LeakIX - Host aladwaa.com

Domain aladwaa.com

France

MICROSOFT-CORP-MSN-AS-BLOCK

Ubuntu

Software information

Kestrel Kestrel

tcp/443

Microsoft-Azure-Application-Gateway v2

tcp/443

cloudflare

tcp/443 tcp/80 tcp/8443

nginx nginx

tcp/80

nginx nginx 1.24.0

tcp/80

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 172.67.69.105
Domain: beta.curriculums.api.aladwaa.com
Port: 443
URL: https://beta.curriculums.api.aladwaa.com

First seen 2025-10-28 02:48
Last seen 2026-01-09 13:47
Open for 73 days

Severity: info
Fingerprint: 5733ddf49ff49cd1f5e22fb4ec93007e170caf0b39c6921fce303aad2d3d3057

Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
DELETE /DeleteLessonsObjective/{lessonId}/{objectiveId}
DELETE /DeleteSubjectBranch
GET /GeMasterSubjects
GET /GetActiveUnitLessonsBySubjectId/{id}
GET /GetAllGrades/{lang}/{all?}/{stageId?}
GET /GetAllSubjectCurrentTermUnitsWithLessons/{SubjectId}
GET /GetAllSubjectUnits
GET /GetAllSubjectUnitsWithLessons/{SubjectId}/{Term}
GET /GetAllSubjects
GET /GetAllTerms
GET /GetAllYearsSubjects
GET /GetCurrentTerm
GET /GetCurrentTermData
GET /GetCurriculumForMoodle/{subjectId}/{termId}
GET /GetCurriculumSheet
GET /GetLessonsObjectivesByLessonId/{lessonId}
GET /GetModifiedItems
GET /GetRandomLessonOrUnitForChallenge/{SubjectId}/{Term}/{Level}
GET /GetRegistrationData/{userTypeId}
GET /GetSchoolLanguages
GET /GetSectorsByYearId/{yearId}
GET /GetStages
GET /GetSubjectById
GET /GetSubjectStructure
GET /GetSubjectsByUserId/{userId}
GET /GetSubjectsByYearId/{yearId}/{all}
GET /GetUnitsWithQuestionedLessons/{SubjectId}/{Term}
GET /GetYear/{yearId}
GET /GetYears/{all}
POST /AddLessonsObjective
POST /CreateSubject
POST /FindEntityById
POST /GetCurriculumStructure
POST /GetSubjectAndGradeById
POST /GetSubjectBranchesFunction
POST /GetSubjectsByIds
POST /GetSubjectsGradeOptions
POST /GetUnitLessonPairs
POST /GetYearSubjectsDetails
POST /Lesson/AddLesson
POST /Lesson/DeleteLesson
POST /Lesson/GetLessons
POST /Lesson/MoveLessonToAntherUnit
POST /Lesson/ReOrderLesson
POST /Lesson/UpdateLesson
POST /SearchSubjects
POST /UpdateGrade
POST /curriculum/path
POST /curriculum/sync-to-course
POST /unit/AddUnit
POST /unit/DeleteUnit
POST /unit/ReOrderUnit
POST /unit/UpdateUnit
POST /v2/GetAllTermsV2
PUT /EditSubject
PUT /EditSubjectBranch
PUT /MergeLessons
PUT /MoveLessonToUnit
PUT /UpdateLessonsObjective
PUT /terms

Found on 2026-01-09 13:47

Severity: info
Fingerprint: 5733ddf49ff49cd1f5e22fb4ec93007e170caf0b39c6921fce303aad146e3f36

Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
DELETE /DeleteLessonsObjective/{lessonId}/{objectiveId}
DELETE /DeleteSubjectBranch
GET /GeMasterSubjects
GET /GetActiveUnitLessonsBySubjectId/{id}
GET /GetAllGrades/{lang}/{all?}/{stageId?}
GET /GetAllSubjectCurrentTermUnitsWithLessons/{SubjectId}
GET /GetAllSubjectUnits
GET /GetAllSubjectUnitsWithLessons/{SubjectId}/{Term}
GET /GetAllSubjects
GET /GetAllTerms
GET /GetAllYearsSubjects
GET /GetCurrentTerm
GET /GetCurrentTermData
GET /GetCurriculumForMoodle/{subjectId}/{termId}
GET /GetCurriculumSheet
GET /GetLessonsObjectivesByLessonId/{lessonId}
GET /GetModifiedItems
GET /GetRegistrationData/{userTypeId}
GET /GetSchoolLanguages
GET /GetSectorsByYearId/{yearId}
GET /GetStages
GET /GetSubjectById
GET /GetSubjectsByUserId/{userId}
GET /GetSubjectsByYearId/{yearId}/{all}
GET /GetUnitsWithQuestionedLessons/{SubjectId}/{Term}
GET /GetYear/{yearId}
GET /GetYears/{all}
POST /AddLessonsObjective
POST /CreateSubject
POST /FindEntityById
POST /GetCurriculumStructure
POST /GetSubjectAndGradeById
POST /GetSubjectBranchesFunction
POST /GetSubjectsByIds
POST /GetSubjectsGradeOptions
POST /GetUnitLessonPairs
POST /GetYearSubjectsDetails
POST /Lesson/AddLesson
POST /Lesson/DeleteLesson
POST /Lesson/GetLessons
POST /Lesson/MoveLessonToAntherUnit
POST /Lesson/ReOrderLesson
POST /Lesson/UpdateLesson
POST /SearchSubjects
POST /UpdateGrade
POST /curriculum/path
POST /curriculum/sync-to-course
POST /unit/AddUnit
POST /unit/DeleteUnit
POST /unit/ReOrderUnit
POST /unit/UpdateUnit
POST /v2/GetAllTermsV2
PUT /EditSubject
PUT /EditSubjectBranch
PUT /MergeLessons
PUT /MoveLessonToUnit
PUT /UpdateLessonsObjective
PUT /terms

