Search by domain, entity or sector, or filter by category and server. Third-party marks
domains best read as ordinary Gaia customers rather than part of the estate; they are included here
because they share infrastructure, not because they share an owner.
Most of these are no longer live (check the Status column). A suspended domain is
not weaker evidence than a live one: registration, hosting and mail records outlast a website
going dark.
A → Cloudflare-proxied (172.67.207.225, 104.21.22.246); NS → Cloudflare
SPF: v=spf1 ip4:188.40.140.252 ip4:159.69.139.89 +a +mx ~all; carries a Google Search Console verification TXT
No DMARC record
WHOIS
Matches the existing record: created 2017-08-02, Dynadot Inc.
Live site
A "SOON" coming-soon landing page with placeholder images.
Wayback
A 403 from 2018, then routine crawler noise.
Assessment
No entity currently attached. Notable as the registrant organization behind siamco.sy below — the one link discovered between two otherwise-separate bare domains in this list.
alardia.net
Al Ardia News Agency · وكالة الأرضية الأخبارية — Arabic-language news portal
Third-party client
Live
2025-10-26
Server A
Online research snapshotRetrieved 2026-08-13
DNS
A → 65.21.200.112 (Server A, direct); NS → edna.ns.cloudflare.com / glen.ns.cloudflare.com
SPF: v=spf1 +mx +a +ip4:65.21.200.112 ~all
DMARC: p=none, rua=dmarc-reports.cloudflare.net
WHOIS
Matches the existing record: created 2025-10-26, Dynadot Inc.
Live site
The domain is NOT sinkholed right now — it resolves normally to Server A and serves a live, fully built Arabic-language news portal, وكالة الأرضية الأخبارية ("Al-Ardia News Agency"): sections for Politics/Business/Science/World news, social video, podcasts, user registration/login, and articles dated as recently as January 2026.
Assessment
This directly contradicts the existing purpose text ("currently sinkholed by a security vendor; no recoverable content"). Whatever sinkhole was observed previously either lifted or was specific to that network/point in time — the domain is now a real, active, content-heavy site hosted directly on Server A. Given it's on Server A itself (not just Cloudflare-fronted), this is worth flagging for a purpose-text update and a closer look at who operates it — a functioning news agency is a much more significant tenant on this infrastructure than a dead sinkholed domain.
alshurouqmotors.com
Al-Shurouq Motors — automotive
Industry
Mail only
2017-06-14
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (172.67.167.113, 104.21.50.210); NS → Cloudflare
SPF: v=spf1 +mx +a +ip4:188.40.140.252 ~all
No DMARC record
WHOIS
Matches the existing record: created 2017-06-14, Dynadot Inc.
Live site
HTTP 526 — unreachable.
Wayback
A 403 from 2018, then a directory-listing snapshot from 2021.
Assessment
No entity currently attached; nothing recovered beyond the domain name and its shared automotive theme with Adaa Motors.
alsy-gaz.com
Al-Sy Gaz — industrial gases · شركة تسييل الهواء السورية SPF authorises Server A (65.21.200.112) — a direct cross-link between the two machines
Industry
Mail only
2022-02-28
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (104.21.3.164, 172.67.130.241); NS → Cloudflare
.sy registry record: registered 2018-07-03. Sponsoring Registrar: "Syrian Monster" — a domestic Syrian registrar, not Dynadot. Registrant Organization: "ASAS" (its own real name, not privacy-redacted) — matches its purpose, اساس للتطوير والعمران (Asas for Development and Urbanism).
Wayback
Snapshots 2023–2024, HTTP 200.
Assessment
One of the cleanest "unrelated" signals in this batch: independently registered through a different, domestic registrar (not the estate's Dynadot account), with its own real registrant name on file.
atlasoflaw.com
Law firm — third-party client The only domain in the dataset not registered at Dynadot
Registered 2019-04-03. Registrar: Hosting Concepts B.V. d/b/a Registrar.eu — not the estate's Dynadot account. Registrant Organization: "UCG L.L.C." (United Arab Emirates), not privacy-redacted.
Live site
Unreachable during this pass — both direct fetch and plain curl timed out with no response.
Wayback
Multiple snapshots 2021–2023, all HTTP 200. Title "أطلس القانون" (Atlas of Law) — a real Arabic-language law-firm site.
