During the information gathering phase I found that there is another domain pointing to the same IP that I'm auditing. The first one, "www.domain.com", is using TLS whereas the second one, "www-org.domain.com", isn't. The two domains offer the same funcionality. Is there any purpose of having the second domain?
One of the reasons could be that some old system needs to operate with the one that don't have TLS support, but nowadays is a it strange that you don't have TLS support on the client
I have a similar scenario explaining why this could occur (And no, there is not a reason to have an unsecured domain other than maybe supporting a really old un-updatable client or making it insecure on purpose). Here is the story behind it how it ended having different domains and only 1 with SSL:
I used to work for a software factory. I developed an eCommerce for a client. We needed to have it running before a particular day. We got everything running, but HTTPS was still not configured (at least, the credit card payment was done in a redirected external system over HTTPS, so no credit cards could be captured...well, maybe phished). The client bought 2 new domains for the new eCommerce, and after some time we pointed the domain from it's old eCommerce to the new one (so it ended with more than one domain). We were going to add HTTPS on the second phase of the development, but our company broke and we could never do this.
After some time, a co-worker started freelancing for this client, and they needed to make available an HTTPS endpoint so other external system could send requests (updating stock or something similar) and it would refuse a non HTTPS connection. So I helped him setting SSL on one of the domains. The other domains didn't get an SSL certificate because the freelancer was already working a lot extra unpaid hours and hadn't enough time to set up everything correctly.
We advised the client that they really should secure all connections, but they unfortunately prioritized other things.
So the site has a domain with SSL and another domains without it (with the same exact functionality)
Finally, they have fixed the situation. There was also another domain without TLS "www-orgf5.domain.com" that was related to the F5 BIG_IP load balancer. They haven't told me the purpose of the domains but now when you try to access them you get redirected to "www.domain.com" so I conclude that these domains were not supposed to be there (which was the main purpose of the question).