 01-23` | Cloudflare | Yes | `104.x / 172.67.x` \u2014 Cloudflare |\r\n| `2021-02-04 \u2192 2022-05-14` | dns1/dns2.scrut.my | No observation | \u2014 none, all sources |\r\n| `2022-06-10 \u2192 2024-10` | Cloudflare | Yes | `104.26.x / 172.67.x` \u2014 Cloudflare |\r\n\r\n> **Web Archive:** Captures by year: 2013\u00d71, 2021\u00d71, 2022\u00d76, 2023\u00d75, 2024\u00d710. The single 2021 capture (17 Jan) loads Cloudflare `/cdn-cgi/` assets. Dense 200-OK captures begin June 2022. No captures fall within the scrut.my window.\r\n\r\n> **Certificate Transparency:** No certificate issued between 2020-12-30 and 2022-05-11 \u2014 none during the scrut.my window. Issuance (Cloudflare / Let's Encrypt / Google) resumes only from May 2022.\r\n\r\n## Section 8: Passive-DNS Resolution Record\r\nObserved resolutions of caghi.com (Mnemonic PassiveDNS, grade B2).\r\n\r\n| First seen | Last seen | Type | Answer | Owner |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| `2021-01-05` | `2021-01-23` | `A` | `172.67.214.142 \u00b7 104.21.59.51 \u00b7 104.27.135.41` | Cloudflare |\r\n| `2021-02 \u2192 2022-06` | `\u2014` | **no resolution observed \u2014 scrut.my window** | none |\r\n| `2022-06-10` | `2022-11-17` | `A` | `172.67.69.191 \u00b7 104.26.1.90 \u00b7 104.26.0.90` | Cloudflare |\r\n| `2022-11-30` | `2024-10-24` | `A` | `104.21.90.138 \u00b7 172.67.156.196` | Cloudflare |\r\n\r\nResolution activity brackets the scrut.my window on both sides and is absent within it.\r\n\r\n## Section 9: Analysis of Competing Hypotheses\r\n\r\n| Hypothesis | Consistency with evidence | Assessment |\r\n| :--- | :--- | :--- |\r\n| H1 \u2014 scrut.my's owner operated/maintained caghi.com | Requires functional service during the scrut.my window; none observed in any dataset. | Unsupported |\r\n| H2 \u2014 caghi.com merely named scrut.my nameservers (no service rendered) | Consistent: delegation present, function absent, no certs, no captures, no resolutions. | Consistent |\r\n| H3 \u2014 Third party named scrut.my to fabricate an association | Not excluded; delegation is unilaterally settable and left no operational trace. | Plausible |\r\n\r\n> **Bottom line:** The evidence favours H2/H3 over H1. An operational attribution of caghi.com to the scrut.my operator cannot be sustained on the available record.\r\n\r\n## Section 10: Analytic Confidence & Limitations\r\n> **Limitations:** Passive-DNS sensor coverage is incomplete; absence of observation is not conclusive proof of inactivity. It remains possible caghi.com served a population no sensor recorded. The strength of this assessment derives from **three independent datasets concurring** on a clean 15-month gap, bracketed by well-populated activity. Confidence could be raised by querying a deeper commercial sensor (Farsight/DomainTools DNSDB) or registry zone-file archives; such collection may also return empty and would not, by itself, overturn KJ-1.\r\n\r\n## Appendix A: Indicators & Observables\r\n\r\n| Type | Indicator | Context |\r\n| :--- | :--- | :--- |\r\n| `domain` | @[attribute](ee32b762-d1d2-412c-b391-b457fdfbfd1c) | subject of assessment |\r\n| `domain` | @[attribute](655a0478-4bf3-4cc1-88f1-eeaf2ccccf8a) | nameserver operator (Ifcon Technology Sdn Bhd) |\r\n| `domain` | @[attribute](90fa16c0-3d54-4f30-ab5c-bb774c8a6d01) | currently delegated to scrut.my (ns1/ns2) |\r\n| `domain` | @[attribute](3d8d8797-07ad-4abd-9034-5a340c5ed803) | currently delegated to scrut.my (dns1/dns2) |\r\n| `nameserver` | @[attribute](427dd48e-fdff-4aa1-b1fa-f91f9d9331b8) @[attribute](298c8f1d-9a01-4259-a81b-750a8bb8fce3) | caghi.com 2020-12; gerantanah present |\r\n| `nameserver` | @[attribute](b77834d3-4311-4f36-8db0-b2db03395279) @[attribute](f8e29277-4ba0-4742-9a11-6d7fcdf86061) | caghi.com 2021-02\u21922022-05; halalinquiry present |\r\n| `ipv4` | @[attribute](1e525802-a6d6-44da-bc2a-8cde56bb33c8) @[attribute](8e5ea7f6-f4af-4d0c-8779-a5af59b45a0d) | caghi.com via Cloudflare, Jan 2021 |\r\n| `ipv4` | @[attribute](958866b9-5c30-485f-afbf-f2015c9cdfe2) @[attribute](bef052bb-93bd-456e-bd20-d10ed6d635fb) | caghi.com via Cloudflare, 2022 |\r\n| `ipv4` | @[attribute](02a6472c-abea-460b-964c-26d1b440f828) @[attribute](98174edb-6a11-4ee9-9e8d-2dc5a1762f96) | caghi.com via Cloudflare, 2022\u20132024 |\r\n| `nameserver` | @[attribute](93b15cb9-0607-4942-8017-8a78b54d256c) @[attribute](a0aa19b5-3562-414c-b699-46fb24ccbe6f) @[attribute](36844573-2646-470a-bdd2-20c887ec4377) | caghi.com present (Njalla) |\r\n\r\n## Appendix B: Web-Archive Capture Provenance\r\nBecause the validity of any Wayback citation can be challenged, each caghi.com capture was examined at source level. The Internet Archive records the originating crawl in the `x-archive-src` response header (retrieved via raw `id_` capture mode). This distinguishes **manually triggered** captures (Save Page Now, prefix `spn2-` \u2014 executable anonymously by any party and therefore *not* probative on their own) from **organic** crawls (Common Crawl `CC-MAIN-`, large-scale domain crawls \u2014 independent and corroborative).\r\n\r\n| Capture (UTC) | x-archive-src | Crawl type | Probative weight |\r\n| :--- | :--- | :--- | :--- |\r\n| `2021-01-17 19:24` | `spn2-20210117\u2026wwwb-spn11` | **Save Page Now** \u2014 manually triggered | Low \u2014 self-served |\r\n| `2022-06-02 / 06-03` | `archiveteam_urls_\u2026megawarc` | ArchiveTeam URL-submission feed | Limited |\r\n| `2022-12-04 06:04` | `CC-MAIN-2022-49-\u2026` | **Common Crawl** \u2014 organic mass crawl | High \u2014 independent |\r\n\r\n### Findings\r\n* **Captures within the scrut.my delegation window (2021-02-04 \u2192 2022-05-14):** 0\r\n* **The single manually-triggered (spn2) capture:** 17 Jan 2021 \u2014 falls in a **Cloudflare** period, not the scrut.my window\r\n* **Independent organic confirmation that caghi.com was genuinely live:** Common Crawl, 04 Dec 2022 \u2014 **Cloudflare** infrastructure\r\n* **Archived WHOIS-lookup pages for caghi.com (who.is, whois.com, DomainTools, ViewDNS, SecurityTrails):** **None found** \u2014 no archived whois page underpins the scrut association\r\n\r\n> **Effect on the assessment:** The triggerable nature of the Wayback Machine was tested directly and does **not** support a framing scenario here: no capture \u2014 manufactured or organic \u2014 places caghi.com on scrut.my infrastructure at any time. The only manually-triggered capture, and the only independent organic capture, both fall in Cloudflare periods. This reinforces KJ-2 and KJ-3.\r\n\r\n> **Verification procedure (reproducible):** For any Wayback snapshot cited as evidence, fetch it in raw mode \u2014 `https://web.archive.org/web/id_/` \u2014 and inspect the `x-archive-src` header. A value beginning `spn2-` indicates a manually triggered Save Page Now capture, which establishes only that a party elected to archive the page, not that the page was independently observed to be live.\r\n\r\n## Appendix C: Content Cloning & Impersonation Analysis\r\nThe archived caghi.com homepage (17 Jan 2021, decompressed from the raw capture) was compared against the contemporaneous scrut.my landing page (25 Jan 2021). caghi.com did not serve original content: it served a **rebranded copy of the scrut.my site**.