Assessment
"UCG L.L.C." is United Communication Group, an Abu Dhabi/Damascus web-hosting and development vendor — the developer/registrar-of-record for this client, not a Hamsho or Gaia signal. Same vendor also registered elegantautomotive.sy below.
awtad-albarakeh.com
Awtad Al Barakeh — stone cladding, a named Gaia client
Third-party client
Live
2025-02-24
Server A
Online research snapshotRetrieved 2026-08-13
DNS
A (apex) → 65.21.200.112 — Server A itself
NS → ns1/ns2.sama-athletic.com — Gaia's own vanity nameservers (see sama-athletic.com; not an ownership signal)
MX → apex → 65.21.200.112
SPF: v=spf1 +a +mx +ip4:65.21.200.112 ~all
DMARC: p=none
WHOIS
Registered 2025-02-24. Registrar: Dynadot LLC. Registrant redacted under standard privacy.
Snapshots from Feb and Jul 2025, plus an api. subdomain.
Assessment
Genuine Syrian stone-export business with a Gaia design credit (the site's own footer spells it "Gaya", a stylistic variant, not a different vendor) — ordinary client profile.
awtad-alkheir.vip
Awtad Al Kheir — interior design and contracting, Cairo DMARC rua points to the Gaia operator's Gmail address
Snapshots from July 2025 — contact-us, get-in-touch, investors and a portfolio page (Madinaty apartment finishing).
Assessment
The DMARC-to-Gmail pattern is the same technical fingerprint this register elsewhere treats as strong operator evidence (e.g. Union Electrical Group) — but per the register's own rule that is an operator signal (Gaia administers this client's mail), not an ownership signal. Combined with a real, unrelated Cairo interior-design business and no textual link to Hamsho or Sama Alsham, this reads as Gaia providing full mail administration for an ordinary client, not a hidden estate holding.
ayawater.com
Aya Water
Consumer
Mail only
2006-11-12
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (188.114.96.0, 188.114.97.0); NS → Cloudflare
SPF: v=spf1 +a +mx +ip4:159.69.139.89 +ip4:52.72.12.188 ~all — notably does not include 188.40.140.252
No DMARC record
WHOIS
Created 2006-11-12, Dynadot Inc — not previously on record; adding created/registrar here.
Live site
https:// fails with Cloudflare 526 (invalid origin certificate); http:// redirects to /cgi-sys/suspendedpage.cgi, the same hosting-suspended notice seen across this cluster.
Assessment
No entity attached. SPF omits the usual Server B address (188.40.140.252) that most of this cluster carries — a minor divergence, not itself evidence of a different operator.
baladei.com
Baladi — food
Consumer
Mail only
2018-08-29
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (104.21.24.64, 172.67.217.81); NS → Cloudflare
Created 2018-08-29T18:55:43Z, Dynadot Inc — not previously on record; adding created/registrar here. Identical timestamp, to the second, to baladi-m.com's creation date.
Live site
https:// fails with Cloudflare 526 (invalid origin certificate); http:// redirects to /cgi-sys/suspendedpage.cgi, a generic hosting-suspended notice.
Assessment
No entity attached. The identical registration timestamp with baladi-m.com indicates both were registered in the same batch/session — likely the same operator registering both spellings at once, same pattern as the Sham Aqua Park and Tahweel clusters.
baladi-m.com
Baladi — food
Consumer
Mail only
2018-08-29
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (188.114.96.0, 188.114.97.0); NS → Cloudflare
Extensive real content from 2003 (about.html, activities-a.html) — a genuine, built early-2000s corporate site.
Assessment
"CEC" already exists elsewhere in this register as Cham Engineering and Contracting's abbreviation in a different context (see the sama-al-arab-tv/CEC Wayback-quirk note) — worth checking whether this domain is the same CEC or a coincidental initialism before drawing any connection; not established here.
chamcontracting.com
Cham Engineering and Contractingشركة شام للهندسة والمقاولات Now serves only an "Under Construction" placeholder; the 2016 site survives in the Internet Archive. SPF authorises ip4:188.40.140.252 (Server B) directly.لا يعرض النطاق حالياً سوى صفحة "قيد الإنشاء"؛ موقع عام 2016 محفوظ في أرشيف الإنترنت. سجل SPF يصرّح مباشرة لعنوان IP 188.40.140.252 (الخادم B).
Industry
Dormant
2015-07-25
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (104.21.94.126, 172.67.135.251); NS → Cloudflare
DMARC: p=none, rua → Cloudflare's own aggregator — not the [email protected] pattern seen elsewhere in the estate
WHOIS
Registered 2026-03-23 — a brand-new registration, not a legacy domain. Registrar: Hosting Concepts B.V. d/b/a Registrar.eu (IANA #1647) — not the Dynadot account the rest of the estate sits in. Registrant redacted under standard privacy.
Live site
A bare Apache/cPanel directory listing (cgi-bin/ only) — effectively unbuilt, last touched 2026-03-24.
Wayback
2021 snapshot: a placeholder page, "Website under construction — Powered By Network EGYPT" (networkegypt.com), an unrelated Egyptian web-hosting shop. No Hamsho or Gaia trace at any point in its history.