Found on 2025-12-26 17:41

Severity: info
Fingerprint: 5733ddf49ff49cd1f5e22fb4ec93007e170caf0b39c6921fce303aad74258d67

Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
DELETE /DeleteLessonsObjective/{lessonId}/{objectiveId}
DELETE /DeleteSubjectBranch
GET /GeMasterSubjects
GET /GetActiveUnitLessonsBySubjectId/{id}
GET /GetAllGrades/{lang}/{all?}/{stageId?}
GET /GetAllSubjectCurrentTermUnitsWithLessons/{SubjectId}
GET /GetAllSubjectUnits
GET /GetAllSubjectUnitsWithLessons/{SubjectId}/{Term}
GET /GetAllSubjects
GET /GetAllTerms
GET /GetAllYearsSubjects
GET /GetCurrentTerm
GET /GetCurrentTermData
GET /GetCurriculumForMoodle/{subjectId}/{termId}
GET /GetCurriculumSheet
GET /GetLessonsObjectivesByLessonId/{lessonId}
GET /GetModifiedItems
GET /GetRegistrationData/{userTypeId}
GET /GetSchoolLanguages
GET /GetSectorsByYearId/{yearId}
GET /GetStages
GET /GetSubjectById
GET /GetSubjectsByUserId/{userId}
GET /GetSubjectsByYearId/{yearId}/{all}
GET /GetYear/{yearId}
GET /GetYears/{all}
POST /AddLessonsObjective
POST /CreateSubject
POST /FindEntityById
POST /GetCurriculumStructure
POST /GetSubjectAndGradeById
POST /GetSubjectBranchesFunction
POST /GetSubjectsByIds
POST /GetSubjectsGradeOptions
POST /GetUnitLessonPairs
POST /GetYearSubjectsDetails
POST /Lesson/AddLesson
POST /Lesson/DeleteLesson
POST /Lesson/GetLessons
POST /Lesson/MoveLessonToAntherUnit
POST /Lesson/ReOrderLesson
POST /Lesson/UpdateLesson
POST /SearchSubjects
POST /UpdateGrade
POST /curriculum/path
POST /curriculum/sync-to-course
POST /unit/AddUnit
POST /unit/DeleteUnit
POST /unit/ReOrderUnit
POST /unit/UpdateUnit
POST /v2/GetAllTermsV2
PUT /EditSubject
PUT /EditSubjectBranch
PUT /MergeLessons
PUT /MoveLessonToUnit
PUT /UpdateLessonsObjective
PUT /terms

Found on 2025-11-23 16:05

Severity: info
Fingerprint: 5733ddf49ff49cd1f5e22fb4ec93007e170caf0b39c6921fce303aad479bb6de

Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
DELETE /DeleteLessonsObjective/{lessonId}/{objectiveId}
DELETE /DeleteSubjectBranch
GET /GeMasterSubjects
GET /GetActiveUnitLessonsBySubjectId/{id}
GET /GetAllGrades/{lang}/{all?}/{stageId?}
GET /GetAllSubjectCurrentTermUnitsWithLessons/{SubjectId}
GET /GetAllSubjectUnits
GET /GetAllSubjectUnitsWithLessons/{SubjectId}/{Term}
GET /GetAllSubjects
GET /GetAllTerms
GET /GetAllYearsSubjects
GET /GetCurrentTerm
GET /GetCurrentTermData
GET /GetCurriculumSheet
GET /GetLessonsObjectivesByLessonId/{lessonId}
GET /GetModifiedItems
GET /GetRegistrationData/{userTypeId}
GET /GetSchoolLanguages
GET /GetSectorsByYearId/{yearId}
GET /GetStages
GET /GetSubjectById
GET /GetSubjectsByUserId/{userId}
GET /GetSubjectsByYearId/{yearId}/{all}
GET /GetYear/{yearId}
GET /GetYears/{all}
POST /AddLessonsObjective
POST /CreateSubject
POST /FindEntityById
POST /GetCurriculumStructure
POST /GetSubjectAndGradeById
POST /GetSubjectBranchesFunction
POST /GetSubjectsByIds
POST /GetSubjectsGradeOptions
POST /GetUnitLessonPairs
POST /GetYearSubjectsDetails
POST /Lesson/AddLesson
POST /Lesson/DeleteLesson
POST /Lesson/GetLessons
POST /Lesson/MoveLessonToAntherUnit
POST /Lesson/ReOrderLesson
POST /Lesson/UpdateLesson
POST /SearchSubjects
POST /UpdateGrade
POST /curriculum/path
POST /curriculum/sync-to-course
POST /unit/AddUnit
POST /unit/DeleteUnit
POST /unit/ReOrderUnit
POST /unit/UpdateUnit
POST /v2/GetAllTermsV2
PUT /EditSubject
PUT /EditSubjectBranch
PUT /MergeLessons
PUT /MoveLessonToUnit
PUT /UpdateLessonsObjective
PUT /terms

Found on 2025-11-16 09:11

Create report

Git configuration and history exposed

The following URL (usually /.git/config) is publicly accessible and is leaking source code and repository configuration.

IP: 104.26.9.42
Domain: beta.schools.aladwaa.com
Port: 80
URL: http://beta.schools.aladwaa.com

First seen 2025-07-01 20:34
Last seen 2025-09-12 11:48
Open for 72 days

Severity: medium
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a652258a10b51

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[remote "origin"]
	url = git@github.com:iomad/iomad.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "IOMAD_405_STABLE"]
	remote = origin
	merge = refs/heads/IOMAD_405_STABLE

Found on 2025-09-12 11:48

275 Bytes

Severity: medium
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a6522f275c8c1

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[remote "origin"]
	url = git://git.moodle.org/moodle.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "MOODLE_500_STABLE"]
	remote = origin
	merge = refs/heads/MOODLE_500_STABLE

Found on 2025-07-10 16:17

278 Bytes

Severity: medium
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a6522ec18f4f6

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[remote "origin"]
	url = git://git.moodle.org/moodle.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "MOODLE_401_STABLE"]
	remote = origin
	merge = refs/heads/MOODLE_401_STABLE
[branch "MOODLE_405_STABLE"]
	remote = origin
	merge = refs/heads/MOODLE_405_STABLE

Found on 2025-07-01 20:34

362 Bytes

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.111.1.6
Domain: beta.askteacher.api.aladwaa.com
Port: 443
URL: https://beta.askteacher.api.aladwaa.com

First seen 2025-10-25 05:15
Last seen 2026-01-09 19:47
Open for 76 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1f5e22fb47620b7d1b6c54122760922918b74a5d3f6e941b0
```
Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
GET /asked-questions/users/{userId}
GET /asked-questions/{id}
POST /asked-questions
POST /asked-questions/search
PUT /asked-questions/answer
```
  Found on 2026-01-09 19:47
- Severity: info
  Fingerprint: 5733ddf49ff49cd1f5e22fb4b90933c5b5a8305ca35ec316a35ec316a35ec316
```
Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
GET /asked-questions/{id}
POST /asked-questions
POST /asked-questions/search
```
  Found on 2025-10-27 01:53
- Severity: info
  Fingerprint: 5733ddf49ff49cd1f5e22fb4f9702293f9702293f9702293f9702293f9702293
```
Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
POST /asked-questions
```
  Found on 2025-10-25 05:15
Create report

Git configuration and history exposed

The following URL (usually /.git/config) is publicly accessible and is leaking source code and repository configuration.

IP: 104.26.8.42
Domain: beta.schools.aladwaa.com
Port: 443
URL: https://beta.schools.aladwaa.com

First seen 2025-07-01 20:34
Last seen 2025-12-30 14:02
Open for 181 days

Severity: medium
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a652258a10b51

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[remote "origin"]
	url = git@github.com:iomad/iomad.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "IOMAD_405_STABLE"]
	remote = origin
	merge = refs/heads/IOMAD_405_STABLE

Found on 2025-12-30 14:02

275 Bytes

Severity: medium
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a6522f275c8c1

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[remote "origin"]
	url = git://git.moodle.org/moodle.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "MOODLE_500_STABLE"]
	remote = origin
	merge = refs/heads/MOODLE_500_STABLE

Found on 2025-07-10 08:37

278 Bytes

Severity: medium
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a6522ec18f4f6

