================================================================================
  COMBINED OSINT RECONNAISSANCE REPORT
  Target: MegaCorp Industries (megacorp-industries.com)
  Date: 2026-03-15
  Classification: CONFIDENTIAL - Red Team Eyes Only
================================================================================

1. WHOIS RECORD
--------------------------------------------------------------------------------
Domain Name: megacorp-industries.com
Registrar: NameCheap, Inc.
Registration Date: 2019-06-12
Expiration Date: 2027-06-12
Updated Date: 2025-11-03
Registrant Organization: MegaCorp Industries, LLC
Registrant Street: 4500 Innovation Parkway, Suite 300
Registrant City: Austin
Registrant State: Texas
Registrant Postal Code: 78759
Registrant Country: US
Registrant Email: domains@megacorp-industries.com
Name Server: ns1.cloudflare.com
Name Server: ns2.cloudflare.com
DNSSEC: unsigned

Note: Cloudflare DNS indicates CDN/WAF in front of primary web properties.
      Real origin IP may be discoverable through historical DNS records or
      misconfigured subdomains.


2. SUBDOMAIN ENUMERATION
--------------------------------------------------------------------------------
Source: Subfinder + crt.sh + DNS brute force (common wordlist)

  SUBDOMAIN                              IP ADDRESS        STATUS
  ------------------------------------   ----------------  --------
  www.megacorp-industries.com            104.21.45.112     Active (CF)
  mail.megacorp-industries.com           52.14.88.203      Active
  vpn.megacorp-industries.com            52.14.88.210      Active
  dev.megacorp-industries.com            18.220.134.77     Active
  staging.megacorp-industries.com        18.220.134.78     Active
  jenkins.megacorp-industries.com        18.220.134.79     Active
  gitlab.megacorp-industries.com         18.220.134.80     Active
  api.megacorp-industries.com            104.21.45.112     Active (CF)
  blog.megacorp-industries.com           104.21.45.112     Active (CF)
  careers.megacorp-industries.com        76.76.21.21       Active (Vercel)

Key Observations:
  - mail, vpn resolve to AWS us-east-2 (52.14.x.x) -- NOT behind Cloudflare
  - dev, staging, jenkins, gitlab all in same AWS subnet (18.220.134.x)
  - Dev/CI infrastructure appears to lack WAF protection
  - jenkins and gitlab subdomains suggest self-hosted CI/CD pipeline


3. EMPLOYEE INFORMATION (LinkedIn / Public Sources)
--------------------------------------------------------------------------------

  NAME                  ROLE                          NOTES
  --------------------  ----------------------------  ----------------------------
  David Chen            CTO                           Posts about Kubernetes, Go
  Sarah Mitchell        VP Engineering                Shared conference talk on
                                                      microservices migration
  James Rodriguez       Senior DevOps Engineer        GitHub profile shows Docker,
                                                      Terraform, Jenkins expertise
  Priya Patel           Security Engineer             Only security hire visible;
                                                      small security team likely
  Alex Thompson         Full-Stack Developer          Active on Stack Overflow;
                                                      answered questions about
                                                      Django REST Framework
  Maria Gonzalez        HR Director                   LinkedIn shows open positions
                                                      for 3 more engineers
  Kevin O'Brien         Systems Administrator         Certified AWS Solutions
                                                      Architect; manages infra
  Lisa Wang             Frontend Developer            GitHub repos show React/Next.js
  Tom Baker             Junior Developer              Hired 2 months ago; likely
                                                      still onboarding

Phishing Target Assessment:
  - Tom Baker (junior, new) -- high susceptibility, low-privilege access
  - James Rodriguez (DevOps) -- moderate susceptibility, high-value target
  - Kevin O'Brien (SysAdmin) -- moderate susceptibility, highest-value target


4. TECHNOLOGY STACK INDICATORS
--------------------------------------------------------------------------------

Source: Wappalyzer, HTTP headers, job postings, GitHub repos, conference talks

  LAYER               TECHNOLOGY                   EVIDENCE SOURCE
  ------------------  ---------------------------  -------------------------
  Frontend            React 18, Next.js 14         Job postings, GitHub
  Backend             Python 3.11, Django 4.2      Stack Overflow answers
  API Framework       Django REST Framework 3.14   Alex Thompson's SO posts
  Database            PostgreSQL 15                Job postings
  Cache               Redis 7.x                   Job postings
  CI/CD               Jenkins 2.4xx               Subdomain + job postings
  Source Control      GitLab CE (self-hosted)      Subdomain discovery
  Container Runtime   Docker, Kubernetes           David Chen's blog posts
  Cloud Provider      AWS (us-east-2)              IP geolocation
  CDN/WAF             Cloudflare (Free/Pro tier)   DNS + HTTP headers
  VPN                 OpenVPN                      vpn subdomain banner grab
  Mail                Microsoft 365                MX record analysis
  CMS (Blog)          WordPress                    /wp-login.php detected
  Monitoring          Unknown                      No indicators found


5. PUBLIC-FACING SERVICES SUMMARY
--------------------------------------------------------------------------------

  SERVICE              URL / ENDPOINT                         NOTES
  -------------------  -------------------------------------  -------------------
  Corporate Website    https://www.megacorp-industries.com    Behind Cloudflare
  REST API             https://api.megacorp-industries.com    Behind Cloudflare
  Blog (WordPress)     https://blog.megacorp-industries.com   Behind Cloudflare
  Careers Portal       https://careers.megacorp-industries.com  Hosted on Vercel
  Email (O365)         mail.megacorp-industries.com:443       OWA login page
  VPN Gateway          vpn.megacorp-industries.com:1194       OpenVPN, UDP
  Jenkins              jenkins.megacorp-industries.com:8080   HTTP, no redirect
  GitLab               gitlab.megacorp-industries.com:443     HTTPS, login page
  Dev Environment      dev.megacorp-industries.com:8000       Django dev server?
  Staging Environment  staging.megacorp-industries.com:443    HTTPS

Critical Findings:
  [!] Jenkins on port 8080 over HTTP (unencrypted) -- no WAF protection
  [!] Dev environment appears to run Django dev server on port 8000
  [!] Dev/staging/CI infrastructure in same subnet -- flat network segment
  [!] Only one security engineer identified -- likely understaffed


6. ADDITIONAL OSINT NOTES
--------------------------------------------------------------------------------

- Company GitHub organization (github.com/megacorp-industries) has 3 public repos:
    - megacorp-design-system (React component library)
    - megacorp-api-docs (OpenAPI specs -- reveals endpoint structure)
    - mc-interview-challenge (coding challenge -- reveals tech preferences)

- Google dorking results:
    - site:megacorp-industries.com filetype:pdf -- Employee handbook found (2024)
    - "megacorp-industries.com" "password" -- No credential leaks in paste sites
    - Shodan: Jenkins instance indexed, shows version in HTTP headers

- The OpenAPI spec in the public repo reveals:
    - /api/v2/users/ endpoint (user enumeration possible)
    - /api/v2/admin/ endpoint (admin panel exists)
    - JWT authentication in use
    - API versioning suggests v1 may still be active (legacy endpoints)

================================================================================
  END OF RECON REPORT
  Next Phase: Vulnerability Scanning (see vulnerability-scan.txt)
================================================================================
