LeakIX - Host birkod.az

Domain birkod.az

CLOUDFLARENET

Software information

cloudflare

tcp/443 tcp/80 tcp/8443

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 172.67.147.117
Domain: oms-b.birkod.az
Port: 443
URL: https://oms-b.birkod.az

First seen 2025-11-03 14:30
Last seen 2026-01-09 21:56
Open for 67 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad035490ed3b6e5e702dc0aaf8fa2c1912cf87614e1e462

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
DELETE /api/Booking/Delete
DELETE /api/Customer/Delete
DELETE /api/OperationClaims/Delete
DELETE /api/Role/Delete
DELETE /api/RoleOperationClaim/Delete
DELETE /api/Room/Delete
DELETE /api/RoomExtra/Delete
DELETE /api/RoomPrice/Delete
DELETE /api/RoomType/Delete
DELETE /api/SpecialDayPrice/Delete
DELETE /api/TravelAgency/Delete
DELETE /api/UserOperationClaims/Delete
DELETE /api/UserRole/Delete
DELETE /api/Users/Delete
GET /api/Booking/{Key}
GET /api/Customer/GetListNonPaging
GET /api/OperationClaims/GetList
GET /api/OperationClaims/GetListNonPaging
GET /api/OperationClaims/{Key}
GET /api/Role/GetList
GET /api/Role/GetListNonPaging
GET /api/Role/{Key}
GET /api/RoleOperationClaim/GetList
GET /api/RoleOperationClaim/{Key}
GET /api/Room/GetListNonPaging
GET /api/RoomExtra/GetListNonPaging
GET /api/RoomPrice/GetListNonPaging
GET /api/RoomType/GetListNonPaging
GET /api/SpecialDayPrice/GetListNonPaging
GET /api/TravelAgency/GetListNonPaging
GET /api/UserOperationClaims/GetList
GET /api/UserOperationClaims/{Key}
GET /api/UserRole/{Key}
GET /api/Users/GetDetail
GET /api/Users/GetFromAuth
GET /api/Users/GetListNonPaging
GET /api/Users/GetListUserInfo
GET /api/Users/{Key}
POST /api/Auth/ForgotPassword
POST /api/Auth/Login
POST /api/Auth/RefreshToken
POST /api/Auth/RevokeToken
POST /api/Booking/Add
POST /api/Booking/GetList/ByDynamic
POST /api/Customer/Add
POST /api/Customer/GetList/ByDynamic
POST /api/OperationClaims/Add
POST /api/Role/Add
POST /api/RoleOperationClaim/Add
POST /api/RoleOperationClaim/GetListRoleAccess/{RoleId}
POST /api/RoleOperationClaim/{RoleId}
POST /api/Room/Add
POST /api/Room/GetList/ByDynamic
POST /api/Room/GetListByRoomType
POST /api/RoomExtra/Add
POST /api/RoomExtra/GetList/ByDynamic
POST /api/RoomPrice/Add
POST /api/RoomPrice/GetList/ByDynamic
POST /api/RoomType/Add
POST /api/RoomType/GetList/ByDynamic
POST /api/SpecialDayPrice/Add
POST /api/SpecialDayPrice/GetList/ByDynamic
POST /api/TravelAgency/Add
POST /api/TravelAgency/GetList/ByDynamic
POST /api/UserOperationClaims/Add
POST /api/UserOperationClaims/GetListUserAccess/{UserId}
POST /api/UserOperationClaims/{UserId}
POST /api/UserRole/Add
POST /api/UserRole/GetListAdminNonPagingById/{UserId}
POST /api/UserRole/GetListNonPagingById/{UserId}
POST /api/UserRole/GetListUserAccess/{UserId}
POST /api/Users/Add
POST /api/Users/GetList/ByDynamic
POST /api/Users/Update
PUT /api/Booking/Update
PUT /api/Customer/Update
PUT /api/OperationClaims/Update
PUT /api/Role/Update
PUT /api/RoleOperationClaim/Update
PUT /api/Room/Update
PUT /api/RoomExtra/Update
PUT /api/RoomPrice/Update
PUT /api/RoomType/Update
PUT /api/SpecialDayPrice/Update
PUT /api/TravelAgency/Update
PUT /api/UserOperationClaims/Update
PUT /api/Users/UpdateProfile

Found on 2026-01-09 21:56

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 104.21.55.101
Domain: demoposapi.birkod.az
Port: 443
URL: https://demoposapi.birkod.az

First seen 2025-11-17 14:32
Last seen 2026-01-10 00:24
Open for 53 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549a5a10d7205e2385b894b2bb82dc7e519d52ffae8

