# DNS Recon Complete — PharmaLink / Innopharm
# Date: 2026-09-07

## Subdomains Found (crt.sh)

| Subdomain | IP | Notes |
|-----------|-----|-------|
| api.pharmalink.id | 34.126.145.28 | Shared |
| apps.pharmalink.id | 54.251.28.144 | AWS |
| api.chc.pharmalink.id | 34.87.167.47 | GCP |
| api.cfu.pharmalink.id | 34.126.145.28 | Shared |
| staging-api.chc.pharmalink.id | 35.187.252.87 | GCP |
| staging-apps.pharmalink.id | 18.140.103.153 | AWS |
| staging-automation.pharmalink.id | 34.143.202.81 | GCP |
| sentry.pharmalink.id | 34.143.136.252 | GCP |
| rnd.pharmalink.id | 34.126.145.28 | Shared |
| personalia.pharmalink.id | 34.143.157.84 | GCP |
| pharos.pharmalink.id | 34.126.159.226 | Vault |
| pabrik.pharmalink.id | — | No A record |
| chatwoot.chc.pharmalink.id | 34.87.167.47 | GCP |
| jitsi.chc.pharmalink.id | 34.50.65.188 | GCP |
| vault-jx.chc.pharmalink.id | 34.87.167.47 | GCP |
| virtue.pharmalink.id | 34.126.145.28 | Shared |
| hello.pharmalink.id | 34.126.145.28 | Shared |
| temp-api.cfu.pharmalink.id | 34.126.145.28 | Shared |
| api-vn.pharmalink.id | — | No A record |
| logistic-vn.pharmalink.id | — | No A record |
| pos-vn.pharmalink.id | — | No A record |
| purchasing-vn.pharmalink.id | — | No A record |

## IP Ranges

| Range | Owner | Usage |
|-------|-------|-------|
| 34.126.145.0/24 | GCP | Shared hosting |
| 34.87.167.0/24 | GCP | CHC cluster |
| 34.143.202.0/24 | GCP | Main/Automation |
| 34.143.157.0/24 | GCP | Personalia |
| 34.143.136.0/24 | GCP | Sentry |
| 34.126.159.0/24 | GCP | Vault/Pharos |
| 34.126.103.0/24 | GCP | CFU |
| 34.50.65.0/24 | GCP | Jitsi |
| 35.187.252.0/24 | GCP | Staging API |
| 35.247.168.0/24 | GCP | GitLab (DEAD) |
| 54.251.28.0/24 | AWS | Apps |
| 18.140.103.0/24 | AWS | Staging Apps |
| 13.250.197.0/24 | AWS | prog2 (our access) |
| 52.74.0.0/24 | AWS | Apotek Century |

## Shodan Queries (manual)

```
pharmalink.id
pharmanet.id
34.126.145.0/24
34.87.167.0/24
34.143.202.0/24
34.143.157.0/24
34.143.136.0/24
34.126.159.0/24
34.126.103.0/24
34.50.65.0/24
35.187.252.0/24
35.247.168.0/24
54.251.28.0/24
18.140.103.0/24
13.250.197.0/24
```

## Interesting Targets

| Target | Why |
|--------|-----|
| sentry.pharmalink.id | Error tracking → may leak creds |
| staging-* | Usually less secure |
| vault-jx.chc | Vault staging |
| chatwoot.chc | Chat logs |
| jitsi.chc | Video conf |
| pabrik.pharmalink.id | Factory (no DNS — check directly) |

## Next Steps

1. Port scan key IPs (nmap)
2. Shodan search for open services
3. Check staging environments
4. Sentry for credential leaks