LeakIX - Host admin.oystertracker.com

Domain admin.oystertracker.com

United States

AMAZON-02

Software information

Heroku

tcp/443 tcp/80

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 3.33.161.45
Domain: admin.oystertracker.com
Port: 443
URL: https://admin.oystertracker.com

First seen 2025-11-08 00:32
Last seen 2026-01-09 17:24
Open for 62 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1b885ff436d97f36888ce4e41920a05c171012bd5ec393a34
```
Public Swagger UI/API detected at path: /swagger.json - sample paths:
DELETE /api/logout
GET /api
GET /api/admin-groups
GET /api/admin-groups/{id}
GET /api/sessions
GET /api/sessions/my
GET /api/sessions/{id}
GET /api/statuses
GET /api/statuses/{id}
GET /api/users
GET /api/users/my
GET /api/users/{id}
POST /api/contact
POST /api/login
POST /api/login/forgot
POST /api/login/reset
PUT /api/admin-groups/{id}/permissions
PUT /api/users/my/password
PUT /api/users/{id}/groups
PUT /api/users/{id}/password
```
  Found on 2026-01-09 17:24
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 13.248.131.213
Domain: admin.oystertracker.com
Port: 80
URL: http://admin.oystertracker.com

First seen 2025-11-08 00:32
Last seen 2026-01-10 01:50
Open for 63 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1b885ff436d97f36888ce4e41920a05c171012bd5ec393a34
```
Public Swagger UI/API detected at path: /swagger.json - sample paths:
DELETE /api/logout
GET /api
GET /api/admin-groups
GET /api/admin-groups/{id}
GET /api/sessions
GET /api/sessions/my
GET /api/sessions/{id}
GET /api/statuses
GET /api/statuses/{id}
GET /api/users
GET /api/users/my
GET /api/users/{id}
POST /api/contact
POST /api/login
POST /api/login/forgot
POST /api/login/reset
PUT /api/admin-groups/{id}/permissions
PUT /api/users/my/password
PUT /api/users/{id}/groups
PUT /api/users/{id}/password
```
  Found on 2026-01-10 01:50
Create report

Open service 13.248.131.213:80 · admin.oystertracker.com

2026-01-10 01:50

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: no-cache
Content-Length: 2154
Content-Type: text/html; charset=utf-8
Date: Sat, 10 Jan 2026 01:51:59 GMT
Etag: "8a9675de695ab17881605c8c0de47c3c7aad1122"
Last-Modified: Thu, 11 Dec 2025 21:40:03 GMT
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=bl6XxQwxBi4lggA6nhKEK3FyZMstHGF7eTIjwMoMvdM%3D\u0026sid=67ff5de4-ad2b-4112-9289-cf96be89efed\u0026ts=1768009919"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=bl6XxQwxBi4lggA6nhKEK3FyZMstHGF7eTIjwMoMvdM%3D&sid=67ff5de4-ad2b-4112-9289-cf96be89efed&ts=1768009919"
Server: Heroku
Strict-Transport-Security: max-age=15768000
Vary: accept-encoding
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: DENY
X-Xss-Protection: 1; mode=block
Connection: close

Page title: BlueTrace

<!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="icon" href="/favicons_bt.png"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="theme-color" content="#000000"/><link rel="manifest" href="/manifest.json"/><title>BlueTrace</title><link href="/static/css/2.19b7558e.chunk.css" rel="stylesheet"><link href="/static/css/main.68f3ddf5.chunk.css" rel="stylesheet"></head><body><noscript>You need to enable JavaScript to run this app.</noscript><div id="root"></div><script>!function(e){function t(t){for(var n,l,i=t[0],f=t[1],a=t[2],p=0,s=[];p<i.length;p++)l=i[p],Object.prototype.hasOwnProperty.call(o,l)&&o[l]&&s.push(o[l][0]),o[l]=0;for(n in f)Object.prototype.hasOwnProperty.call(f,n)&&(e[n]=f[n]);for(c&&c(t);s.length;)s.shift()();return u.push.apply(u,a||[]),r()}function r(){for(var e,t=0;t<u.length;t++){for(var r=u[t],n=!0,i=1;i<r.length;i++){var f=r[i];0!==o[f]&&(n=!1)}n&&(u.splice(t--,1),e=l(l.s=r[0]))}return e}var n={},o={1:0},u=[];function l(t){if(n[t])return n[t].exports;var r=n[t]={i:t,l:!1,exports:{}};return e[t].call(r.exports,r,r.exports,l),r.l=!0,r.exports}l.m=e,l.c=n,l.d=function(e,t,r){l.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:r})},l.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},l.t=function(e,t){if(1&t&&(e=l(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(l.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var n in e)l.d(r,n,function(t){return e[t]}.bind(null,n));return r},l.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return l.d(t,"a",t),t},l.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},l.p="/";var i=this.webpackJsonpclient=this.webpackJsonpclient||[],f=i.push.bind(i);i.push=t,i=i.slice();for(var a=0;a<i.length;a++)t(i[a]);var c=f;r()}([])</script><script src="/static/js/2.89e45933.chunk.js"></script><script src="/static/js/main.1a8883ec.chunk.js"></script></body></html>

