LeakIX - Host chainweb.egretail-dev.cloud

Domain chainweb.egretail-dev.cloud

The Netherlands

MICROSOFT-CORP-MSN-AS-BLOCK

Software information

Microsoft-IIS 10.0

tcp/443

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 52.232.19.237
Domain: slotb.chainweb.egretail-dev.cloud
Port: 443
URL: https://slotb.chainweb.egretail-dev.cloud

First seen 2026-01-11 13:08
Last seen 2026-02-09 18:12
Open for 29 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-02-09 18:12
- Severity: info
  Fingerprint: 5733ddf49ff49cd1aad03549ac9b2cf16ae02d11e300e87c9513e4829e3761cb
```
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/Cashiers/{cashierNo}/verifyPasswordValidity
GET /api/Users
GET /api/Users/{username}
GET /api/usernotifications/{username}
POST /api/Cashiers/{cashierNo}/changePassword
POST /api/UserWithPin/activate/{azureAdTenantId}
PUT /api/usernotifications/{username}/dismiss
PUT /api/usernotifications/{username}/{id}/dismiss
```
  Found on 2026-01-23 13:16
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 52.232.19.237
Domain: slota.chainweb.egretail-dev.cloud
Port: 443
URL: https://slota.chainweb.egretail-dev.cloud

First seen 2026-01-14 09:14
Last seen 2026-01-17 09:05
Open for 2 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1aad03549ac9b2cf16ae02d11e300e87c9513e4829e3761cb
```
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/Cashiers/{cashierNo}/verifyPasswordValidity
GET /api/Users
GET /api/Users/{username}
GET /api/usernotifications/{username}
POST /api/Cashiers/{cashierNo}/changePassword
POST /api/UserWithPin/activate/{azureAdTenantId}
PUT /api/usernotifications/{username}/dismiss
PUT /api/usernotifications/{username}/{id}/dismiss
```
  Found on 2026-01-17 09:05
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 52.232.19.237
Domain: r32komow3j.chainweb.egretail-dev.cloud
Port: 443
URL: https://r32komow3j.chainweb.egretail-dev.cloud

First seen 2026-01-10 05:35
Last seen 2026-01-16 15:28
Open for 6 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1aad03549ac9b2cf16ae02d11e300e87c9513e4829e3761cb
```
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/Cashiers/{cashierNo}/verifyPasswordValidity
GET /api/Users
GET /api/Users/{username}
GET /api/usernotifications/{username}
POST /api/Cashiers/{cashierNo}/changePassword
POST /api/UserWithPin/activate/{azureAdTenantId}
PUT /api/usernotifications/{username}/dismiss
PUT /api/usernotifications/{username}/{id}/dismiss
```
  Found on 2026-01-16 15:28
Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 52.232.19.237
Domain: selfservicemonitorbackend.chainweb.egretail-dev.cloud
Port: 443
URL: https://selfservicemonitorbackend.chainweb.egretail-dev.cloud

First seen 2026-01-10 20:49
Last seen 2026-02-09 17:35
Open for 29 days

Severity: info
Fingerprint: 5733ddf49ff49cd1f3d88d60ab25fb0e97b7b05393a9b8f71c281a3f4afdf35e

Public Swagger UI/API detected at path: /swagger/v1/swagger.json - sample paths:
DELETE /api/NotificationHubAccess/unregister/{installationId}
GET /api/CachedControls/GetCartId/{storeNo}
GET /api/CachedControls/GetControls/{storeNo}
GET /api/CachedControls/GetRegisters/{storeNo}
GET /api/Configuration/GetConfiguration/{storeNumber}
GET /api/LoginApi/authorityUrl
GET /api/LoginApi/authorityUrl/{tenantId}
GET /api/NotificationHubAccess/connectionString
GET /api/SalesHistory/GetSalesHistoryForCacheRegister/{storeNumber}/{posNumber}
GET /api/StoreApi
GET /api/UserNotifications
GET /api/UserProfiles
GET /api/signalraccess/api/accesstoken
GET /api/signalraccess/hub/{hubName}/accesstoken
GET /api/signalraccess/hub/{hubName}/information
GET /api/version
POST /api/NotificationHubAccess/register/{installationId}
PUT /api/UserNotifications/dismiss
PUT /api/UserNotifications/{id}/dismiss

