Mapping the two-server estate

The Union cluster had been mapped for a while: ten domains, shared nameservers, a shared reseller, and a DMARC reporting address that pointed at a Damascus web studio's Gmail account. What it lacked was any way to get from that infrastructure to a named party.

The step that changed it was unglamorous. Every domain in the file resolved to a single address — 65.21.200.112 — so the obvious next question was what else lived there.

The first server

Reverse-IP on 65.21.200.112 returned roughly a hundred and twenty hostnames. Most were expected: the Union sites, Gaia's own domains, and a scattering of unrelated clients. Two were not.

hamsho-group.com and gaia-printing.com were both still configured as virtual hosts on the machine, each with a mail. entry — despite neither resolving in public DNS any more. The old gaia-printing.com/hamsho/ install had never been a coincidence of directory naming. Gaia's web server was the host of the Hamsho Group site, and still is.

The second server

The more useful find was buried in the SPF records. Several domains on the first machine authorised addresses that were not the first machine — among them 176.9.55.34, which turned out to be running ns3 and ns4 for a domain that had not appeared anywhere in the investigation: gaia-group.co.

That domain resolved to 188.40.140.252. Reverse-IP on that returned around ninety hostnames, and the overwhelming majority of them were mail. records. This was not a web host. It was a corporate mail server.

The contents settled the question of what Gaia actually is:

• hamshocom.com — Hamsho Communication, named in the EU/UK designation of Mohammed Hamcho
• smi-sy.com — Syria Metal Industries, also named in that designation
• jupiter-hi.com and jupiterrentacar.com — Jupiter for Investment and Tourism, also named
• hamshocarpet.com, shamprint.com, palmyravillage.com, jupiterrentacar.com — carpet distribution, printing, hotels and resorts, car rental: four of OFAC's listed business lines for Hamsho International Group

What this does and does not prove

It proves that one operator runs the mail, the DNS and the registrar account for the digital estate of several designated entities. That is a real finding, and it reframes Gaia from "a web vendor these companies happen to share" to something closer to a captive IT function.

It does not prove common ownership of everything on those machines. Gaia has genuine unrelated clients — a rental app, a safety-equipment supplier, a stone-cladding firm — and their presence on the same box means nothing about who owns them. The same caution applies, uncomfortably, to Union Electrical Group: sharing a server with a sanctioned group's mail is an operator signal, not an ownership document.

The distinction is the whole discipline of this register. Co-hosting is evidence of a shared operator. Only paperwork is evidence of a shared owner.

Postscript, 14 August 2026

"Two-server estate" was accurate to what had been mapped on 12 August, not to the estate itself. A pass through the register's SPF records two days later identified a third machine, server2.bocme.net (and its sibling server1.bocme.net), belonging to a separate operator entirely: BOC — Business Optimization Consultants, a Damascus and Aleppo web firm with its own registrar and DNS stack, unrelated to Gaia. Twenty-seven domains authorise a BOC relay in their SPF records, every one of them registered before 5 January 2017 — the estate's IT operator before Gaia, not a third Gaia box. See the boc entity and the boc-second-operator finding for the full picture, and the boc-gaia-handover event for when the handover happened.

This does not change anything argued above about Gaia's own two machines — that analysis holds. It means the title undercounts the estate's technical history by one operator and two more servers, which is exactly the kind of framing the "what this does and does not prove" section above was trying to guard against, just aimed at the wrong boundary.