Assessment
Consistent with third_party: independent DNS and a different registrar, no textual or ownership tie to Hamsho or Sama Alsham beyond sharing Gaia's hosting box.
dakfood.net
DAK / Dar Al-Khair — FMCG · داك فوود للغذائياتداك فوود — أغذية سريعة الاستهلاك Sama Alsham Group's own subsidiary page gives this as DAK's own domain and fax number — the same fax number Unipac lists as one of its own landlines.[email protected] هو عنوان التواصل الخاص بشركة الاتحاد للعبوات والتغليف (يونيباك) بحسب ملفها في دليل industrysy.com — النطاق نفسه ليس تحت علامة يونيباك.
Consumer
Live
2013-10-12
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (188.114.97.0, 188.114.96.0); NS → Cloudflare
Created 2013-10-12, Dynadot Inc — not previously on record; adding created/registrar here.
Live site
A real, built FMCG site — nav for About/Products/Gallery/Quality/Services/Contact, an image slideshow, and a PHP contact form. The footer carries a web-vendor credit: "Design by Afkar" (www.afkar.sy) — a name not seen elsewhere in this register.
Assessment
The site is clearly live and built, not just a mail vhost — worth revisiting the mail_only status. "Afkar" (afkar.sy) is a new, previously-unrecorded web vendor credit; worth checking whether it built any other domains in the estate.
Created 2011-10-24, Dynadot Inc — not previously on record; adding created/registrar here.
Live site
https:// fails with Cloudflare 526 (invalid origin certificate) — consistent with an unmaintained mail-only vhost.
Assessment
No entity currently attached. The SPF/MX pattern is identical to the rest of the consumer cluster on Server B; consistent with the cluster but no standalone confirmation of who runs it specifically.
A → Cloudflare-proxied (104.21.63.99, 172.67.145.34); NS → distinct Cloudflare pair (walk/wilson.ns.cloudflare.com) — the only domain in this batch not on adam/brenna or edna/glen
SPF: v=spf1 +mx +a +ip4:188.40.140.252 ~all
No DMARC record
WHOIS
Created 2015-08-23, the same day as eblaair.com. Registrar: Dynadot Inc.
Wayback
Real content from 2023 (861 bytes — likely a stub/redirect page).
Assessment
Consistent with the existing ebla-airlines entity.
DMARC: p=none, rua=mailto:[email protected] — the operator fingerprint already documented elsewhere in this register
WHOIS
Matches the existing record: created 2013-01-29, Dynadot Inc.
Wayback
Real content from 2018.
Assessment
Consistent with the existing ebla-trade-offshore entity; the DMARC-to-Gaia pattern adds another operator-level data point alongside Union Copper and Union Electrical Group.
.sy registry record: registered 2026-03-10 — brand new. Sponsoring Registrar: "UCG" (United Communication Group), Registrant United Communication Group (UCG), contact [email protected] — UCG is the accredited .sy registrar of record here, not merely a footer credit.
Live site
Elegant Automotive Group — an automotive business with Damascus-area phone numbers; no address or vendor credit visible.
Wayback
Not checked — the domain was only registered 2026-03-10, too recent for archived history.
Assessment
Same UCG vendor pattern as atlasoflaw.com: a real Damascus/Abu Dhabi web-hosting and registrar vendor handling this client's domain directly (as the .sy sponsoring registrar itself, not just a footer credit), unconnected to the Hamsho/Gaia cluster.
elmas-invest.com
Elmas Invest — Damascus real estate development, a named Gaia client
Third-party client
Live
2025-06-16
Server A
Online research snapshotRetrieved 2026-08-13
DNS
A (apex) → 65.21.200.112 — Server A itself
NS → ns1/ns2.sama-athletic.com — Gaia's own vanity nameservers (see sama-athletic.com; not an ownership signal)
MX → apex → 65.21.200.112
SPF: v=spf1 +a +mx +ip4:65.21.200.112 ~all
DMARC: p=none
WHOIS
Registered 2025-06-16. Registrar: Dynadot LLC. Registrant redacted under standard privacy.
Live site
الماس للتطوير العقاري والهندسي (Elmas for Real Estate Development and Engineering) — residential/commercial sales, rentals and property management in Damascus (Kafarsouseh, Shams Market). Footer: "من تطوير Gaia group" (Developed by Gaia group).
Wayback
Snapshots from July 2025 (homepage, blog, contact, FAQs, listings) — an actively built multi-page site.
