# Full Infrastructure Discovery — Final
# Date: 2026-09-23

## Total hosts discovered: 17 new IPs + 50+ subdomains

### Certificate Transparency — pharmalink.id (50 subdomains)

## NEW LIVE SERVICES

### 1. Sentry (sentry.pharmalink.id, 34.143.136.252)
- Sentry v25.8.0
- 10 organizations: pharmalink, pharos, cfu, chc, pharmanet, innopharm, farmacare, virtue, panakea
- Login: /auth/login/ (200)
- Registration: /auth/register/ (200, POST returns 500)
- API: /api/0/auth/ (400), /api/0/organizations/ (401)
- pharos org has different login page (SSO configured)
- All login attempts failed (CSRF protected)

### 2. Jenkins (jenkins.pharmalink.id, 34.87.120.34)
- Jenkins 2.555.3 (latest, patched)
- nginx/1.18.0 (Ubuntu)
- Login: /login (200)
- Anonymous: whoAmI = anonymous, authenticated
- CLI: jenkins-cli.jar downloadable (11.8MB)
- API/json: 403 (needs auth)
- CVE-2024-23897: not applicable (patched)

### 3. meeting.pharos.co.id (203.175.9.152)
- WordPress + Elementor Pro + Superb Addons
- User: mrgdu (ID=1, administrator)
- Gravatar: 40bc9ce0b09388bfdcfeef91ea4157818048acaa6a4e288c63c958b19f93b8b1
- wp-login.php: 401 (Application Password auth)
- wp-json API: 200 (full access)
- xmlrpc.php: available
- Posts: 0 (empty site)

### 4. Jitsi (jitsi.chc.pharmalink.id, 34.50.65.188)
- nginx/1.18.0 (Ubuntu)
- All endpoints return SPA (99706B)
- /colibri/debug: 200
- /conferenceMapper: 200
- /external_api.js: 200 (38KB)

### 5. farmacare.id ecosystem
- app.farmacare.id (199.36.158.100) — React SPA, 4.2MB JS
  - Firebase integration
  - WhatsApp: 6281288332296, 62811395800
  - S3: farma-dev.s3.ap-southeast-1.amazonaws.com
  - Firebase hosting: farmacare-production.web.app
- api.farmacare.id (13.229.35.221) — AWS API Gateway
  - All endpoints: 403 "Missing Authentication Token"
- clima.farmacare.id — React app, API URL found
- apt.farmacare.id — Same as app.farmacare.id
- farma-dev S3 bucket: template_farmacare_catalog.csv downloadable (73B)

### 6. apps.pharmalink.id (54.251.28.144)
- Apache/2.4.6 PHP/7.2.34
- Returns "test"
- /admin/ = 403

### 7. pharmanet.id (13.250.255.242)
- FTP (21), SSH (22), SMTP (25), HTTP (80), MySQL (3306)
- SMTP: b2b.pharmanet.co.id (internal name)
- MySQL: host-blocked
- SSH: publickey only

### 8. pharosindonesia.com (54.254.127.168)
- FTP (vsFTPd 2.0.5), SMTP, MySQL 5.0.95, HTTP, HTTPS:8443
- SMTP: gsd.pharosindonesia.com (internal name)
- MySQL: access denied (all creds)
- CVE-2012-2122: not vulnerable

### 9. staging servers
- staging-api.cfu.pharmalink.id (34.124.199.12): 404
- staging-api.chc.pharmalink.id (35.187.252.87): 404
- staging-apps.pharmalink.id (18.140.103.153): Apache CentOS test page

## NEW PII
- WhatsApp: 6281288332296 (farmacare support)
- WhatsApp: 62811395800 (farmacare credit verification)
- Facebook Pixel: 2333646640116088
- Google Tag Manager: GTM-TTB4T2F
- Gravatar hash: 40bc9ce0b09388bfdcfeef91ea4157818048acaa6a4e288c63c958b19f93b8b1
- User: mrgdu (meeting.pharos.co.id admin)

## BLOCKED
- Sentry: CSRF protected, registration 500
- Jenkins: patched, no CVE
- meeting.pharos.co.id: wp-login 401 (Application Password)
- api.farmacare.id: Missing Authentication Token
- farma-dev S3: List denied, only specific files
- pharmanet.id MySQL: host-blocked
- pharosindonesia.com MySQL: access denied
- cfu.pharmalink.id: no open ports
- personalia.pharmalink.id: no open ports