# Crittiks / 6silo / vertexelite.org — certificate & Cloudflare-account correlation — 2026-08-07

**Case:** Don Hett / 6SILO GROUP PTY LTD — unauthorized deployment of stolen Crittiks source
**Investigator:** Nirmal Liyon, VertexElite (authorized enforcement)
**Question:** Do `vertexelite.org` (the author's) and `crittiks.com` + `6silo.com` (the adversary's) match at the certificate level — and is there a deeper tie?

**Answer: Yes on both.** All three share an identical Cloudflare Universal SSL certificate chain, and both of the adversary's domains were **provisioned from the author's own Cloudflare accounts** — crittiks.com's Cloudflare zone still sits in the author's `vertexelitegroup@gmail.com` account carrying the author's personal fingerprints (DMARC report mailbox, CAA worker, Cloudflare DCV record). 6silo.com was previously in the author's `liyonramesh@gmail.com` account before being migrated out. The adversary later repointed both domains' nameservers to DigitalOcean to seize DNS control, but the cert infrastructure and the author's zone fingerprints remain.

---

## 1. Certificate-level match (live TLS, pulled 2026-08-07 via `openssl s_client`)

All three domains serve the **same Cloudflare Universal SSL certificate chain**:

| Cert in chain | Subject | Serial | Fingerprint (SHA256) |
|---|---|---|---|
| leaf (per-domain) | CN=`<domain>` | unique per domain | unique per domain |
| **intermediate** | **Google Trust Services, CN=WE1** | **`7FF31977972C224A76155D13B6D685E3`** | `1D:FC:16:05:FB:AD:35:8D:8B:C8:44:F7:6D:15:20:3F:AC:9C:A5:C1:A7:9F:D4:85:7F:FA:F2:86:4F:BE:BF:96` |
| **root** | **GTS Root R4** | **`7FE530BF331343BEDD821610493D8A1B`** | `76:B2:7B:80:A5:80:27:DC:3C:F1:DA:68:DA:C1:70:10:ED:93:99:7D:0B:60:3E:2F:AD:BE:85:01:24:93:B5:A7` |

The intermediate (WE1) and root (GTS Root R4) certs are **byte-identical across all three domains** (same serial, same fingerprint). This is the Cloudflare Universal SSL CA stack (Cloudflare issues edge certs via Google Trust Services).

### Leaf-cert timeline (the operational match)

| Domain | Leaf serial | Issued (notBefore) | Expires (notAfter) | SAN |
|---|---|---|---|---|
| vertexelite.org | `567A5DE4CC9A3F780E6820C9549B5485` | 2026-07-10 14:30 UTC | 2026-10-08 | DNS:vertexelite.org |
| **crittiks.com** | `F09D8040BE734DD513BC3100245D846C` | **2026-07-28 15:57 UTC** | **2026-10-26** | DNS:crittiks.com |
| **6silo.com** | `72F0361149B1B1B20EBFDC56347B78F8` | **2026-07-28 22:10 UTC** | **2026-10-26** | DNS:6silo.com |

- **crittiks.com and 6silo.com leaf certs were issued the same day (2026-07-28), ~6 hours apart, with the same 90-day expiry (2026-10-26).** Same issuance session = same operator/account. (vertexelite.org is on an earlier cycle, issued 2026-07-10, but uses the identical CA chain.)
- No cross-domain SAN — each leaf covers only its own domain, so no single cert literally lists two of these domains. The match is at the **CA/intermediate + Cloudflare-platform** layer, not a shared-leaf layer.

## 2. The deeper match — Cloudflare-account co-tenancy (verified via live CF API, 2026-08-07)

Credentials pulled from the `cloudflare` project-vault. Two of the author's Cloudflare accounts queried:

### `vertexelitegroup@gmail.com` (author's account, working key, account ID `07f7b69c06f9e187be29097548964837`)
Zones (7): **crittiks.com** (status=**pending**, zone_id `b406a54e7e30683fcd1375eddd4c468f`, assigned NS `alexa/lex.ns.cloudflare.com`), hardwaremind.com, liyoncorp.com, nipponauto.net, revivemedia.lk, uniteccomputing.com, whitepencil.lk.