Found on 2026-02-09 17:35

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 52.232.19.237
Domain: chainweb.egretail-dev.cloud
Port: 443
URL: https://chainweb.egretail-dev.cloud

First seen 2026-01-13 05:34
Last seen 2026-02-09 16:28
Open for 27 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1aad03549ac9b2cf16ae02d11e300e87c9513e4829e3761cb
```
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/Cashiers/{cashierNo}/verifyPasswordValidity
GET /api/Users
GET /api/Users/{username}
GET /api/usernotifications/{username}
POST /api/Cashiers/{cashierNo}/changePassword
POST /api/UserWithPin/activate/{azureAdTenantId}
PUT /api/usernotifications/{username}/dismiss
PUT /api/usernotifications/{username}/{id}/dismiss
```
  Found on 2026-02-09 16:28
Create report

Open service 52.232.19.237:443 · slotb.customerorderv2management.chainweb.egretail-dev.cloud

2026-01-26 12:43

HTTP/1.1 200 OK
Content-Length: 24391
Connection: close
Content-Type: text/html
Date: Mon, 26 Jan 2026 12:43:50 GMT
Server: Microsoft-IIS/10.0
Accept-Ranges: bytes
ETag: "1dc8eb3c7ffb547"
Last-Modified: Mon, 26 Jan 2026 11:06:12 GMT
Set-Cookie: ARRAffinity=77f12f85c9afc4c4219e1ebcbabf3c363c124c1272c6f1766e41bee0c3ed9b13;Path=/;HttpOnly;Secure;Domain=slotb.customerorderv2management.chainweb.egretail-dev.cloud
Set-Cookie: ARRAffinitySameSite=77f12f85c9afc4c4219e1ebcbabf3c363c124c1272c6f1766e41bee0c3ed9b13;Path=/;HttpOnly;SameSite=None;Secure;Domain=slotb.customerorderv2management.chainweb.egretail-dev.cloud
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Request-Context: appId=cid-v1:ddc69cf7-c04b-4756-badc-fcaf7553f2f1
X-Content-Type-Options: nosniff
X-Frame-Options: sameorigin
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' ; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; img-src 'self' data: https://chainweb.egretail-dev.cloud https://r32komow3j.chainweb.egretail-dev.cloud blob:; font-src 'self' https://fonts.gstatic.com data: https://kendo.cdn.telerik.com; connect-src 'self' https://chainweb.egretail-dev.cloud https://r32komow3j.chainweb.egretail-dev.cloud https://devtest-shellcommon.service.signalr.net ws://devtest-shellcommon.service.signalr.net https://dc.services.visualstudio.com; object-src 'none'; frame-ancestors 'self'; frame-src 'self' https://chainweb.egretail-dev.cloud https://r32komow3j.chainweb.egretail-dev.cloud; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-downloads allow-modals; base-uri 'self'; upgrade-insecure-requests;
Referrer-Policy: no-referrer
X-Powered-By: ASP.NET