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[remote "origin"]
	url = git://git.moodle.org/moodle.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "MOODLE_401_STABLE"]
	remote = origin
	merge = refs/heads/MOODLE_401_STABLE
[branch "MOODLE_405_STABLE"]
	remote = origin
	merge = refs/heads/MOODLE_405_STABLE

Found on 2025-07-01 20:34

362 Bytes

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 40.79.130.129
Domain: mobilefiles.api.aladwaa.com
Port: 443
URL: https://mobilefiles.api.aladwaa.com

First seen 2025-12-11 03:21
Last seen 2026-01-10 02:30
Open for 29 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1f5e22fb44a171f221cf0d68cdf39546d506c33f99752b7bb
```
Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
DELETE /DeleteBannerImage/{id}
GET /GetAllBannerImages
GET /GetBannerImages
GET /mobileAssets
POST /CreateBannerImage
PUT /UpdateBannerImage
PUT /UpdateBannerLink
PUT /mobileAssets/banners/reorder
```
  Found on 2026-01-10 02:30
- Severity: info
  Fingerprint: 5733ddf49ff49cd1f5e22fb44a171f221cf0d68cdf39546d506c33f92de91e92
```
Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
DELETE /DeleteBannerImage/{id}
GET /GetAllBannerImages
GET /GetBannerImages
GET /mobileAssets
POST /CreateBannerImage
PUT /UpdateBannerImage
PUT /mobileAssets/banners/reorder
```
  Found on 2025-12-27 00:49
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.111.1.6
Domain: askteacher.api.aladwaa.com
Port: 443
URL: https://askteacher.api.aladwaa.com

First seen 2025-10-25 06:37
Last seen 2026-01-09 19:59
Open for 76 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1f5e22fb47620b7d1b6c54122760922918b74a5d3f6e941b0
```
Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
GET /asked-questions/users/{userId}
GET /asked-questions/{id}
POST /asked-questions
POST /asked-questions/search
PUT /asked-questions/answer
```
  Found on 2026-01-09 19:59
- Severity: info
  Fingerprint: 5733ddf49ff49cd1f5e22fb4f9702293f9702293f9702293f9702293f9702293
```
Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
POST /asked-questions
```
  Found on 2025-11-18 05:59
Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 40.79.130.129
Domain: staging.barcodes.api.aladwaa.com
Port: 443
URL: https://staging.barcodes.api.aladwaa.com

First seen 2025-12-08 02:57
Last seen 2026-01-09 09:17
Open for 32 days

Severity: info
Fingerprint: 5733ddf49ff49cd1f5e22fb448d099f0c6b22e51f0b4fba560f05584f5d6971b

Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
DELETE /DeleteDynamicActivationReason/{id}
GET /BarCodeOperation/GetAllBarCodeTypes
GET /BarCodeOperation/GetBarCodeBySerial
GET /BarCodeOperation/GetBarcodeDetails
GET /BarCodeOperation/GetUserBarCodes/{UserId}/{page}/{pageSize}
GET /GetDynamicActivationReasons
GET /TestStatus/GetAll
POST /AddDynamicActivationReason
POST /BarCodeOperation/ActiveBarcodeDynamic
POST /BarCodeOperation/BurnBarCodeByAdminForUser
POST /BarCodeOperation/DeleteBarcodeUsage
POST /BarCodeOperation/EndUsageOfBarCodeByBarCodeNumber
POST /BarCodeOperation/EndUsageOfBarCodeBySubject
POST /BarCodeOperation/ExpiryBarcode
POST /BarCodeOperation/ExportBarCode
POST /BarCodeOperation/GenerateBarCode
POST /BarCodeOperation/InsertUpdateBarCodeTested
POST /BarCodeOperation/IsSubjectHasBarCode
POST /BarCodeOperation/ReUseBarCode/{barCode}
POST /BarCodeOperation/SelectBarCodeBatchesBySubjectAndTerm
POST /BarCodeOperation/SelectBarCodeOnlyBySubjectAndTerm_new
POST /CreateBarcodeBatch
POST /GetAllBarcodebatchesFunction
PUT /EditDynamicActivationReason

Found on 2026-01-09 09:17

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 40.79.130.129
Domain: staging.messages.teacherhub.api.aladwaa.com
Port: 443
URL: https://staging.messages.teacherhub.api.aladwaa.com

First seen 2025-12-07 16:11
Last seen 2026-01-10 00:45
Open for 33 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1f5e22fb480870a686a3409799f3c4f679f3c4f679f3c4f67
```
Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
GET /GetTeacherMessageById/{id}
GET /GetTeacherMessages/{teacherId}
POST /SendMessage
```
  Found on 2026-01-10 00:45
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 40.79.130.129
Domain: finance.teacherhub.api.aladwaa.com
Port: 443
URL: https://finance.teacherhub.api.aladwaa.com

