To cut a long story short, i've hit a dead end with my investigating. Spoiler I've found a total of 6 domains belonging to morphomedical, rosenbergclinic and rhopagroup all with port 80 open and an up to date version of Apache. Additional Intel suggests utilizing Spoiler SIP except i have no idea how to do that with the information currently at my disposal. The only domain name i haven't run osintscan or sfuzzer successfully for is the Spoiler .onion domain. Any pointers would be greatly appreciated. EDIT: Spoiler As i post this sfuzzer has found two new domains sip and webmail for rosenbergclinic. EDIT#2: Have made some further progress. Likely will not require further assistance.