MJF Associates, Inc.
A homeowner performance review
Dawson Landing HOA management company review — our opinion of the services visible in this dispute, separated from documented facts below.
Our verdict
Thesis: MJF Associates' faulty reinspection website prevented homeowners from reporting that a cured HOA violation had already been fixed. In our opinion, approximately $430 in fines and interest was retained not because the repair failed, but because MJF claimed it had not been notified — through a portal that did not work under ordinary browser access.
Each category below explains the documented record, our opinion, and supporting sources. Allegations remain disputed unless confirmed by a court or regulatory authority.
How to read the details
This page expands on the rating above. Statements labeled “documented record” are tied to source materials. Conclusions labeled “our opinion” are our interpretation of those records.
MJF Associates and Dawson Landing HOA may dispute these conclusions. Readers should review the linked primary documents and draw their own conclusions.
Evidence and analysis
Five management functions visible in this dispute — expand each section for the record, our opinion, and source documents.
MJF's role in Dawson Landing
Association materials identify MJF Associates, Inc. as the Dawson Landing homeowners association (HOA) management company and managing agent. The records reviewed connect this associate to the architectural-review workflow, reinspection requests, homeowner account statements, and the Association's written complaint process.
This page does not claim that those visible functions are MJF's only contractual duties. The management contract, complete invoices, and full scope of services have not been reviewed here.
1. Inspection and reinspection administration
The contractor invoice records the shutter repair as completed on October 21, 2025—before the stated November 4 correction deadline and November 5 fine start date. The hearing response directed the homeowner to notify MJF and listed http://mjfarb.com/reinspect/ as the 24-hour online reinspection channel.
Testing documented in March 2026 showed that ordinary HTTPS-first navigation did not reach the portal. The site used unencrypted HTTP and required account-related information. The homeowners report that they raised the accessibility and security issues with MJF, the HOA president, and the Board, and supplied a screen recording. The later denial nevertheless relied in part on delayed contact with management and the reinspection instructions.
Where a management company administers a reinspection workflow, that workflow should be secure, accessible under normal browser behavior, and capable of confirming receipt. In our experience, MJF's portal did not meet that standard. Continuing to rely on non-use of that workflow after the physical condition had already been corrected compounded the administrative failure.
2. Billing and account clarity
The June 10, 2026 statement showed a total balance of $960.60. It separately listed a new $265 semiannual dues installment and monthly interest entries, but carried forward an earlier $625 “previous balance” without showing the underlying components. The result did not fully separate ordinary dues from violation fines and interest across the complete account history.
The homeowners requested a ledger itemizing each charge by date, type, and amount, including violation fines, interest or late fees, collection costs, and ordinary dues. The reviewed record does not contain the requested complete ledger.
Billing administration is a basic management function. Owners should be able to identify and pay ordinary dues without guessing how much of a carried balance consists of disputed fines or related interest. MJF's statements and follow-up did not provide that clarity in this case.
3. Legal and homeowner correspondence
Cornerstone Law Group sent a March 23, 2026 demand letter to Dawson Landing HOA c/o MJF Associates, demanding removal of the violation fines. The homeowners later retransmitted the demand and requested governing documents and a complete itemized ledger. No response to the attorney's demand appears in the April or May Board minutes, and the reviewed record contains no substantive written response from MJF to the demand or ledger request.
The Association's AP02 complaint procedure also assigned MJF a specific acknowledgment role. The formal complaint was submitted July 7, 2026; the only documented response was from the HOA president on day eight, rather than the written acknowledgment from MJF described in AP02.
A managing agent serving as the Association's mailing address and complaint contact should reliably acknowledge, route, and track significant correspondence. The lack of a documented MJF acknowledgment or substantive response created uncertainty about whether the demand and records requests were properly handled.
4. Contact access
The MJF contact information located in Dawson Landing HOA materials lists the following published details. We did not locate a publicly listed general MJF email address in those materials.
MJF Associates, Inc.
- 10692-A Crestwood Drive, Manassas, Virginia 20109
- Phone: 703.369.6535 / (703) 369-6535 / 703-369-6535
- Fax: 703.369.9008 / 703-369-9008
- Website: mjfassociatesinc.com
- Reinspection portal:
http://mjfarb.com/reinspect/ - Associated principal (per public listings): Mark Fischer
For a company handling homeowner records, complaints, billing questions, and time-sensitive reinspection requests, a published monitored email address or secure message channel would improve accessibility and create a reliable written record.