First seen 2025-12-04 11:17
Last seen 2026-01-09 23:37
Open for 36 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1f5e22fb45e40fcd21ea09c6c95869cb246e82c87c5fea584
```
Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
GET /Categories/{type}
GET /teacher/{teacherId}/GetTeacherFinanceDashboard
GET /transaction/TotalTeacherRevenueByMonth/{teacherId}/{year}/{month}
GET /transaction/{id}
POST /transaction
POST /transaction/Get
```
  Found on 2026-01-09 23:37
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 40.79.130.129
Domain: beta.ses.api.aladwaa.com
Port: 443
URL: https://beta.ses.api.aladwaa.com

First seen 2025-12-07 08:39
Last seen 2025-12-17 04:08
Open for 9 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1b885ff435a10a45ecbcff83ac3a9b34cfee40039b5679fcd
```
Public Swagger UI/API detected at path: /swagger.json - sample paths:
DELETE /SESFunction/DeleteSESUser/{userId}/{email}
GET /SESFunction/GetSESUserById/{userId}
GET /SESFunction/GetSESUsers
GET /api/SESFunction/GetCourseSections/{courseId}/{userId}
GET /api/SESFunction/GetCourses/{subjectId}/{userId}
GET /api/SESFunction/GetLessons/{sectionId}/{userId}
GET /api/SESFunction/GetUserGradeAndSubjects/{userId}
POST /SESFunction/AddSESUser
POST /SESFunction/UpdateSESUser
POST /api/LikeMessage/{userId}/{lessonId}
POST /api/Login/LoginCallback
POST /api/ResetLessonBadgesQueue
```
  Found on 2025-12-17 04:08
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 40.79.130.129
Domain: beta.mobilefiles.api.aladwaa.com
Port: 443
URL: https://beta.mobilefiles.api.aladwaa.com

First seen 2025-12-11 03:23
Last seen 2026-01-09 13:40
Open for 29 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1f5e22fb44a171f221cf0d68cdf39546d506c33f99752b7bb
```
Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
DELETE /DeleteBannerImage/{id}
GET /GetAllBannerImages
GET /GetBannerImages
GET /mobileAssets
POST /CreateBannerImage
PUT /UpdateBannerImage
PUT /UpdateBannerLink
PUT /mobileAssets/banners/reorder
```
  Found on 2026-01-09 13:40
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 40.79.130.129
Domain: staging.mobilefiles.api.aladwaa.com
Port: 443
URL: https://staging.mobilefiles.api.aladwaa.com

First seen 2025-12-11 03:24
Last seen 2026-01-09 13:40
Open for 29 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1f5e22fb44a171f221cf0d68cdf39546d16cdc9c94541a095
```
Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
DELETE /DeleteBannerImage/{id}
GET /GetAllBannerImages
GET /GetBannerImages
POST /CreateBannerImage
PUT /UpdateBannerImage
```
  Found on 2026-01-09 13:40
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 40.79.130.129
Domain: staging.finance.teacherhub.api.aladwaa.com
Port: 443
URL: https://staging.finance.teacherhub.api.aladwaa.com

First seen 2025-12-04 12:08
Last seen 2026-01-09 12:01
Open for 35 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1f5e22fb45e40fcd2c2ef3b845ec0bf850790b06413e743da
```
Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
GET /Categories/{type}
GET /transaction/TotalTeacherRevenueByMonth/{teacherId}/{year}/{month}
GET /transaction/{id}
POST /transaction
POST /transaction/Get
```
  Found on 2026-01-09 12:01
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 40.79.130.129
Domain: beta.finance.teacherhub.api.aladwaa.com
Port: 443
URL: https://beta.finance.teacherhub.api.aladwaa.com

First seen 2025-12-04 11:42
Last seen 2026-01-09 07:19
Open for 35 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1f5e22fb45e40fcd21ea09c6c95869cb246e82c87c5fea584
```
Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
GET /Categories/{type}
GET /teacher/{teacherId}/GetTeacherFinanceDashboard
GET /transaction/TotalTeacherRevenueByMonth/{teacherId}/{year}/{month}
GET /transaction/{id}
POST /transaction
POST /transaction/Get
```
  Found on 2026-01-09 07:19
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 40.79.130.129
Domain: beta.messages.teacherhub.api.aladwaa.com
Port: 443
URL: https://beta.messages.teacherhub.api.aladwaa.com

First seen 2025-12-07 16:15
Last seen 2026-01-09 05:38
Open for 32 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1f5e22fb480870a686a3409799f3c4f679f3c4f679f3c4f67
```
Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
GET /GetTeacherMessageById/{id}
GET /GetTeacherMessages/{teacherId}
POST /SendMessage
```
  Found on 2026-01-09 05:38
Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 40.79.130.129
Domain: staging.teacherhub.api.aladwaa.com
Port: 443
URL: https://staging.teacherhub.api.aladwaa.com