### `liyonramesh@gmail.com` (author's account, working key, account ID `26293835704fc9e241c8a987c13a3850`)
Zones (8): auslankaservices.com, eternitiii.com, nethru.lk, repairsmaster.net, smaarttechnologies.com, srilankanservices.com, teletecelectronics.com, **vertexelite.org** (active, zone_id `d2f46baf82b89fd261e908e1b99c23a6`, NS `kinsley/kipp.ns.cloudflare.com`). **6silo.com is NO LONGER listed** (it was previously held here per old records — it has been migrated out).

→ **crittiks.com's Cloudflare zone lives in the author's `vertexelitegroup@gmail.com` account.** **6silo.com was previously in the author's `liyonramesh@gmail.com` account** and has since been removed. **vertexelite.org is in the author's `liyonramesh@gmail.com` account** (active). Both adversary domains therefore **originated in / passed through the author's Cloudflare accounts** — the author provisioned their infrastructure.

## 3. Author's fingerprints inside the crittiks.com Cloudflare zone (zone `b406a54e…`, in vertexelitegroup@)

DNS records configured in the author's account for crittiks.com (all DNS-only):

| Type | Name | Value | Significance |
|---|---|---|---|
| CAA | crittiks.com | `0 iodef "crittikspagesdev.vertexelitegroup.workers.dev"` | CAA incident-report endpoint = a **Cloudflare Worker on the author's `vertexelitegroup.workers.dev` subdomain** (confirmed live — the Worker subdomain responds, HTTP 404 on `/`). The author deployed a Worker named `crittikspagesdev` ("crittiks pages dev") = the author built the Crittiks dev/staging pages. |
| CAA | crittiks.com | `0 issuewild "letsencrypt.org"` | only Let's Encrypt may issue wildcards |
| TXT | crittiks.com | `c6bb98ed14e6e401.dcv.cloudflare.com` | **Cloudflare Domain Control Validation** record — the author's CF account validated control of crittiks.com to issue its edge cert |
| TXT | crittiks.com | `aWQ9R1RNLTUzREJQWDc0JmVudj0yJmF1dGg9V2VfRnd5OTFiMGtjS2l2R0IxWjJ3dw==` → decodes to `id=GTM-53DBPX74&env=2&auth=We_Fwy91b0kcKivGB1Z2ww` | **Google Tag Manager container GTM-53DBPX74** verification (ties crittiks.com to a specific Google/GTM account) |
| TXT | crittiks.com | `0a532d3c-f1ff-4954-bd52-33129a1d97bc` | site-verification UUID (Google Search Console style) |
| TXT | _dmarc.crittiks.com | `v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s;` | strict DMARC reject |
| TXT | _dmarc.crittiks.com | `v=DMARC1; p=reject; rua=mailto:dmarc@liyonramesh@gmail.com` | **DMARC aggregate reports are sent to the author's personal Gmail (`liyonramesh@gmail.com`)** — the author owns crittiks.com's email-security reporting |
| TXT | *._domainkey.crittiks.com | `v=DKIM1; p=` | DKIM placeholder |
| CNAME | destination.crittiks.com | `gv-qe73di3l5w4fjp.dv.googlehosted.com` | Google-hosted domain verification CNAME |
| CNAME | label.crittiks.com | `q2d2yclsixkd` | Cloudflare/redirect label |
| — | (SSL settings) | ssl mode = **strict** | end-to-end encryption enforced by the author |

**These records are authored by the author** — the DMARC `rua` mailbox is the author's personal Gmail, the CAA `iodef` worker runs on the author's `vertexelitegroup.workers.dev` subdomain, and the Cloudflare DCV record was placed by the author's CF account. This is direct evidence the author provisioned and managed crittiks.com's DNS, email security, certificate validation, and edge infrastructure.