Assessment
Genuine operating real-estate business with an explicit "Developed by Gaia group" credit — the profile of an ordinary paying client, not an estate member.
emberly.vip
Emberly
Third-party client
Mail only
2025-07-31
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (104.21.12.83, 172.67.151.237)
Matches the existing record: created 2014-06-01, Dynadot Inc.
Wayback
Real content from 2018.
Assessment
No entity currently attached. The equestrian theme echoes Al-Ghabra and Seif Alsham elsewhere in this register, but nothing recovered here ties it to a specific person or company beyond the domain name — a lead, not a finding.
eso-solution.com
ESO Solutions
Third-party client
Mail only
2014-09-06
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (104.21.45.254, 172.67.221.177)
DMARC: p=quarantine, pct=1, rua=mailto:[email protected] — the exact fingerprint already listed for this domain in data/servers.json
WHOIS
Created 2020-12-01, Dynadot Inc — not previously on record; adding created/registrar here.
Live site
A bare Apache "Index of /" directory listing with no files — consistent with its role as the corporate mail host (server3.gaia-group.co) rather than a public website.
Assessment
Confirms the existing gaia entity; matches data/servers.json's own fingerprint table exactly.
Matches the existing record: created 2004-12-05, Dynadot Inc.
Wayback
Real content from 2006; later entries include a suspended-account page (2025), consistent with mail_only status.
Assessment
Consistent with the existing ghabra entity.
hadeed-mmc.com
Hadeed MMC — steel [email protected] is the official contact address on a 2016 letter signed by Mohammed Hamsho as Chairman of the Syrian Council for Metals and Steel
Industry
Live
2011-12-08
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → 188.40.140.252 (Server B directly, not Cloudflare-proxied); NS → ns5/ns6.gaia-group.co — Gaia's own branded nameservers
Matches the existing record: created 2011-12-08, Dynadot Inc.
Wayback
No snapshots retrieved in this pass.
Assessment
Consistent with the existing hadeed-mmc entity — the direct (non-proxied) Server B IP and Gaia's own nameservers are a slightly tighter operator signal than the Cloudflare-fronted domains elsewhere in this cluster.
hamsho-group.com
Hamsho Group Still a configured vhost with a mail. entry, but no public DNS. Registered two days after sama-holding.com.
Hamsho-named
Not resolving
2018-06-28
Server A
Online research snapshotRetrieved 2026-08-13
DNS
A → none; NS → none; MX → none; TXT → none — no public DNS at all, on 1.1.1.1/8.8.8.8 alike
WHOIS
Matches the existing record: created 2018-06-28, Dynadot Inc.
Live site
Does not resolve — connection fails outright, consistent with status: unresolved.
Assessment
Confirms the existing record. The vhost/mail. entry referenced in the note is server-side configuration invisible from outside; nothing new to add from public DNS or WHOIS.
Matches the existing record: created 2013-07-11, Dynadot Inc.
Wayback
Extensive real content from 2003–2004 (about_a.html, aboutus.html, accessories.html, activities.html) — a genuine, built GSM-handset retail site from that era.
Assessment
Consistent with the existing hamsho-communication entity.
Matches the existing record: created 2006-09-19, Dynadot Inc.
Live site
HTTP 200 with a zero-byte body on both http:// and https:// — a genuinely empty vhost, not an error page. Consistent with status: mail_only.
Assessment
Consistent with the existing jupiter-investment-tourism entity; no new findings.
maak-sy.com
Maak — fuel distribution app, a named Gaia client
Third-party client
Live
2025-09-06
Server A
Online research snapshotRetrieved 2026-08-13
DNS
A (apex) → 65.21.200.112 — Server A itself
NS → ns1/ns2.sama-athletic.com — Gaia's own vanity nameservers (see sama-athletic.com; not an ownership signal)
MX → apex → 65.21.200.112
SPF: v=spf1 +a +mx +ip4:65.21.200.112 ~all
DMARC: p=none
WHOIS
Registered 2025-09-06. Registrar: Dynadot LLC. Registrant redacted under standard privacy.
Live site
Maak (معَك) — a Syrian fuel-delivery app (gas, diesel, fuel tanks) with home delivery, Damascus. Reports 2,067 downloads, 982 customers. Footer: "Powered by Gaia Group" (gaia.sy).
Wayback
Not checked separately — footer credit and live content already confirm the Gaia relationship directly.
Assessment
Genuine consumer delivery app with an explicit Gaia credit — ordinary client.
marcom.sy
Marcom Company — media and marketing Previously observed at sinkhole.paloaltonetworks.com (Palo Alto DNS Security); as of 2026-08-13 resolves normally on three resolvers — the block was network-specific, not a property of the domain.
Consumer
Live
—
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (104.21.50.245, 172.67.215.5) — confirmed on the default resolver, @1.1.1.1, and @8.8.8.8 alike, no sinkhole address on any of them
No public WHOIS — .sy domains generally have none.