First seen 2025-12-07 16:14
Last seen 2026-01-09 23:01
Open for 33 days

Severity: info
Fingerprint: 5733ddf49ff49cd1f5e22fb48937c9cd01486ad1b660679272def21685770370

Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
DELETE /DeleteGroup/{groupId}
DELETE /DeleteMaterial
DELETE /DeleteSession
GET /GetAllSessionStudents/{sessionId}
GET /GetGradesWithSubjectsByTeacherId/{teacherId}
GET /GetGroupSessions/{groupId}
GET /GetSessionMaterials/{sessionId}/{MaterialCategoryId?}
GET /GetSessionStudentRemainingAmount/{sessionId}/{studentId}
GET /Teacher/GetTeacherByIdFreshChat/{id}
GET /TeacherHub/ExportDetailedPerformanceSheet
GET /TeacherHub/ExportPerformanceSheet
GET /TeacherHub/ExportTeachersSheet
GET /TeacherHub/ExportTeachersStudentsDetailed
GET /TeacherHub/GetAllBooksByTeacherId/{teacherId}/{lang}/{subjectId}/{gradeId}
GET /TeacherHub/GetClassRoomData/{id}
GET /TeacherHub/GetFeedBackFormURL
GET /TeacherHub/GetHomeBooksByTeacherId/{teacherId}
GET /TeacherHub/GetStudentBurnedCoursesById/{id}
GET /TeacherHub/GetStudentData/{id}/{TeacherId}
GET /TeacherHub/GetStudentStatus/{StudentId}
GET /TeacherHub/GetStudentStatus2/{StudentId}
GET /TeacherHub/GetTeacherById/{id}
GET /TeacherHub/SendMailToSupport
GET /assistant/{id}
GET /book/{id}
GET /configuration/freePremium
GET /teachers/{id}/assistants
GET /{studentId}/GetLinkedTeachers/{pageNumber}/{pageSize}
POST /AddNewGroup
POST /AddSessionMateial
POST /AddStudentsToGroup
POST /CheckAssistancePermission/{id}/{permission}
POST /CreateAutomaticGroupSession
POST /CreateManualGroupSession
POST /GetAllSubjectGrades
POST /GetMaxQuestionsPerQuiz
POST /GetTeacherBooksByScope
POST /GetTeacherContentLibrary
POST /GetTeacherGroups
POST /GetTeacherSessionByDateRange
POST /GetTeacherStudentGroups
POST /GetUnlinkedPrivateCourses
POST /RefreshToken
POST /RemoveGroupStudent
POST /SendAdminNotification
POST /StudentJoinSession
POST /TeacherHub/AddEditStudentTeacherNote
POST /TeacherHub/ChangeUserPassword
POST /TeacherHub/CheckVerificationCode
POST /TeacherHub/GetGroupStudents
POST /TeacherHub/GetLinkedStudents
POST /TeacherHub/GetTeacherStudent
POST /TeacherHub/ImportPromtersExcel
POST /TeacherHub/ImportTeacherBookExcel
POST /TeacherHub/ImportTeachersExcel
POST /TeacherHub/SearchTeachers
POST /TeacherHub/SendVerificationCode
POST /TeacherHub/TeacherLogin
POST /TeacherHub/UseTeacherCode
POST /UpdateStudentPayAndAttendStatus
POST /book
POST /check-student-connection
POST /teachers/{teacherId}/assistants
PUT /EditGroup
PUT /EditSession
PUT /Teacher/{teacherId}/UpgradeTeacherPremium/{status}
PUT /UnlinkStudent
PUT /UpdateTeacherProfile
PUT /assistants/{id}
PUT /assistants/{id}/change-password
PUT /teacher/{id}/quota

Found on 2026-01-09 23:01

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 40.79.130.129
Domain: messages.teacherhub.api.aladwaa.com
Port: 443
URL: https://messages.teacherhub.api.aladwaa.com

First seen 2025-12-07 16:11
Last seen 2026-01-09 22:09
Open for 33 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1f5e22fb480870a686a3409799f3c4f679f3c4f679f3c4f67
```
Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
GET /GetTeacherMessageById/{id}
GET /GetTeacherMessages/{teacherId}
POST /SendMessage
```
  Found on 2026-01-09 22:09
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.111.1.6
Domain: staging.askteacher.api.aladwaa.com
Port: 443
URL: https://staging.askteacher.api.aladwaa.com

First seen 2025-10-23 16:53
Last seen 2026-01-09 18:12
Open for 78 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1f5e22fb4f9702293f9702293f9702293f9702293f9702293
```
Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
POST /asked-questions
```
  Found on 2026-01-09 18:12
Create report

Open service 40.79.130.129:443 · chat2.api.aladwaa.com

2026-01-12 11:25

HTTP/1.1 200 OK
Content-Length: 149794
Connection: close
Content-Type: text/html
Date: Mon, 12 Jan 2026 11:26:52 GMT
Server: Kestrel

Page title: Your Azure Function App is up and running.

