HIGH · epc

Engineers India Limited

2026-10-05 passive check: HTTP 200; TLS expires 2026-10-23; 1 headers absent on observed response.

engineersindia.combaseline scan 2026-04-27 · daily passive check 2026-10-05 · historical phase 2 assessment 2026-04-28

Daily passive check · 2026-10-05

score 56

Availability

HTTP 200

TLS

2026-10-23 · 18d

Headers

1 missing · 1 permissive

Email auth

SPF missing · DMARC absent

38

Baseline score · 2026-04-27

Elevated

Historical findings · 2026-04-27

  • 01Public directory listing on /wp-content/uploads/cache/2019/01/CPP-ANGUL-SMELTER_full/ — Google-indexed, project documents exposed
  • 02Apache 2.4.29 EOL (current is 2.4.64)
  • 03No SPF, no DMARC — both entirely absent
  • 04Missing CSP

Current · time-bound actions

  • 18d to expiryRenew the currently observed TLS certificate before expiry2026-10-23

TLS security

warn

Issuer
DigiCert Inc
Expires
2026-10-23(18d)

certificate expires in 18 days

Email authentication

SPF
missing
DKIM
missing
DMARC
absent

Hardening headers

4 / 1 / 1present/permissive/missing

  • HSTSpresent
  • CSPpermissive
  • X-Framepresent
  • X-Content-Typepresent
  • Referrer-Policypresent
  • Permissions-Policymissing

Lookalike domains

  • engineersindia.net→ 198.49.23.145 (third-party)
  • engineers-india.com→ 72.1.241.142 (third-party)
  • engineersindia.in→ 104.21.3.133 (Cloudflare, third-party)

Public topology · CT logs

1 total · 1 sensitive

engineersindia.com
Document mgmt
  • /wp-content/uploads/cache/2019/01/CPP-ANGUL-SMELTER_full/

Certificate-transparency logs are immutable and public. Sensitive subdomains advertised here cannot be retracted; the mitigation is forward-only — new internal services route through a private CA that does not submit to public CT.

Historical active assessment · 2026-04-28 · open archive

Historical phase 2 assessment · 2026-04-28

This assessment is preserved as a dated record. Its attack paths and patch deadlines are not current findings; use the daily passive check above for current TLS, headers, availability, and email authentication.

Historical question from 2026-04-28

Can EIL implement SPF/DMARC and CSP headers, and submit a Google de-index request, before the next spear-phishing campaign uses cached project filenames as lures?

Active fingerprints · per host

  • engineersindia.comEOL × 4

    ASP.NET Core (HTTP/2)

    • ⚠ CSP MISSING (CRITICAL)
    • ⚠ SPF and DMARC entirely absent — open spoofing surface
    • ⚠ Apache 2.4.29 EOL on legacy edge (if still in stack)
    • ⚠ Directory listing /wp-content/uploads/cache/2019/01/CPP-ANGUL-SMELTER_full/ Google-indexed

Attack-path simulation

Mythos-class adversary analytical chain · paths ranked by exploitability × access value.

#1

Path A: Email spoofing via missing SPF/DMARC

effort hours
detect low (bad)
Entry
No SPF, no DMARC. Spoofed @engineersindia.com with no policy enforcement.
Pivot
Executive clicks phishing link → credentials harvested.
Objective
Initial compromise; lateral move via trust.
#2

Path B: Typosquat + spoofed domain

effort hours
detect low (bad)
Entry
Register eil-engineering-india.com or similar.
Pivot
Send spoofed mail; SPF absence = pass; high-trust exploitation.
Objective
Credential harvest; partner-network compromise.
#2

Path C: Cached document lure

effort days
detect medium
Entry
Google Cache may still show CPP-Angul-Smelter PDF filenames despite directory now redirecting.
Pivot
Craft identical-looking memo (Design Review Q1 2026); email technical staff; RAT deployment on click.
Objective
Supply-chain intelligence + credential theft.
#2

Path D: Apache 2.4.29 unpatched CVEs (if still serving)

effort days
detect medium
Entry
If Apache 2.4.29 remains on the stack, CVE-2024-47252 / CVE-2024-43204 / CVE-2024-42516 apply.
Pivot
TLS 1.3 access bypass; mod_rewrite SSRF; mod_proxy SSRF.
Objective
Server-side data access; internal pivot.

