Domain api-express-drive.financialexpress.com
Germany
-
Swagger API description is publicly available
Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
IP: 2.23.7.40
Domain: api-express-drive.financialexpress.com
Port: 443
URL: https://api-express-drive.financialexpress.comFirst seen 2025-11-24 07:14
Last seen 2026-01-31 17:29
Open for 68 days-
Severity: info
Fingerprint: 5733ddf49ff49cd1bf890109bf890109bf890109bf890109bf890109bf890109Public Swagger UI/API detected at path: /api-docs/swagger.json
Found on 2026-01-31 17:29
-
-
Open service 2.23.7.40:443 · api-express-drive.financialexpress.com
2026-01-23 10:49
HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Content-Length: 139 Content-Security-Policy: default-src 'none' X-Content-Type-Options: nosniff Date: Fri, 23 Jan 2026 10:49:32 GMT Alt-Svc: h3=":443"; ma=93600 Connection: close Referrer-Policy: no-referrer-when-downgrade X-XSS-Protection: 1 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=600 ; includeSubDomains Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type, Accept, Authorization, X-Api-Key, * Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET,POST,PUT Page title: Error <!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Error</title> </head> <body> <pre>Cannot GET /</pre> </body> </html>
Found 2026-01-23 by HttpPluginCreate report
-
Open service 2.23.7.40:443 · api-express-drive.financialexpress.com
2026-01-09 13:40
HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Content-Length: 139 Content-Security-Policy: default-src 'none' X-Content-Type-Options: nosniff Date: Fri, 09 Jan 2026 13:40:40 GMT Alt-Svc: h3=":443"; ma=93600 Connection: close Referrer-Policy: no-referrer-when-downgrade X-XSS-Protection: 1 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=600 ; includeSubDomains Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type, Accept, Authorization, X-Api-Key, * Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET,POST,PUT Page title: Error <!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Error</title> </head> <body> <pre>Cannot GET /</pre> </body> </html>
Found 2026-01-09 by HttpPluginCreate report
-
Open service 2.23.7.40:443 · api-express-drive.financialexpress.com
2026-01-02 13:39
HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Content-Length: 139 Content-Security-Policy: default-src 'none' X-Content-Type-Options: nosniff Date: Fri, 02 Jan 2026 13:39:17 GMT Alt-Svc: h3=":443"; ma=93600 Connection: close Referrer-Policy: no-referrer-when-downgrade X-XSS-Protection: 1 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=600 ; includeSubDomains Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type, Accept, Authorization, X-Api-Key, * Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET,POST,PUT Page title: Error <!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Error</title> </head> <body> <pre>Cannot GET /</pre> </body> </html>
Found 2026-01-02 by HttpPluginCreate report
-
Open service 2.23.7.40:443 · api-express-drive.financialexpress.com
2025-12-23 06:53
HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Content-Length: 139 Content-Security-Policy: default-src 'none' X-Content-Type-Options: nosniff Date: Tue, 23 Dec 2025 06:53:27 GMT Alt-Svc: h3=":443"; ma=93600 Connection: close Referrer-Policy: no-referrer-when-downgrade X-XSS-Protection: 1 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=600 ; includeSubDomains Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type, Accept, Authorization, X-Api-Key, * Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET,POST,PUT Page title: Error <!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Error</title> </head> <body> <pre>Cannot GET /</pre> </body> </html>
Found 2025-12-23 by HttpPluginCreate report