5. Personal data security
The reinspection portal at http://mjfarb.com/reinspect/ is the only self-service channel MJF published for stopping the per-day violation charge, and it requests an account number, reference code, and email address. A passive, non-intrusive technical review of that portal's public-facing behavior — no exploitation or unauthorized access attempted — found unencrypted transport and unmaintained server software. Expand below for the technical detail.
Technical findings: server software, encryption, and browser behavior
Server software. The site identifies itself in every response as Apache/2.0.52 HP-UX_Apache-based_Web_Server. The Apache Software Foundation's own published advisory record states the entire 2.0.x branch received its final release in 2013 and is no longer investigated for new security issues. This server runs 2.0.52 — nine point-releases behind even that final 2013 release — meaning it has not received a security patch in roughly two decades.
Apache's own advisory page names version 2.0.52 specifically in the "Affects" field of 40 separate published CVE records (each fixed only in a later 2.0.x release this server never received), plus one additional record for the bundled htdigest utility catalogued by NVD — 41 documented CVEs in total. None were tested or exploited against this server; they are listed here as the vendor's own documented history for this exact software version. Apache's advisory page also states it stopped tracking new issues against this branch after August 2013, so this list likely understates the version's full exposure.
Show the full 41-record CVE list
| CVE | Issue | Severity (Apache's rating) |
|---|---|---|
| CVE-2004-0786 | IPv6 URI parsing heap overflow (bundled apr-util) — remote crash, possible code execution on some BSD systems | Critical |
| CVE-2011-3192 | Range header remote denial of service | Important |
| CVE-2010-0425 | mod_isapi module-unload flaw, potential code execution (Windows/mod_isapi-specific; not applicable to this HP-UX host) | Important |
| CVE-2007-3304 | Signals sent to arbitrary processes (local denial of service) | Important |
| CVE-2006-3747 | mod_rewrite off-by-one error — denial of service, or code execution on vulnerable builds | Important |
| CVE-2005-2700 | mod_ssl SSLVerifyClient bypass (requires TLS in use; not applicable — this host runs no TLS service) | Important |
| CVE-2004-0942 | Remote memory-consumption denial of service via crafted MIME header | Important |
| CVE-2011-0419 | apr_fnmatch / mod_autoindex remote denial of service | Moderate |
| CVE-2011-3368 | mod_proxy reverse-proxy exposure to internal servers | Moderate |
| CVE-2012-0053 | Default error responses can expose "httpOnly" cookies | Moderate |
| CVE-2008-2364 | mod_proxy_http denial of service via excessive interim responses | Moderate |
| CVE-2007-5000 | mod_imagemap cross-site scripting | Moderate |
| CVE-2007-6388 | mod_status cross-site scripting (requires server-status publicly enabled; this review found it returns 403) | Moderate |
| CVE-2006-5752 | mod_status cross-site scripting (requires server-status publicly enabled; this review found it returns 403) | Moderate |
| CVE-2007-1863 | mod_cache proxy denial of service | Moderate |
| CVE-2007-3847 | mod_proxy crash (reverse or forward proxy) | Moderate |
| CVE-2005-3352 | mod_imap Referer cross-site scripting | Moderate |
| CVE-2005-2088 | HTTP request spoofing/smuggling via chunked encoding | Moderate |
| CVE-2005-2728 | Byte-range filter denial of service | Moderate |
| CVE-2004-0885 | mod_ssl SSLCipherSuite restriction bypass (requires TLS in use; not applicable — this host runs no TLS service) | Moderate |
| CVE-2011-3607 | mod_setenvif .htaccess privilege escalation | Low |
| CVE-2012-0031 | Scoreboard parent-process denial of service | Low |
| CVE-2013-1862 | mod_rewrite log escape-sequence filtering | Low |
| CVE-2008-2939 | mod_proxy_ftp globbing cross-site scripting | Low |
| CVE-2009-1891 | mod_deflate denial of service via large-file compression | Low |
| CVE-2009-2412 | Bundled APR apr_palloc heap overflow | Low |
| CVE-2009-3094 | mod_proxy_ftp denial of service (NULL pointer dereference) | Low |
| CVE-2009-3095 | mod_proxy_ftp FTP command injection | Low |
| CVE-2009-3560 | Bundled expat library denial of service | Low |
| CVE-2009-3720 | Bundled expat library denial of service | Low |
| CVE-2010-0434 | mod_headers subrequest header-handling information leak | Low |
| CVE-2010-1452 | mod_cache / mod_dav denial of service | Low |
| CVE-2010-1623 | apr_brigade_split_line denial of service | Low |
| CVE-2008-0005 | mod_proxy_ftp UTF-7 cross-site scripting | Low |
| CVE-2005-3357 | mod_ssl access-control denial of service (requires TLS in use; not applicable — this host runs no TLS service) | Low |
| CVE-2005-1268 | mod_ssl malicious-CRL off-by-one overflow (requires TLS in use; not applicable — this host runs no TLS service) | Low |
| CVE-2005-2491 | Bundled PCRE integer overflow (local .htaccess privilege escalation) | Low |
| CVE-2005-2970 | Worker MPM memory leak denial of service | Low |
| CVE-2004-1834 | mod_disk_cache stores sensitive authentication headers on disk | Low |
| CVE-2005-1344 | Buffer overflow in the bundled htdigest command-line utility (not on Apache's own advisory page; recorded by NVD) | — |
Source: Apache HTTP Server 2.0 vulnerability advisory page (Apache Software Foundation) and the National Vulnerability Database. None of these were independently tested or exploited against MJF's server.