<!DOCTYPE html>
<html>
<head>
    <title>Your Azure Function App is up and running.</title>
    <style type="text/css">
        @font-face {
            font-family: 'SegoeLight';
            src: url(//:) format('no404'), url(data:font/woff;charset=utf-8;base64,d09GRgABAAAAAFbcABAAAAAAjewAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABGRlRNAAABbAAAABsAAAAcWqtaPUdERUYAAAGIAAAAHQAAACABGAADT1MvMgAAAagAAABYAAAAYGrqcLZjbWFwAAACAAAAAaIAAAIKczqUA2N2dCAAAAOkAAAATAAAAEwOEAwRZnBnbQAAA/AAAAGxAAACZQ+0L6dnYXNwAAAFpAAAAAwAAAAMAAMAB2dseWYAAAWwAABJAAAAe3CDYeDNaGVhZAAATrAAAAAxAAAANvjlJxhoaGVhAABO5AAAACAAAAAkDm4GkWhtdHgAAE8EAAACNgAAA6yU7F4gbG9jYQAAUTwAAAHOAAAB2DtSXCptYXhwAABTDAAAACAAAAAgAg8B1G5hbWUAAFMsAAAA5wAAAZ4hIT5EcG9zdAAAVBQAAAH4AAAC+Je8aS1wcmVwAABWDAAAAM8AAAFulHbF13jaY2BgYGQAguP/NtwH0SfDQtZA6Y0AWbsHmQB42mNgZGBg4ANiCQYQYGIA8V8BSRYwjwEADksBHAAAAHjaY2BmfsOow8DKwMI6i9WYgYFhBYRmkmZIY0rjYGLiZmZiYWVhYmJewMC03oFBIZoBCnyDFRSAlMJvFra0f2kMDOzpTJxAgfkgORYG1lkgOQZGAGSzDHF42mNgYGBmgGAZBkYgycDIAuQxgvksDC+AtBmDApAlxlDH8J/RkDGYsYLpGNMtpjssbCwcLGEsEQpcCiIKUgpyCkoKagr6ClYK8QprFJUeMPxm+s3y/z9QvwLDAqC+IAx9DAoCChIKMlB9lnB9jCB9/x//P/R/4v/C/77/GP6+/fvmj9of1d/ffn99cPLBkQcHHxx4sPfBrgebHqx80PrA8v4Rheesz1mfQdxPDmBkY4BrZmQCEkzoCoBBxMLKxs7BycXNw8vHLyAoJCwiKiYuISklLSMrJ6+gqKSsoqqmrqGppa2jq6dvYGhkbGJqZm5haWVtY2tn7+Do5Ozi6ubu4enl7ePr5x8QGBQcEhoWHhEZFR0TGxefkMjQ1t7ZPXnGvMWLlixbunzl6lVr1q5ft2Hj5q1btu3Yvmf33n0MRSmpmfcrFhZkPyvLYuiYxVDMwJBeDnZdTg3Dil2NyXkgdm7tg6Sm1umHj1y/cefuzVs7GQ4eZXj66PGLlwyVt+8xtPQ093b1T5jYN3Uaw5Q5c2cfOnaikIHheBVQIwDe55fTAAD+KQAABAAFmgXpAFQAIQAnAFMAWgBbAFwAYABiAGYAeQCYAGMAXABjAGcAbABwAHcAgQCFAIsAmgBOAEkAVgBRAF4AagBMAEcARABYeNpdUbtOW0EQ3Q0PA4HE2CA52hSzmZAC74U2SCCuLsLIdmM5QtqNXORiXMAHUCBRg/ZrBmgoU6RNg5ALJD6BT4iUmTWJojQ7O7NzzpkzS8qRqndpveepcxZI4W6DZpt+J6TaRYAH0vWNRkbawSMtNjN65bp9v4/BZjTlThpAec9bykNG006gFu25fzI/g+E+/8s8B4OWZpqeWmchPYTAfDNuafA1o1l3/UFfsTpcDQaGFNNU3PXHVMr/luZcbRm2NjOad3AhIj+YBmhqrY1A0586pHo+jmIJcvlsrA0mpqw/yURwYTJd1VQtM752cJ/sLDrYpEpz4AEOsFWegofjowmF9C2JMktDhIPYKjFCxCSHQk45d7I/KVA+koQxb5LSzrhhrYFx5DUwqM3THL7MZlPbW4cwfhFH8N0vxpIOPrKhNkaE2I5YCmACkZBRVb