# E20. Historical origin-server observations

## Observation sources

The 23 July record combines Censys, Shodan and VirusTotal observations associated with `207.241.172[.]222`. The analyst queried research-service records rather than directly probing that host. The findings below describe the analyst’s notes; the raw scan responses and certificate were not retained. The retained panel files were fetched from api.domatisc[.]ink, not the bare IP. They do not independently reproduce the reported direct-IP response or establish present service availability. [S1]

## Certificate and content associations

The record reports an HTTPS certificate naming `api.cklomino[.]ink` and a direct-IP response containing a Subtensor sign-in panel. Panel markup and assets were compared with related observations. Other domain associations derive from certificate facets, reverse-DNS fields or passive DNS. Each relationship should retain its evidence type: a presented certificate, an observed resolution and matching content are not interchangeable proofs of control. [S1]

The certificate interval recorded as 13 July to 11 October 2026 dates that certificate's validity, not the campaign or tenancy. A matching interface can support a deployment association but can also be copied.

## Service coverage

The saved enumeration lists SSH, HTTP and HTTPS. It cannot prove that no other ports or services existed outside the scan coverage. An empty vulnerability result does not establish a secure host, and a recent-looking software banner does not establish whether the machine was rented or compromised. [S1]

A host-key search reportedly returned only this address in the searched datasets. That is a bounded negative, not proof that no fallback or sibling host exists. Common OpenSSH banners and handshake fingerprints were recognized as weak discriminators because they occur widely.

## Assessment

Certificate and panel-content observations strengthen the historical association of this address with the administration/C2 deployment. They do not prove exclusive tenancy, identify the person operating it or guarantee that blocking it would have no collateral effect. The source's descriptions of a sole origin and a decisive takedown point exceed the available evidence and are not adopted here.

No login, direct-origin request, fresh scan or current ownership check was performed for this evidence report. Domain and address values are historical, defanged research indicators.