Live site
A live, bare Apache "Index of /" directory listing with no files — real content, not an error.
Assessment
This domain resolves normally on three independent public resolvers today — the Palo Alto sinkhole the existing note describes is not reproducing now, which is exactly the network-specific artifact DOMAIN-RESEARCH.md warns about. Either the vendor block has lifted, or it was specific to the network the original observation was made from. Worth updating status away from unresolved if this holds up.
memoict.com
MEMO — electronics Redirects to en/index.php, which currently returns a server error.
Consumer
Dormant
2008-01-13
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (188.114.97.0, 188.114.96.0); NS → Cloudflare
SPF: v=spf1 +a +mx +ip4:188.40.140.252 +ip4:188.40.140.247 ~all — an extra IP (.247) beyond the usual Server B address
DMARC: p=quarantine, pct=1, rua=mailto:[email protected] — the same reporting address the register already tracks as a Server B/Gaia fingerprint
WHOIS
Matches the existing record: created 2008-01-13, Dynadot Inc.
Live site
The root 302-redirects to /en/index.php, which returns HTTP 500 — matches the existing note exactly.
Assessment
Consistent with the existing memo entity. The DMARC rua address is the same [email protected] fingerprint already documented in data/servers.json, reaffirming this domain's place in the shared Server B/Gaia operator infrastructure.
meo-eng.net
MEO Engineering — site erroring/unreachable since at least 2023
Third-party client
Live
2021-11-17
Server A
Online research snapshotRetrieved 2026-08-13
DNS
A → 65.21.200.112 (Server A, direct); NS → Cloudflare
SPF: v=spf1 +a +mx +ip4:65.21.200.112 -all (hard fail, stricter than the ~all used elsewhere)
Matches the existing record: created 2021-11-17, Dynadot Inc.
Live site
No longer erroring — it now serves a proper "scheduled maintenance" holding page ("We'll be back with something amazing shortly"), with an email-signup prompt and Facebook/Twitter/Instagram links.
Assessment
Consistent with the existing third_party/live record, though the site's presentation has moved on from a bare error to an intentional maintenance page since the purpose text was last written — a soft update, not a contradiction.
Matches the existing record: created 2007-11-05, Dynadot Inc.
Live site
https:// fails with Cloudflare 526 (invalid origin certificate); http:// redirects to /cgi-sys/suspendedpage.cgi, a generic hosting-suspended notice — no longer the custom holding page with the Hamsho P.O. Box/fax described in the existing note.
Assessment
Consistent with the existing palmyra-village-resort entity. The holding page the note describes appears to predate the account suspension — worth a Wayback check to confirm it still exists in history.
plainxfashion.com
PlainX Fashion
Third-party client
Mail only
2025-08-02
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (104.21.59.18, 172.67.167.150)
SPF: v=spf1 ip4:188.40.140.252 +a +mx +ip4:159.69.139.89 ~all — includes Server B's own IP directly
No DMARC record
WHOIS
Registered 2022-06-16. Registrar: Dynadot LLC. Registrant redacted under standard privacy.
Live site
Not tested live, consistent with mail_only status.
Wayback
Old snapshots 2011–2016 (redirects, ending in a 403) — a long-dead prior web presence, consistent with the domain now being mail-only.
Assessment
Mail-only client on Server B; historical web content long gone.
royaltobacco.co
Royal Tobacco
Consumer
Mail only
2025-09-01
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (188.114.96.0, 188.114.97.0); NS → Cloudflare
SPF: v=spf1 +mx +a +ip4:188.40.140.252 ~all
DMARC: p=none, rua=dmarc-reports.cloudflare.net (Cloudflare's own default reporting address, not a custom one)
WHOIS
Created 2025-09-01, Dynadot Inc — not previously on record; adding created/registrar here. Much more recent than the rest of the consumer cluster, which mostly dates to 2006–2019.
Live site
A plain Arabic "Under Construction" (الموقع قيد الإنشاء) page with no other content.
Assessment
No entity attached. A recent (September 2025) addition to the Server B consumer cluster, still in the setup stage — worth revisiting once it's built out further.
sah-metaltrading.com
SAH Metal Trading
Industry
Mail only
2022-02-08
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (172.67.147.53, 104.21.47.110); NS → Cloudflare
Matches the existing record: created 2022-02-08, Dynadot Inc.
Live site
HTTP 526 (Cloudflare SSL handshake failure to the origin) — unreachable.
Wayback
Real content from 2023, plus a cpanel subdomain snapshot.
Assessment
No entity currently attached. "SAH" reads plausibly as an initialism, but nothing recovered here identifies the underlying company beyond the domain name.