Encryption. The site offers no HTTPS service at all. This is not an expired or mismatched certificate — a direct connection attempt to port 443 times out, indicating no encrypted-transport listener exists on the host. Every form submission, including the account number and reference code, is sent as plain, unencrypted form data.
Browser behavior on ordinary use. The account-number field is coded as a password-type input. Chrome and Safari have flagged password fields on unencrypted pages as "Not Secure" since January 2017 (Chrome 56), and both browsers mark all HTTP pages as "Not Secure" once a user interacts with any field on the page (Chrome 68/70, mid-to-late 2018). Since April 2021 (Chrome 90), typing a bare address into the address bar — ordinary use, not a workaround — causes Chrome to attempt an HTTPS connection first; because this host has no HTTPS listener, that attempt cannot fail quickly and must instead wait out a full connection timeout before falling back to HTTP. Google has separately announced that Chrome's full-page, click-through security warning for HTTP sites ("Always Use Secure Connections") became the default for Enhanced Safe Browsing users in April 2026 and is scheduled to become the default for all Chrome users in October 2026 — meaning a large and growing share of visitors encounter an active warning simply by following the address MJF printed on its own notices.
Sources: Apache Software Foundation's 2.0 vulnerability advisory page; Chromium project's "Marking HTTP As Non-Secure" history; Google's "HTTPS by default" announcement; direct passive review of the live site, July 2026.
Screen recording dated March 2, 2026, documenting the reported HTTPS access issue.
Running unmaintained server software with no encrypted transport to collect account numbers and reference codes from residents is not consistent with reasonable data-handling practice for a company entrusted with an HOA's billing and homeowner records. This is a fair basis to ask the Board whether MJF is an appropriate vendor to continue relying on for these functions, independent of how the underlying violation dispute is resolved. This is not a claim that any specific homeowner's data was intercepted, and it is not a certified security audit — it is an observation drawn from the site's own public-facing behavior.
6. Management cost and contract value
The records reviewed do not establish MJF's annual cost to the Association, the complete scope of its contract, or comparable market pricing. We therefore cannot responsibly state that MJF is overpaid or attribute that conclusion to a Board member.
The documented service problems provide a reasonable basis for owners to ask whether the management contract delivers adequate value. That question should be answered by reviewing the contract, annual payments, service levels, performance standards, and comparable bids.
See the homeowners' request for a management-contract review.
BBB complaint submitted
On July 16, 2026, the homeowners submitted a Better Business Bureau complaint against MJF Associates. The complaint asks for cancellation of the fines, interest, late fees, and related charges associated with violation #123723; a corrected itemized ledger; and written confirmation that no collection action will be based on those charges.
A BBB complaint is a consumer allegation and request for resolution. It is not a BBB finding, government action, or legal judgment.
Our conclusion and requested review
The documented reinspection, billing, and correspondence problems justify a Board review of MJF's performance, contract scope, cost, and corrective-action plan. This conclusion is narrower than saying MJF fails every community it serves; our evidence concerns this dispute and the Dawson Landing records available to us.
We ask the Board to obtain and publish for member review, subject to lawful redactions: the management scope of work, annual amount paid, performance standards, secure-portal remediation plan, billing-itemization practices, correspondence-tracking procedures, and any competitive management proposals.