LeakIX - Host bumc-api.durate.com

Domain bumc-api.durate.com

United States

RAILWAY

Software information

railway-edge

tcp/443

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 66.33.22.164
Domain: bumc-api.durate.com
Port: 443
URL: https://bumc-api.durate.com

First seen 2025-10-24 19:15
Last seen 2026-02-01 18:51
Open for 99 days

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa31a0bbaa31a0bbaa31a0bbaa31a0bbaa31a0bbaa3
```
GraphQL introspection enabled at /graphql
```
Found on 2026-02-01 18:51

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa31d4513006f05f7c44c62faeff511b2831f7b8266

GraphQL introspection enabled at /graphql
Types: 1001 (by kind: ENUM: 120, INPUT_OBJECT: 678, INTERFACE: 1, OBJECT: 194, SCALAR: 8)
Operations:
- Query: Query | fields: getInvitationMetadata, getPublicUserInfo, userMany, userOne, userVerify
- Mutation: Mutation | fields: overridenRotationNotifyUser, processNaturalLanguage, shiftSwapNotifyAll, shiftSwapNotifySendTradeOffer, shiftSwapNotifyShiftBought
- Subscription: Subscription | fields: scheduleViewerAdded, scheduleViewerRemoved, scheduleViewersUpdated
Directives: deprecated, include, skip (total: 3)

Found on 2025-12-01 06:27

1.5 MBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3509e48360df836a6edc899a8cd6f710e743cdd01

GraphQL introspection enabled at /graphql
Types: 1000 (by kind: ENUM: 120, INPUT_OBJECT: 678, INTERFACE: 1, OBJECT: 193, SCALAR: 8)
Operations:
- Query: Query | fields: getPublicUserInfo, staffGroupOne, userMany, userOne, userVerify
- Mutation: Mutation | fields: overridenRotationNotifyUser, processNaturalLanguage, shiftSwapNotifyAll, shiftSwapNotifySendTradeOffer, shiftSwapNotifyShiftBought
- Subscription: Subscription | fields: scheduleViewerAdded, scheduleViewerRemoved, scheduleViewersUpdated
Directives: deprecated, include, skip (total: 3)

Found on 2025-11-14 22:21

1.5 MBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa33bcf9ec657c1a336b7e34a78d08d123e716ab711

GraphQL introspection enabled at /graphql
Types: 956 (by kind: ENUM: 114, INPUT_OBJECT: 646, INTERFACE: 1, OBJECT: 187, SCALAR: 8)
Operations:
- Query: Query | fields: getPublicUserInfo, staffGroupOne, userMany, userOne, userVerify
- Mutation: Mutation | fields: overridenRotationNotifyUser, processNaturalLanguage, shiftSwapNotifyAll, shiftSwapNotifySendTradeOffer, shiftSwapNotifyShiftBought
- Subscription: Subscription | fields: scheduleViewerAdded, scheduleViewerRemoved, scheduleViewersUpdated
Directives: deprecated, include, skip (total: 3)

Found on 2025-11-12 18:41

1.5 MBytes

Create report

Open service 66.33.22.164:443 · bumc-api.durate.com

2026-01-23 10:29

HTTP/1.1 404 Not Found
Access-Control-Allow-Credentials: true
Content-Length: 139
Content-Security-Policy: default-src 'none'
Content-Type: text/html; charset=utf-8
Date: Fri, 23 Jan 2026 10:29:38 GMT
Server: railway-edge
Vary: Origin
X-Clerk-Auth-Reason: session-token-and-uat-missing
X-Clerk-Auth-Status: signed-out
X-Content-Type-Options: nosniff
X-Powered-By: Express
X-Railway-Edge: railway/europe-west4-drams3a
X-Railway-Request-Id: UZTKCz5GRzas4DrwN8N_Fg
Connection: close

Page title: Error

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Error</title>
</head>
<body>
<pre>Cannot GET /</pre>
</body>
</html>

Found 2026-01-23 by HttpPlugin

Create report

bumc-api.durate.com

Fingerprint:

d407a26ae67e9b1d9b52436c6e1f983bc5f255c87386b98d1b01d2b467aa33a9

CN:

bumc-api.durate.com

Key:

RSA-2048

Issuer:

R13

Not before:

2025-11-28 17:07

Not after:

2026-02-26 17:07

Domain summary

bumc-api.durate.com 4

1 recorded

IP summary

66.33.22.164 2

1 recorded