Matches the existing record: created 2021-09-28, Dynadot Inc.
Assessment
Confirms the existing note: this domain is the vanity-NS host for elmas-invest.com, trixaglobal.com, awtad-albarakeh.com and maak-sy.com in the third_party list, among others.
Registered 2025-01-16. Registrar: Dynadot LLC. Registrant redacted under standard privacy.
Wayback
Real content as recently as January 2025 (homepage plus a cpanel subdomain snapshot) — confirms this was a live, built site well after the "site in preparation" purpose text was written, and well before today's unreachability.
Assessment
The domain was genuinely live within the last two years per Wayback; its current unreachability from this environment specifically cannot be attributed to the domain being down, abandoned, or compromised — that would need checking from an unfiltered network.
Matches the existing record: created 2015-05-12, Dynadot Inc.
Wayback
Real content from 2010 onward, including a directory-listing snapshot as recently as May 2026 — matches the current "empty directory index" note.
Assessment
Consistent with the existing sama-alsham-group entity.
samaalsham.net
Sama Alsham Group — placeholder / under construction Static "Under Construction" page since 2018. A record 188.40.140.248 shares Server B's server3.gaia-group.co reverse-DNS; SPF directly authorises 188.40.140.252 and 176.9.55.34. Registered 2011, predating samaalsham.com by ~4 years.
Sama holding
Live
2011-08-18
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → 188.40.140.248 (adjacent to but distinct from Server B's 188.40.140.252 — same /24, consistent with the existing note)
NS → ns5/ns6.gaia-group.co — Gaia's own branded nameservers, a more direct operator signal than the sama-athletic.com vanity NS used elsewhere
SPF: v=spf1 ip4:188.40.140.252 +a +mx +ip4:176.9.55.34 ~all; also carries a Google Search Console verification TXT record
DMARC: p=none
WHOIS
Matches the existing record: created 2011-08-18, Dynadot Inc.
Wayback
Real content from 2011 onward (arabisque.html, a CMS reference to "SyrianMonster" — the same .sy registrar seen elsewhere in this register).
Assessment
Consistent with the existing sama-alsham-group entity and its already-documented notes.
samapower.com
Sama Power
Sama holding
Mail only
2021-03-16
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (172.67.131.160, 104.21.10.160); NS → Cloudflare
SPF: v=spf1 +mx +a +ip4:188.40.140.252 ~all
No DMARC record
WHOIS
Matches the existing record: created 2021-03-16, Dynadot Inc.
Live site
Redirects to a hosting-provider "account suspended" page — no content.
Wayback
Real content from 2013, predating the current registration.
Assessment
No entity currently attached. See samapower.sy below for a much stronger lead on the same brand.
samapower.sy
Sama Power Registrant Organization on the .sy registry record reads "Hamsho Group" — not privacy-redacted, a direct primary-source link between this domain and the Hamsho name that this register did not previously have.
Sama holding
Mail only
2021-12-28
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (172.67.183.84, 104.21.18.202); NS → Cloudflare
SPF: v=spf1 +mx +a +ip4:188.40.140.252 ~all
No DMARC record
WHOIS
.sy registry record: registered 2021-12-28. Sponsoring Registrar: Syrian Monster. Registrant Organization: "Hamsho Group" — stated directly, not privacy-redacted (the .sy registry doesn't offer the same redaction .com registrations get through Dynadot).
Live site
Account-suspended page — no content beyond a webmaster contact address.
Assessment
This is a primary-source registry record naming "Hamsho Group" as registrant for a domain not previously linked to any entity in this register. Worth promoting to a proper finding: it is a cleaner, more direct ownership signal than most of the DNS/hosting evidence this register otherwise relies on.
scbc.sy
SCBC
Finance
Mail only
—
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (188.114.97.0, 188.114.96.0); NS → Cloudflare
SPF: v=spf1 +mx +a +ip4:188.40.140.252 ~all
DMARC: p=none, rua=dmarc-reports.cloudflare.net
WHOIS
No public WHOIS — .sy domains generally have none.
Live site
A live, bare Apache "Index of /" directory listing with no files.
Assessment
No entity attached. Same SPF fingerprint as the rest of the Server B cluster; no content to identify who runs it.
Created 2008-06-26T08:27:24Z, Dynadot Inc — same batch as the .com pair. Not previously on record; adding created/registrar here.
Live site
https:// fails with Cloudflare 526 (invalid origin certificate); http:// redirects to /cgi-sys/suspendedpage.cgi, the same hosting-suspended notice as its .com siblings.
Assessment
Consistent with the existing sham-aqua-park entity — the third domain in the same registration batch.
