# New Hosts — Full Scan Results
# Date: 2026-09-23

## pharmanet.id (13.250.255.242)

| Service | Details | Access |
|---------|---------|--------|
| FTP (21) | "Welcome to FTP service" | ❌ All creds 530 |
| SSH (22) | OpenSSH 7.4 | publickey only |
| SMTP (25) | b2b.pharmanet.co.id ESMTP Postfix | VRFY: postmaster EXISTS |
| HTTP (80) | Apache "Under Construction" | All paths 200/375B |
| MySQL (3306) | MySQL (version unknown) | Host-blocked (direct + proxy) |

## pharosindonesia.com (54.254.127.168)

| Service | Details | Access |
|---------|---------|--------|
| FTP (21) | vsFTPd 2.0.5 | ❌ All creds 530 |
| SMTP (25) | gsd.pharosindonesia.com ESMTP | Sendmail (252 for all) |
| HTTP (80) | 301 → pharos.co.id (timeout) | — |
| MySQL (3306) | MySQL 5.0.95 | ❌ Access denied (all creds) |
| HTTPS (8443) | Apache CentOS test page | Old SSL (SECLEVEL=1) |

## CVE-2012-2122 (MySQL auth bypass)
- Target: pharosindonesia.com MySQL 5.0.95
- 1000 rapid connections with wrong password
- Result: NOT VULNERABLE (all 1000 failed)

## MySQL via Indonesian proxy
- Both pharosindonesia.com and pharmanet.id
- Proxy tunnel succeeds but MySQL auth still fails
- No host-blocked message via proxy (different behavior)
- But no creds work either

## FTP brute — all failed
- 21 user:password combinations on each host
- All returned 530 (Login incorrect)
- No rate limiting/blocking detected

## SMTP enumeration
- pharmanet.id: postmaster EXISTS (252), all others "Relay access denied"
- pharosindonesia.com: Sendmail, 252 for all users (not informative)
- Neither is open relay

## Internal names revealed
- b2b.pharmanet.co.id (pharmanet.id SMTP banner)
- gsd.pharosindonesia.com (pharosindonesia.com SMTP banner)