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
DELETE /api/ContactUs/{id}
DELETE /api/EmailTemplate/{Id}
DELETE /api/InquiryAttachment/{id}
DELETE /api/Role/{Id}
DELETE /api/User/{Id}
GET /api
GET /api/Brand/{id}
GET /api/Brands
GET /api/City
GET /api/City/country
GET /api/CompanyProfile
GET /api/ContactUs
GET /api/Countries
GET /api/Country/{id}
GET /api/Currency
GET /api/Customer
GET /api/Customer/GetCustomerPayment
GET /api/Customer/GetCustomerPayment/report
GET /api/Customer/search
GET /api/Customer/walkIn
GET /api/Customer/{id}
GET /api/Customer/{id}/Exist
GET /api/Dashboard/bestsellingproduct/{month}/{year}
GET /api/Dashboard/dailyreminder/{month}/{year}
GET /api/Dashboard/halfyearlyreminder/{month}/{year}
GET /api/Dashboard/monthlyreminder/{month}/{year}
GET /api/Dashboard/onetime/{month}/{year}
GET /api/Dashboard/quarterlyreminder/{month}/{year}
GET /api/Dashboard/salesvspurchase/{month}/{year}
GET /api/Dashboard/statistics
GET /api/Dashboard/weeklyreminder/{month}/{year}
GET /api/Dashboard/yearlyreminder/{month}/{year}
GET /api/EmailSMTPSetting
GET /api/EmailSMTPSetting/{id}
GET /api/EmailTemplate
GET /api/EmailTemplate/{id}
GET /api/Expense
GET /api/Expense/report
GET /api/Expense/{id}
GET /api/Expense/{id}/download
GET /api/ExpenseCategories
GET /api/ExpenseCategory/{id}
GET /api/Inquiry
GET /api/Inquiry/{id}
GET /api/Inquiry/{id}/products
GET /api/InquiryActivity/{inquiryId}
GET /api/InquiryAttachment/{id}/download
GET /api/InquiryAttachment/{inquiryId}
GET /api/InquiryNote/{inquiryId}
GET /api/InquirySource/{id}
GET /api/InquirySources
GET /api/InquiryStatus/{id}
GET /api/InquiryStatuses
GET /api/Inventory
GET /api/Inventory/history
GET /api/LoginAudit
GET /api/NLog
GET /api/NLog/{id}
GET /api/Product
GET /api/Product/bywarehouse
GET /api/Product/detail
GET /api/Product/{id}
GET /api/ProductCategories
GET /api/ProductCategory/{id}
GET /api/PurchaseOrder
GET /api/PurchaseOrder/items/profitLoss
GET /api/PurchaseOrder/items/reports
GET /api/PurchaseOrder/newOrderNumber/{isPurchaseOrder}
GET /api/PurchaseOrder/recent/expecteddate
GET /api/PurchaseOrder/report
GET /api/PurchaseOrder/{id}
GET /api/PurchaseOrder/{id}/items
GET /api/PurchaseOrderPayment/report
GET /api/PurchaseOrderPayment/{id}
GET /api/Reminder/GetReminders
GET /api/Reminder/notification/markasread
GET /api/Reminder/notifications
GET /api/Reminder/notofication/top10
GET /api/Reminder/{id}
GET /api/ReminderScheduler/{application}/{referenceId}
GET /api/Role
GET /api/Role/{id}
GET /api/RoleUsers/{id}
GET /api/SalesOrder
GET /api/SalesOrder/items/profitLoss
GET /api/SalesOrder/items/reports
GET /api/SalesOrder/newOrderNumber
GET /api/SalesOrder/recentshipment
GET /api/SalesOrder/{id}
GET /api/SalesOrder/{id}/items
GET /api/SalesOrderPayment/report
GET /api/SalesOrderPayment/{id}
GET /api/Supplier
GET /api/Supplier/GetNewSupplier
GET /api/Supplier/GetSupplierPayment
GET /api/Supplier/{id}
GET /api/SupplierSearch
GET /api/Tax/{id}
GET /api/Taxes
GET /api/Testimonials
GET /api/Testimonials/{id}
GET /api/UnitConversation
GET /api/UnitConversation/dropDown
GET /api/User/GetAllUsers
GET /api/User/GetRecentlyRegisteredUsers
GET /api/User/GetUsers
GET /api/User/notification/count
GET /api/User/profile
GET /api/User/{id}
GET /api/Warehouse/product/{id}
GET /api/Warehouse/{id}
GET /api/Warehouse/{id}/items
GET /api/Warehouses
POST /api/Authentication
POST /api/Brand
POST /api/Country
POST /api/Email
POST /api/ExpenseCategory
POST /api/FileUpload
POST /api/InquiryActivity
POST /api/InquiryAttachment
POST /api/InquiryNote
POST /api/InquirySource
POST /api/InquiryStatus
POST /api/NewsletterSubscriber
POST /api/ProductCategory
POST /api/PurchaseOrderPayment
POST /api/Reminder
POST /api/ReminderScheduler
POST /api/SalesOrderPayment
POST /api/SendEmail/suppliers
POST /api/Tax
POST /api/User
POST /api/User/UpdateUserProfilePhoto
POST /api/User/changepassword
POST /api/User/resetpassword
POST /api/Warehouse
PUT /api/Brand/{Id}
PUT /api/City/{id}
PUT /api/Country/{Id}
PUT /api/ExpenseCategory/{Id}
PUT /api/InquiryActivity/{id}
PUT /api/InquiryNote/{id}
PUT /api/InquirySource/{Id}
PUT /api/InquiryStatus/{Id}
PUT /api/ProductCategory/{Id}
PUT /api/PurchaseOrder/{id}/return
PUT /api/SalesOrder/{id}/return
PUT /api/Tax/{Id}
PUT /api/UnitConversation/{Id}
PUT /api/UserClaim/{id}
PUT /api/Warehouse/{Id}