A → 188.40.140.252 (Server B, direct — not Cloudflare-proxied); NS → ns5.gaia-group.co / ns6.gaia-group.co, Gaia's own nameservers on Server B
SPF: v=spf1 ip4:188.40.140.252 +a +mx +ip4:176.9.55.34 ~all — the second IP matches ns3/ns4.gaia-group.co per data/servers.json
No DMARC record
WHOIS
Matches the existing record: created 2019-02-16, Dynadot Inc.
Live site
A bare "Under construction" notice, no other content.
Assessment
Notably different from the rest of the consumer cluster: this domain is hosted directly on Server B under Gaia's own nameservers, rather than fronted by Cloudflare — a closer technical tie to Gaia's own infrastructure than most of its consumer-cluster neighbours.
siamco.sy
Siamco Registrant Organization on the .sy registry record reads "adaa motors" — links this otherwise-bare domain directly to adaa-motors.com elsewhere in this register.
Industry
Mail only
2018-05-28
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → 188.40.140.252 (Server B directly); NS → ns5/ns6.gaia-group.co
Not reachable as a distinct page — only Wayback-crawled well-known probe paths, all 404.
Wayback
Real content from 2008.
Assessment
The registrant-name link to Adaa Motors is a genuine, if small, primary-source connection between two previously unrelated bare domains — worth carrying forward if either is investigated further.
sigma-tic.com
Sigma TIC
Industry
Mail only
2025-06-04
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (172.67.128.116, 104.21.2.5); NS → Cloudflare
SPF: v=spf1 +mx +a +ip4:188.40.140.252 ~all
DMARC: p=none, rua → Cloudflare's own aggregator
WHOIS
Matches the existing record: created 2025-06-04, Dynadot Inc.
Live site
A bare cPanel directory listing (cgi-bin/ only) — unbuilt, matching its recent registration.
Wayback
Real content from 2013, predating the current registration by over a decade — a prior, unrelated use of the name.
Assessment
No entity currently attached; too new to have built content yet.
sinalco.sy
Sinalco Syria — soft drinks · سينالكو للمشروبات الغازيةسينالكو سوريا — مشروبات غازية Own /about page names الشركة المتحدة للإستثمارات الصناعية (UCII) as the operating company. SPF directly authorises ip4:188.40.140.252, Server B.صفحة "عن الشركة" الخاصة به تسمّي الشركة المتحدة للاستثمارات الصناعية (UCII) كجهة مشغِّلة. سجل SPF يصرّح مباشرة لعنوان IP 188.40.140.252، الخادم B.
Consumer
Live
—
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → 78.46.0.188 (reverse DNS: dedi2288.your-server.de — a Hetzner dedicated-server hostname, not Server A or B); NS → Cloudflare (not proxied)
SPF: v=spf1 ip4:188.40.140.252 +a +mx +ip4:159.69.139.89 +ip4:52.72.12.188 ~all — authorises Server B for mail, as the existing note says
No DMARC record
WHOIS
No public WHOIS — .sy domains generally have none.
Live site
A live, built WordPress site (with TranslatePress for translation) for Sinalco Syria, branded "consumer trust since 1905" with Facebook/Instagram links. No web-vendor credit visible on the homepage.
Assessment
Confirms the existing ucii entity and live status. New technical detail: the site itself is hosted on a separate Hetzner box (78.46.0.188) distinct from Server A and Server B, while mail routes through Server B via SPF — a third Hetzner address worth keeping in mind if it recurs elsewhere.
smartmoney.sy
Smart Money
Finance
Mail only
—
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (172.67.210.21, 104.21.34.231); NS → Cloudflare
No public WHOIS — .sy domains generally have none.
Live site
A hosting-provider "This Account has been suspended" page, contact [email protected] — the same cPanel-suspension pattern used across the Server B consumer/finance domains, on a .sy TLD.
Assessment
No entity attached. Same shared hosting fingerprint (SPF, suspension-page template) as the rest of the Server B cluster; nothing beyond that to name an operator.
A → Cloudflare-proxied (172.67.163.75, 104.21.34.169); NS → Cloudflare
SPF: v=spf1 +mx +a +ip4:188.40.140.252 ~all
DMARC: p=none, rua → Cloudflare's own aggregator
WHOIS
Matches the existing record: created 2008-03-20, Dynadot Inc.
Wayback
Real content from 2010; later entries are a mix of a suspicious injected script (bUzZckQJT.js, 2025) and routine Cloudflare assets — the injected-looking filename is worth a second look if this domain is revisited.
Assessment
Consistent with the existing syria-metal-industries entity.