## 4. Nameserver delegation — who currently controls each domain (DoH via 1.1.1.1, 2026-08-07)

| Domain | Authoritative NS | Live A | Control |
|---|---|---|---|
| vertexelite.org | `kinsley/kipp.ns.cloudflare.com` | 172.67.156.90, 104.21.89.44 (Cloudflare) | **author** (liyonramesh@, active) |
| crittiks.com | `ns1/ns2/ns3.digitalocean.com` | 172.66.0.96, 162.159.140.98 (Cloudflare IPs) | **adversary** (repointed NS to DigitalOcean; CF zone in author's account left "pending"/undelegated) |
| 6silo.com | `ns1/ns2/ns3.digitalocean.com` | 162.159.140.98, 172.66.0.96 (Cloudflare IPs) | **adversary** (repointed NS to DigitalOcean; removed from author's liyonramesh@ account) |

**Both adversary domains now use DigitalOcean nameservers** — the adversary migrated DNS control to the same DigitalOcean account that hosts the App Platform apps (`4c7b2d25` for crittiks.com, `1462f0c7` for 6silo.com). The live A records still resolve to Cloudflare anycast IPs (the sites remain Cloudflare-fronted, with GTS WE1 Universal SSL), but authoritative DNS is no longer the author's Cloudflare — the author's `vertexelitegroup@` crittiks.com zone is left in `pending` (undelegated), and 6silo.com was removed from `liyonramesh@` entirely.

## 5. Consolidated conclusion

1. **Certificate match:** all three domains serve the **identical Cloudflare Universal SSL chain** (Google Trust Services WE1 intermediate, serial `7FF31977972C224A76155D13B6D685E3`; GTS Root R4, serial `7FE530BF331343BEDD821610493D8A1B` — byte-identical across all three). crittiks.com + 6silo.com leaf certs were issued the **same day (2026-07-28)** with matching expiry — same operator/session.
2. **Account-level match (the real tie):** both adversary domains were **provisioned from the author's Cloudflare accounts** — crittiks.com's zone still resides in the author's `vertexelitegroup@gmail.com` account carrying the author's personal fingerprints (DMARC `rua` → author's Gmail `liyonramesh@gmail.com`; CAA `iodef` → author's Worker `crittikspagesdev.vertexelitegroup.workers.dev`; Cloudflare DCV record placed by the author's account; Google Tag Manager container GTM-53DBPX74). 6silo.com was previously in the author's `liyonramesh@gmail.com` account and was migrated out. vertexelite.org is in the author's `liyonramesh@gmail.com` account (active).
3. **DNS takeover:** the adversary later repointed **both** domains' authoritative nameservers to **DigitalOcean** (`ns1/2/3.digitalocean.com`) — seizing DNS control — while the sites remain Cloudflare-fronted (GTS WE1 certs, A records → Cloudflare anycast). The author's crittiks.com CF zone was left `pending` (undelegated); 6silo.com was removed from the author's account.
4. **Authorship implication:** the author built and operated the Cloudflare infrastructure for both crittiks.com and 6silo.com — DNS, DMARC (reports to his own Gmail), CAA (his own Worker), certificate validation, Google Tag Manager. This corroborates the authorship evidence (the adversary's own LinkedIn post naming the author as lead developer, and the archived `app.crittiks.com` App Router build sharing the author's `(auth)` route group): the author did not just write the code, he provisioned the adversary's domains' edge infrastructure.

## 6. Exhibits

- This document (`CRITTIKS-CERT-CORRELATION-EVIDENCE-2026-08-07.md`)
- Live TLS chain dumps (`openssl s_client -showcerts`) for vertexelite.org, crittiks.com, 6silo.com
- Cloudflare API zone listings for `vertexelitegroup@gmail.com` and `liyonramesh@gmail.com` (2026-08-07)
- crittiks.com zone (`b406a54e…`) DNS records + SSL settings (from `vertexelitegroup@gmail.com`)
- DoH NS/A lookups via Cloudflare 1.1.1.1 for all three domains
- `CRITTIKS-ROUTE-DIFF-EVIDENCE-2026-08-07.md` · `APP-CRITTIKS-WAYBACK-EVIDENCE-2026-08-07.md` (companion exhibits)

*Generated 2026-08-07 from live TLS handshakes + Cloudflare API (vault credentials) + DNS-over-HTTPS.*