Found on 2026-01-10 00:24

Create report

Open service 104.21.55.101:443 · n8n.birkod.az

2026-01-11 21:16

HTTP/1.1 200 OK
Date: Sun, 11 Jan 2026 21:16:42 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
Server-Timing: cfCacheStatus;desc="DYNAMIC"
Server-Timing: cfEdge;dur=6,cfOrigin;dur=617
alt-svc: h3=":443"; ma=86400
Cache-Control: public, max-age=86400
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=5QTwN%2BWmBOObO2qGxq6z1G9hXSJen4ytKWKabng4oUYPDkaqVDS8m%2FOxlwB6MK%2BTxeJYNd3NUw9FFiBuBwPEY5%2F6y8kCjpBNHpam6Jg%3D"}]}
Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
last-modified: Tue, 02 Dec 2025 06:58:15 GMT
vary: Accept-Encoding
vary: Accept-Encoding
cf-cache-status: DYNAMIC
Server: cloudflare
CF-RAY: 9bc76fc80a88a6c4-SJC

Page title: n8n.io - Workflow Automation

<!DOCTYPE html>
<html lang="en">
	<head>
		<script type="module" crossorigin src="/assets/polyfills-deFGRMT9.js"></script>

		<meta charset="utf-8" />
		<meta http-equiv="X-UA-Compatible" content="IE=edge" />
		<meta name="viewport" content="width=device-width,initial-scale=1.0" />
		<link rel="icon" href="/favicon.ico" />
		<style>@media (prefers-color-scheme: dark) { body { background-color: rgb(45, 46, 46) } }</style>
		<script type="text/javascript">
			window.BASE_PATH = '/';
			window.REST_ENDPOINT = 'rest';
		</script>
		<script src="/rest/sentry.js"></script>
		<script>!function(t,e){var o,n,p,r;e.__SV||(window.posthog=e,e._i=[],e.init=function(i,s,a){function g(t,e){var o=e.split(".");2==o.length&&(t=t[o[0]],e=o[1]),t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}}(p=t.createElement("script")).type="text/javascript",p.async=!0,p.src=s.api_host+"/static/array.js",(r=t.getElementsByTagName("script")[0]).parentNode.insertBefore(p,r);var u=e;for(void 0!==a?u=e[a]=[]:a="posthog",u.people=u.people||[],u.toString=function(t){var e="posthog";return"posthog"!==a&&(e+="."+a),t||(e+=" (stub)"),e},u.people.toString=function(){return u.toString(1)+".people (stub)"},o="capture identify alias people.set people.set_once set_config register register_once unregister opt_out_capturing has_opted_out_capturing opt_in_capturing reset isFeatureEnabled getFeatureFlag onFeatureFlags reloadFeatureFlags".split(" "),n=0;n<o.length;n++)g(u,o[n]);e._i.push([i,s,a])},e.__SV=1)}(document,window.posthog||[])</script>

		<title>n8n.io - Workflow Automation</title>
		<script type="module" crossorigin src="/assets/index--ag0tEQM.js"></script>
		<link rel="stylesheet" crossorigin href="/assets/index-B-xWz5mo.css">
	</head>
	<body>
		<noscript>
			<strong
				>We're sorry but the n8n Editor-UI doesn't work properly without JavaScript enabled. Please
				enable it to continue.</strong
			>
		</noscript>
		<div id="app"></div>
	<script defer src="https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015" integrity="sha512-ZpsOmlRQV6y907TI0dKBHq9Md29nnaEIPlkf84rnaERnq6zvWvPUqr2ft8M1aS28oN72PdrCzSjY4U6VaAw1EQ==" data-cf-beacon='{"version":"2024.11.0","token":"d35f5d6941984c3398866107587cc458","r":1,"server_timing":{"name":{"cfCacheStatus":true,"cfEdge":true,"cfExtPri":true,"cfL4":true,"cfOrigin":true,"cfSpeedBrain":true},"location_startswith":null}}' crossorigin="anonymous"></script>
<script>(function(){function c(){var b=a.contentDocument||a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'9bc76fc80a88a6c4',t:'MTc2ODE2NjIwMQ=='};var a=document.createElement('script');a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();</script></body>
</html>

Found 8 hours ago by HttpPlugin

Domain birkod.az

Software information

Swagger API description is publicly available

Swagger API description is publicly available

birkod.az*.birkod.az

Domain summary

IP summary