A → Cloudflare-proxied (172.67.197.106, 104.21.90.81); NS → Cloudflare
SPF: v=spf1 +mx +a +ip4:188.40.140.252 ~all
No DMARC record
WHOIS
Created 2015-09-08T12:48:40Z, Dynadot Inc — same minute as the other three spellings.
Live site
https:// fails with Cloudflare 526 (invalid origin certificate); http:// redirects to /cgi-sys/suspendedpage.cgi, the same hosting-suspended notice as its siblings.
A hosting-provider "This Account has been suspended" page (Cloudflare email-protected contact link).
Assessment
Consistent with the existing tahweel entity. All four spelling variants (tahweil/ta7weil/tahwiel/ta7wiel) were registered within the same minute, confirming a single coordinated registration of the brand-variant cluster.
Registered 2025-11-06. Registrar: Dynadot Inc. Registrant redacted under standard privacy.
Live site
تأجير (Taajir) — a Syrian multi-category rental app (real estate, vehicles, equipment, clothing). No contact details or vendor credit on the homepage.
Wayback
One snapshot, 2024-09-07 — predates the current 2025-11-06 registration date, meaning the domain likely had a different prior registration; earlier content not investigated further.
Assessment
Ordinary consumer-app client. The pre-registration Wayback snapshot is a minor loose end, not pursued here.
A → 65.21.200.112 (Server A); NS → ns1/ns2.sama-athletic.com
SPF: v=spf1 +a +mx +ip4:65.21.200.112 +ip4:148.251.75.47 +ip4:176.9.55.34 ~all — two Hetzner IPs beyond Server A itself, shared across most of the union-*.com cluster
DMARC: p=none
WHOIS
Matches the existing record: created 2017-01-12, Dynadot Inc.
Wayback
A real 2013 snapshot; later crawl noise (.well-known probes) is not meaningful content.
Assessment
Consistent with the existing union-cables entity — no new findings, DNS/WHOIS confirm what's already on record.
A → 65.21.200.112 (Server A); NS → Cloudflare (adam/brenna.ns.cloudflare.com) — unlike most of the union cluster, this one doesn't use Gaia's vanity NS
SPF: v=spf1 +a +mx +ip4:65.21.200.112~all
DMARC: p=none, rua=mailto:[email protected] — the operator fingerprint already on record
WHOIS
Matches the existing record: created 2017-01-13, Dynadot Inc.
Assessment
Consistent with the existing union-copper entity and its DMARC-to-Gaia finding.
A → 65.21.200.112 (Server A); NS → ns1/ns2.sama-athletic.com
SPF: v=spf1 +ip4:65.21.200.112 +ip4:193.43.149.11 +include:_spf.google.com ~all — a distinct IP (193.43.149.11) and a Google Workspace include not seen on its siblings
DMARC: p=none
WHOIS
Registered 2017-02-01, about two weeks after the main site. Registrar: Dynadot Inc.
Assessment
Consistent with the existing union-electrical-group entity; the extra SPF include suggests this alternate-spelling domain has (or had) its own separately configured mailbox.
Registered 2018-01-23, same day as union-cables.com — the two alternate-spelling registrations were evidently a matched pair.
Assessment
Consistent with the existing union-transformers entity.
unipac-sy.com
Unipac — PET packagingيونيباك — تعبئة وتغليف PET SPF authorises ip4:188.40.140.252 (Server B) directly. Serves only an empty directory index; no archived content found.سجل SPF يصرّح مباشرة لعنوان IP 188.40.140.252 (الخادم B). لا يعرض النطاق سوى فهرس مجلد فارغ؛ لم يُعثر على محتوى مؤرشف.
Industry
Dormant
2018-04-19
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (172.67.158.233, 104.21.90.176); NS → Cloudflare
Matches the existing record: created 2018-04-19, Dynadot Inc.
Wayback
A directory-listing snapshot from 2021 — consistent with the existing note that no real archived content was found.
Assessment
Consistent with the existing unipac entity.
yafouresort.com
Yafour Hotel and Resort · فندق ومنتجع يعفور Currently serves a generic "Coming Soon" template; a real WordPress-based hotel site survives in the Internet Archive from 2012–2021.
Hamsho-named
Dormant
2006-10-10
Server B
Online research snapshotRetrieved 2026-08-13
DNS
A → Cloudflare-proxied (172.67.183.78, 104.21.18.197); NS → Cloudflare
Matches the existing record: created 2006-10-10, Dynadot Inc.
Live site
A generic "Coming Soon" countdown-timer template with no business name or contact details — matches the existing note.
Assessment
Consistent with the existing yafour-resort entity; no new findings from DNS/WHOIS/live site. Archive.org rate-limited every CDX query attempted during this pass, so the 2012–2021 WordPress history the note describes was not re-verified here.