Mythos compression

Discovery-time compression: pre-AI adversary vs Mythos-class adversary, per attack path.

Path A · Email spoofing via missing SPF/DMARC
factor ~3–5×
pre-AI
Missing SPF/DMARC + cached governance doc filenames → credential compromise + supply-chain intel exfil
Mythos
AI-augmented attacker auto-correlates cached filenames with current project cycles and crafts indistinguishable lures
Path C · Cached document lure
factor ~5–7×
pre-AI
Manual lure crafting from cached document index
Mythos
Cached document index becomes a phishing-template generator

The compression factor is reasoned, not measured. Mythos-class capability changes the tempo of attack-path traversal; the topology of the chain is unchanged.

Historical patch list · 2026-04-28

Tier 1 · within 7 days

  • critical

    Implement SPF record (hard -all)

    Host
    engineersindia.com
    Fix
    Publish: v=spf1 include:_spf.<actual mail provider> -all. Audit mail provider; align before enforcement.
    Owner
    IT / Email Security
    Validation
    dig +short TXT engineersindia.com | grep v=spf1
  • critical

    Implement DMARC p=quarantine → p=reject after 30 days

    Host
    engineersindia.com
    Fix
    Publish DMARC with rua=. Monitor 30 days; promote to p=reject.
    Owner
    IT / Email Security
    Validation
    dig +short TXT _dmarc.engineersindia.com returns DMARC1
  • critical

    Add CSP header (currently missing)

    Host
    engineersindia.com
    Fix
    default-src 'self'; script-src 'self' 'nonce-{random}'; object-src 'none'; upgrade-insecure-requests.
    Owner
    Frontend / Security
    Validation
    curl -i shows Content-Security-Policy header
  • critical

    Disable directory indexing on /wp-content/uploads/

    Host
    engineersindia.com
    Fix
    .htaccess: Options -Indexes. Verify all subdirectories.
    Owner
    Web Ops
    Validation
    curl /wp-content/uploads/ returns 403

Tier 2 · within 30 days

  • high

    Submit Google Search Console de-index request for cached cache/* paths

    Host
    engineersindia.com
    Fix
    GSC → Removals → submit /wp-content/uploads/cache/*. Add robots.txt block to prevent re-index.
    Owner
    Web Ops / SEO
    Validation
    site:engineersindia.com/wp-content/uploads/cache returns 0 results within 30 days
  • high

    Audit and upgrade WordPress / plugins / Apache

    Host
    engineersindia.com
    CVE
    CVE-2024-47252 (Apache 2.4.x)
    Fix
    wp-cli: wp plugin list --update=available. Apply updates. Apache to 2.4.62+ if 2.4.29 still present. Test in staging.
    Owner
    Web Ops
    Validation
    Apache 2.4.62+ in headers; wp plugin status all-current
  • high

    Deploy WAF — block directory traversal, SQLi, WP exploit patterns

    Host
    engineersindia.com
    Fix
    Cloudflare or ModSecurity OWASP CRS.
    Owner
    Security / WAF
    Validation
    ../../../etc/passwd payload returns 403
  • high

    Implement DKIM signing for outbound mail

    Host
    engineersindia.com
    Fix
    Mail server config: enable DKIM signing. Publish public key in DNS.
    Owner
    Email Security
    Validation
    Test email shows DKIM-Signature: pass in headers

Methodology is reproducible by any visitor with curl, dig, and openssl. Passive checks record observed HTTP, TLS, header, and DNS state, not proof of exploitation. Historical active assessments are dated and are not current operational guidance.

Sibling: Sanjaya — fuel data on the same Ministry portfolio. Sanjaya tracks energy data; Sanket tracks public security observations.