# sayasehat + WordPress — Full Analysis
# Date: 2026-09-21

## sayasehat / sayasehat3 — Health Portal (Indonesia)

### What is it
sayaSehat ("I am Healthy") — Indonesian health portal operated by
**VP Digital** (vp-digital.com), developed by **Unictive** (unictive.com).

- Contact: info@unictive.com, 0815 1915 3333
- Social media: Facebook (sayasehatid), Twitter (@sayasehatid), Instagram (@sayasehat.id)
- Provinces covered: DKI Jakarta, Jawa Barat, Jawa Tengah, Jawa Timur
- Point system: 300 points for registration
- Privilege levels: Contributor, Author, Community, Super Admin, External Content Manager

### Databases
- **sayasehat** — original (2016), 44 tables
- **sayasehat3** — newer version, 47 tables
- Both hosted on prog2.pharmanet.id (13.250.197.171)

### Admin Accounts (admin_tb) — MD5 unsalted — ALL CRACKED

| Username | Name | MD5 Hash | Password | Status |
|----------|------|----------|----------|--------|
| admin | Dr. Frans Suny Herry | 3f1f27850ba9aff3d9437afb4841389a | NOT CRACKED | Active |
| **pharos** | Pharos Admin | 7a37a8413bde3f55a8cc4d488124b1cc | **pharospharos** | Active |
| **agency_external** | (external content) | 81b679ba47a8b98c72e884a6bb18a11c | **sayasehat333** | Active |
| **mis** | (superadmin) | e10adc3949ba59abbe56e057f20f883e | **123456** | Active |

3 of 4 admin accounts cracked. admin (Dr. Frans Suny Herry) needs hashcat.

### Community Users — PII + MD5

- sayasehat: 94 users with MD5 passwords, full names, emails, phones, DOBs
- sayasehat3: 102 users (same + additional)
- Total unique: ~111 users with PII
- Many real Indonesian names, phones, emails (Gmail, Yahoo)
- Some test accounts (kampretz, asdf, gsg)
- Facebook/Twitter OAuth IDs stored for some users

### Notable users
- sunfrans (Frans Suny) — frans.suny@gmail.com — likely the admin/developer
- victor (Victor Kurnia) — vic.050487@gmail.com — developer
- stanley (Stanley Audrey) — stanley@unictive.com — Unictive employee
- natassya — natassya@vp-digital.com — VP Digital employee
- anisa — nurul.annisa@vp-digital.com — VP Digital employee
- marjuky — Marjuky CH — marjukych@rocketmail.com

### Consultations (konsultasi_tb)
Health Q&A between community users and doctors:
- "Kenapa saya sering mengantuk di pagi hari?" (Why am I sleepy in the morning?)
- "Electrical muscle stimulation" (weight loss question)
- "Resesi Gingiva" (dental gum recession)
- Answered by: agency_external (Pharos content team)

### Newsletter subscribers: 13 emails
### Mailbox messages: 10 messages
### Article tracking: 938K article views logged

### Session data (akucantik_sessions)
2,930 sessions with:
- IP addresses (Indonesian ISPs)
- User agents (mobile devices — Android, Chrome)
- Session IDs (MD5)
- "akucantik" = "I am beautiful" — possibly rebranded from beauty portal

## u8182940_wpni213 — WordPress (Vitropic Forte)

### What is it
WordPress site for **Vitropic Forte** — a pharmaceutical product website.
- URL: https://vitropic.co.id
- Admin: admin@vitropic.co.id
- Theme: Betheme v15.8
- Previous theme: niagafinance (1.0.0)

### Plugins (10 active)
1. LayerSlider (v6.0.5)
2. Addon Elements for Elementor Page Builder
3. All-in-One WP Security and Firewall (v4.3.2)
4. Contact Form 7
5. Elementor
6. Akismet (v4.0.1)
7-10. (4 more plugins)

### Admin account
- user_login: admin
- user_pass: $P$B20rPWUFOndlAedeP0fnZ95hSaKvhz/ (phpass)
- user_email: admin@vitropic.co.id
- Role: administrator (level 10)

### Security posture
- All-in-One WP Security plugin installed
- 1,608,574 failed login attempts logged (brute-force protection active)
- Top brute-force IPs: 92.223.85.238 (81K), 70.37.98.239 (59K), 20.51.216.105 (32K)
- users_can_register: 0 (registration disabled)

### Content
- "Hello world!" (default WordPress post)
- Sample Page, Contact Form, Homepage Example, News
- Services: Strategic Planning, Taxes Planning
- Images: singapore-river, circle, venox, quest, geo, madrin, digit, mapmaster, masso, snycy
- Looks like a product marketing site for Vitropic Forte (vitamin supplement)

### vitropic.co.id — NOT LIVE
Both HTTP and HTTPS return empty response. The WordPress site is no longer
serving content, but the database remains on prog2.

## Connection between sayasehat and WordPress

Both are hosted on the same MySQL server (prog2.pharmanet.id):
- sayasehat/sayasehat3 — health portal by VP Digital / Unictive
- u8182940_wpni213 — Vitropic Forte product website

Both are Pharos/Pharmanet-related:
- sayasehat admin "pharos" (Pharos Admin)
- sayasehat answered by "agency_external" (Pharos content team)
- Vitropic = pharmaceutical product (likely Pharos product)
- Both use prog2.pharmanet.id as DB host

## OPSEC NOTE
The sayasehat admin "mis" with password "123456" is a real admin account
on a health portal with community user PII. This is a finding, not a vector
for further exploitation unless operator directs.