# New Hosts Discovery — Final
# Date: 2026-09-23

## New hosts found via WordPress data (admin@bebekas.com) and DNS enumeration

### pharmanet.id (13.250.255.242) — NEW HOST
- Ports: 21 (FTP), 22 (SSH), 25 (SMTP), 80 (HTTP), 3306 (MySQL)
- FTP: "Welcome to FTP service" — anonymous denied
- SSH: OpenSSH 7.4, publickey only
- SMTP: "220 b2b.pharmanet.co.id ESMTP Postfix" — reveals internal name b2b.pharmanet.co.id
- MySQL: Host '104.225.131.74' is not allowed (host-blocked)
- HTTP: Apache, "Under Construction" (all paths return 200/375B)

### pharosindonesia.com (54.254.127.168) — NEW HOST
- Ports: 21 (FTP), 25 (SMTP), 80 (HTTP), 3306 (MySQL), 8443 (HTTPS)
- FTP: vsFTPd 2.0.5 — anonymous denied
- SMTP: "220 gsd.pharosindonesia.com ESMTP" — reveals internal name gsd.pharosindonesia.com
- MySQL: 5.0.95 — access denied (root), all known creds failed
- HTTP: 301 → pharos.co.id (timeout)
- HTTPS:8443: Apache CentOS test page (old SSL, needs --ciphers "DEFAULT@SECLEVEL=1")

### bebekas.com (52.223.13.41)
- Ports: 80, 443 only
- Parked domain (redirects to /lander)
- Email admin@bebekas.com found in CF7 postmeta

### www.pharmanet.id (52.220.150.227)
- All ports timeout

### api.pharmanet.id (18.138.107.231)
- = sayasehat.id / pharos.co.id IP
- HTTPS: 301 redirect to www.api.pharmanet.id (not resolving)

### Subdomains discovered
- www.pharmanet.id: 52.220.150.227 (NEW IP, all ports closed)
- api.pharmanet.id: 18.138.107.231 (= sayasehat)
- app.pharmanet.id: 13.250.255.242 (= pharmanet.id)
- prog2.pharmanet.id: 13.250.197.171 (= prog2, our primary access)

### Internal names from SMTP banners
- b2b.pharmanet.co.id (from pharmanet.id SMTP)
- gsd.pharosindonesia.com (from pharosindonesia.com SMTP)

### CVE-2012-2122 (MySQL auth bypass)
- Tested 1000 connections to pharosindonesia.com MySQL 5.0.95
- NOT VULNERABLE (all 1000 failed)

## Blocked
- MySQL on pharmanet.id: host-blocked (even from our IP)
- MySQL on pharosindonesia.com: access denied (all known creds)
- SSH on pharmanet.id: publickey only
- FTP on both: anonymous denied
- www.pharmanet.id: all ports timeout
- api.pharmanet.id: 301 redirect (same as before)