6hxnMviwG51P4zECVgefrtXycCrTs2ES9lbZ1jjBWCnt823/llxd2qXOdFobt3VTVU6ZTmQy9n3+MRT4+F4aCx4M3nfX+jQO0NixsNmgPBkN6N3v/RWnXEVd4LH9lvNbOxFgAAAAAAAAIABAAC//8AA3jaxX0JfBRV8v97fcx99RyZ3MlkcgAhCcwQwogIKguoyCIbkUXEyH2oCAjKsojIIiIiIoqIiKjIIrps92RUjIhBLvEGJayLeCsGFd1d1pVjOv+q93omw6G7+/v//p8/fDLT83qm+7169aq+Va+qmgjkdkLE24WjRCRmUk3ihJJKTXK3quYajbpbqWqpUUmLJmW3qpJHk2mlJma3alZaSbp0jSohpSykhG4XSfJ2gehEOJr03k6PEkIE8l7bUTpDXgXXdZMLSVzC69o8rXFBJJVU9dSo5hbNmdeKf43UabZUasTbqilwA0IVrybZYjGiCTbFq5JYl640LEbFkvLabt2jkayA30QHDrVNipZUV5eUdOlCl0vmE/U1JeGqqnBJDdz7WfEDQWL3NpPuJG6CW6pCNCF7iE2qVEmEjUpuSUhe0g0aYGCUViYI+2SMDW/I/k4MtDXoOryIH9Btem+6Da5fS2ZLs+H6eaSI9iTxAFw/7s/OiUajca9AKht9WcHc0mBUUywwNk9+UWkwojprGmWL1YHNLmgW3AWF0EzV4hotRCvV7rlNF9z/98UkUGlT/dUu1d4sa4H84y7V1tx0wdK/z8UTspoNZ8xwJgfPmJpl1eRppKYcX2WjwF5lfFXNnkaLORsObJ5Gqy0AB3ZPo8Puhy+42auHvfrwFb+Txb4DvwqyX8E1c9l14FQ+nmosSH2hEL/QWISvImk0mW32avhH+2RTQTaZLVab3eH2+PyBrGB2Tm5+QWFR9c/8U/vkIpFDYsgcEsM+9lcXYn9Rkf3J8CZN0H8YSAu8+pdDBw/Vj+HLlz6aPVA/6KMlwwYPo85hg39Lfcl5A6ljoBjX1w/Sp9Kl+DeIDh9EV+nj8G+Qvp4OB54UyRNtNeIc0yBSQEpJJZlE4iJwpUqimkVuVcsjcdFiq2zsIwpW4NDONaqjRZUjWkhpVUMeZIu44C6MRCKJMsYocaIE4VO8zIo/KvNbK9Uyj9YRGDhPadWqgIs0iwjsKwP7lgXCtSUVtVlRpZoCD9fVRgORYKA8rBRSYGbRBa9ZRVS5AE6WC3WDtixe+eedd6gPDVp5/fhHN9/7TOvk349YPGjazddJ+/cOHjdKGDr1yal3vR58PlE5/vzk42Ofnn7PVrmDcu+EYfMGP5Q86F943QhY1UQmQ9o+lnX5eWInQeDVChIlr5N4Pq7Eakur2qFGK4E3UqN54c1Ro5kssN671ahii+b2tqpuj5YDo8mG8Wd7tAAcWqHV6tGK4LASDis9Wi4frprn0brCYRks4VrOzXVlH/8BmVZSc6rVvGo1x6Nly8fxi7nycaER+CPPYASqZefAiveSWEwNKJrDFItpebmKtzG/pEN1aRDEQIdqOF9UBu0OLxyJ1hiKhAxxIJaYgILRSHegnximp4mKzHN0zar4yw+vUF9YNn3BvKnT5t0+fbR4bcOghxubV2DjtDvnTZ0+73bhg9cf//P2Vzet3issfnjRvJWr5y9ZemK2/OKJX7/+uPbqjj9B+z2rF85b+cgfltzH+GpJ22F5thwHGpeTGnKMxPM4XzH+0qrl1rgTRIRWIgN9u9SophatUmHksyHN4LCME9UDhx6PFuRUbyTZQRCLebmtSFuk6Xsd9l2FNHWpxKN2bAZiqvnNakeQAR0JLNB8T6MvPw8WaIC95uIrnq3As3E4VXx38d1hk0vxAqFjam4sDmfwA42R56kvkJtf0dFYn/SMz2yaispgUkSnhU9KCUxKo8nmCcKnLl1DFaYQEN1T1k54cxbtXhcVzFbK+DqM80BJhcRmQ/p22x79yHvf0oFP7Fy9dN36+ApaMsfSYH6MKqc2b1p02zVT7xSG6olF+v5X/vjllv0fbKD+B156ZPG2J29btO2Kx/Tvmn7S/

Found 18 hours ago by HttpPlugin