Found 2026-01-10 by HttpPlugin

Create report

Open service 3.33.161.45:443 · admin.oystertracker.com

2026-01-09 17:24

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: no-cache
Content-Length: 2154
Content-Type: text/html; charset=utf-8
Date: Fri, 09 Jan 2026 17:24:19 GMT
Etag: "8a9675de695ab17881605c8c0de47c3c7aad1122"
Last-Modified: Thu, 11 Dec 2025 21:40:03 GMT
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=RHfSr9CcaTTHNkI6wPCi8Z22wPMm4JZih9tgTvvYfYo%3D\u0026sid=67ff5de4-ad2b-4112-9289-cf96be89efed\u0026ts=1767979459"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=RHfSr9CcaTTHNkI6wPCi8Z22wPMm4JZih9tgTvvYfYo%3D&sid=67ff5de4-ad2b-4112-9289-cf96be89efed&ts=1767979459"
Server: Heroku
Strict-Transport-Security: max-age=15768000
Vary: accept-encoding
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: DENY
X-Xss-Protection: 1; mode=block
Connection: close

Page title: BlueTrace

<!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="icon" href="/favicons_bt.png"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="theme-color" content="#000000"/><link rel="manifest" href="/manifest.json"/><title>BlueTrace</title><link href="/static/css/2.19b7558e.chunk.css" rel="stylesheet"><link href="/static/css/main.68f3ddf5.chunk.css" rel="stylesheet"></head><body><noscript>You need to enable JavaScript to run this app.</noscript><div id="root"></div><script>!function(e){function t(t){for(var n,l,i=t[0],f=t[1],a=t[2],p=0,s=[];p<i.length;p++)l=i[p],Object.prototype.hasOwnProperty.call(o,l)&&o[l]&&s.push(o[l][0]),o[l]=0;for(n in f)Object.prototype.hasOwnProperty.call(f,n)&&(e[n]=f[n]);for(c&&c(t);s.length;)s.shift()();return u.push.apply(u,a||[]),r()}function r(){for(var e,t=0;t<u.length;t++){for(var r=u[t],n=!0,i=1;i<r.length;i++){var f=r[i];0!==o[f]&&(n=!1)}n&&(u.splice(t--,1),e=l(l.s=r[0]))}return e}var n={},o={1:0},u=[];function l(t){if(n[t])return n[t].exports;var r=n[t]={i:t,l:!1,exports:{}};return e[t].call(r.exports,r,r.exports,l),r.l=!0,r.exports}l.m=e,l.c=n,l.d=function(e,t,r){l.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:r})},l.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},l.t=function(e,t){if(1&t&&(e=l(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(l.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var n in e)l.d(r,n,function(t){return e[t]}.bind(null,n));return r},l.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return l.d(t,"a",t),t},l.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},l.p="/";var i=this.webpackJsonpclient=this.webpackJsonpclient||[],f=i.push.bind(i);i.push=t,i=i.slice();for(var a=0;a<i.length;a++)t(i[a]);var c=f;r()}([])</script><script src="/static/js/2.89e45933.chunk.js"></script><script src="/static/js/main.1a8883ec.chunk.js"></script></body></html>

Found 2026-01-09 by HttpPlugin