\r\n\r\n| Attribute | scrut.my (original) | caghi.com (captured clone) |\r\n| :--- | :--- | :--- |\r\n| Page title | `SCRUT - Japan Auction History & UK Vehicle History | Home` | **Identical** |\r\n| CDN / static assets | `scrut.b-cdn.net` | `scrut.b-cdn.net` (scrut's own bucket, hotlinked) |\r\n| Press-mention links | paultan.org, careta.my, pandulaju\u2026 | **Identical, copied** |\r\n| Body branding | \"scrut\" throughout | partial find-replace to \"caghi.com\"; **57 residual `scrut` strings** remain (incl. \"go to SCRUT\") |\r\n| Navigation links | `scrut.my/privacy-policy \u00b7 /team \u00b7 /terms\u2026` | repointed to `caghi.com/privacy-policy \u00b7 /team \u00b7 /terms\u2026` |\r\n| Earliest archive | `2019` (full, multi-page, multi-year crawls) | `2021-01-17` (single Save Page Now) |\r\n\r\n### Sub-page archive comparison\r\nThe clone's internal links resolve to caghi.com paths that the archive never captured; the scrut.my originals are fully archived back to 2019.\r\n\r\n| Path | caghi.com snapshots | scrut.my snapshots |\r\n| :--- | :--- | :--- |\r\n| `/privacy-policy` | **0** | 200 \u2014 since 2019-08 |\r\n| `/team` | **0** | 200 \u2014 since 2020-08 |\r\n| `/terms-and-conditions` | **0** | 200 \u2014 since 2019-08 |\r\n| `/listing` | 0 | present |\r\n| `/login` | 5 \u2014 but only from **2022-06** (Cloudflare era) | present |\r\n\r\n> **Methodological caveat:** Part of the absence of caghi.com sub-page snapshots is explained by caghi.com receiving only a single manual Save Page Now capture of its homepage in January 2021, which does not deep-crawl sub-pages. The absence of sub-page captures is therefore **not** relied upon as primary proof. The cloning finding rests on the **content of the page itself** (identical title, scrut.my CDN, residual scrut strings) and on scrut.my's status as the older, fully-built original.\r\n\r\n> **Assessment:** caghi.com appropriated scrut.my's identity along two independent axes \u2014 its **visual brand** (a cloned, partially-rebranded site) and its **nameserver name** (`dns1/dns2.scrut.my` in WHOIS). Neither act required scrut.my's participation, and the nameserver delegation was never observed to function (Section 7\u20138). The evidence establishes scrut.my as the original and caghi.com as the impersonating copy \u2014 the inverse of the claim under examination. Whether the copy was built by the scrut.my operator (e.g. an unofficial mirror) or by a third party cannot be resolved from these artefacts; the sloppy partial rebrand and hotlinked assets are **more consistent with a third-party clone** than an official mirror, but this is assessed at low-to-moderate confidence.\r\n\r\n## Section 11: Authentication & Sign-off\r\n\r\n**A. Hidayat**\r\nLead Analyst, Digital Forensics & Threat Intelligence\r\n\r\n**Quality Review**\r\nPeer / QA Reviewer, Analytic standards & sourcing verified\r\n\r\n| | |\r\n| :--- | :--- |\r\n| Document reference | `PT-FI-2026-0617` |\r\n| Revision history | `v1.0` \u2014 2026-06-22 \u2014 Final issue
`v1.1` \u2014 2026-06-22 \u2014 Added KJ-5 and Appendix B
`v1.2` \u2014 2026-06-22 \u2014 Added KJ-6 and Appendix C |\r\n| Handling | `TLP:AMBER` \u2014 limited to recipient organisation |\r\n| Retention | Per engagement record-keeping policy |\r\n\r\n> **Disclaimer.** This assessment is provided for the recipient's internal investigative purposes and is based solely on open-source data available as of 22 June 2026. It addresses DNS infrastructure attribution only and makes no determination as to the content, legality, or operator identity of any domain. Registrant organisation names are reproduced verbatim from public WHOIS. Open-source records are subject to change and to the coverage limitations of their providers. Nothing herein constitutes legal advice or a conclusive finding of fact for evidentiary proceedings without further corroboration.\r\n\r\n---\r\n**TLP:AMBER** \u00b7 Limited Disclosure \u2014 Recipient Organisation Only \u00b7 End PT-FI-2026-0617\r\n", "deleted": false, "name": "DNS Attribution Assessment: the caghi.com \u2013 scrut.my nameserver association", "timestamp": "1782397060", "uuid": "5370dc47-ac48-464c-8c44-ebcc005144e0" } ] } }