Page title: Customer Order Management

<!doctype html>
<html lang="en" data-critters-container>
<head><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
  <meta charset="utf-8">
  <title>Customer Order Management</title>
  <base href="/">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <link rel="icon" type="image/x-icon" href="favicon.png">
  <style type="text/css">@font-face{font-family:'Roboto';font-style:normal;font-weight:300;font-stretch:100%;src:url(https://fonts.gstatic.com/s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3GUBHMdazTgWw.woff2) format('woff2');unicode-range:U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}@font-face{font-family:'Roboto';font-style:normal;font-weight:300;font-stretch:100%;src:url(https://fonts.gstatic.com/s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3iUBHMdazTgWw.woff2) format('woff2');unicode-range:U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;}@font-face{font-family:'Roboto';font-style:normal;font-weight:300;font-stretch:100%;src:url(https://fonts.gstatic.com/s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3CUBHMdazTgWw.woff2) format('woff2');unicode-range:U+1F00-1FFF;}@font-face{font-family:'Roboto';font-style:normal;font-weight:300;font-stretch:100%;src:url(https://fonts.gstatic.com/s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3-UBHMdazTgWw.woff2) format('woff2');unicode-range:U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}@font-face{font-family:'Roboto';font-style:normal;font-weight:300;font-stretch:100%;src:url(https://fonts.gstatic.com/s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMawCUBHMdazTgWw.woff2) format('woff2');unicode-range:U+0302-0303, U+0305, U+0307-0308, U+0310, U+0312, U+0315, U+031A, U+0326-0327, U+032C, U+032F-0330, U+0332-0333, U+0338, U+033A, U+0346, U+034D, U+0391-03A1, U+03A3-03A9, U+03B1-03C9, U+03D1, U+03D5-03D6, U+03F0-03F1, U+03F4-03F5, U+2016-2017, U+2034-2038, U+203C, U+2040, U+2043, U+2047, U+2050, U+2057, U+205F, U+2070-2071, U+2074-208E, U+2090-209C, U+20D0-20DC, U+20E1, U+20E5-20EF, U+2100-2112, U+2114-2115, U+2117-2121, U+2123-214F, U+2190, U+2192, U+2194-21AE, U+21B0-21E5, U+21F1-21F2, U+21F4-2211, U+2213-2214, U+2216-22FF, U+2308-230B, U+2310, U+2319, U+231C-2321, U+2336-237A, U+237C, U+2395, U+239B-23B7, U+23D0, U+23DC-23E1, U+2474-2475, U+25AF, U+25B3, U+25B7, U+25BD, U+25C1, U+25CA, U+25CC, U+25FB, U+266D-266F, U+27C0-27FF, U+2900-2AFF, U+2B0E-2B11, U+2B30-2B4C, U+2BFE, U+3030, U+FF5B, U+FF5D, U+1D400-1D7FF, U+1EE00-1EEFF;}@font-face{font-family:'Roboto';font-style:normal;font-weight:300;font-stretch:100%;src:url(https://fonts.gstatic.com/s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMaxKUBHMdazTgWw.woff2) format('woff2');unicode-range:U+0001-000C, U+000E-001F, U+007F-009F, U+20DD-20E0, U+20E2-20E4, U+2150-218F, U+2190, U+2192, U+2194-2199, U+21AF, U+21E6-21F0, U+21F3, U+2218-2219, U+2299, U+22C4-22C6, U+2300-243F, U+2440-244A, U+2460-24FF, U+25A0-27BF, U+2800-28FF, U+2921-2922, U+2981, U+29BF, U+29EB, U+2B00-2BFF, U+4DC0-4DFF, U+FFF9-FFFB, U+10140-1018E, U+10190-1019C, U+101A0, U+101D0-101FD, U+102E0-102FB, U+10E60-10E7E, U+1D2C0-1D2D3, U+1D2E0-1D37F, U+1F000-1F0FF, U+1F100-1F1AD, U+1F1E6-1F1FF, U+1F30D-1F30F, U+1F315, U+1F31C, U+1F31E, U+1F320-1F32C, U+1F336, U+1F378, U+1F37D, U+1F382, U+1F393-1F39F, U+1F3A7-1F3A8, U+1F3AC-1F3AF, U+1F3C2, U+1F3C4-1F3C6, U+1F3CA-1F3CE, U+1F3D4-1F3E0, U+1F3ED, U+1F3F1-1F3F3, U+1F3F5-1F3F7, U+1F408, U+1F415, U+1F41F, U+1F426, U+1F43F, U+1F441-1F442, U+1F444, U+1F446-1F449, U+1F44C-1F44E, U+1F453, U+1F46A, U+1F47D, U+1F4A3, U+1F4B0, U+1F4B3, U+1F4B9, U+1F4BB, U+1F4BF, U+1F4C8-1F4CB, U+1F4D6, U+1F4DA, U+1F4DF, U+1F4E3-1F4E6, U+1F4EA-1F4ED, U+1F4F7, U+1F4F9-1F4FB, U+1F4FD-1F4FE, U+1F503, U+1F507-1F50B, U+1F50D, U+1F512-1F513, U+1F53E-1F54A, U+1F54F-1F5FA, U+1F610, U+1F650-1F67F, U+1F687, U+1F68D, U+1F691, U+1F694, U+1F698, U+1F6AD, U+1F6B2, U+1F6B9-1F6BA, U+1F6BC, U+1F6C6-1F6CF, U+1F6D3-1F6D7, U+1F6E0-1F6EA, U+1F6F0-1F6F3, U+1F6F7-1F6FC, U+1F700-1F7FF, U+1F800-1F80B, U+1F810-1F847, U+1F850-1F859, U+1F860-1F887, U+1F890-1F8AD, U+1F8B0-1F8BB, U+1F8C0-1

Found 2026-01-26 by HttpPlugin

Domain chainweb.egretail-dev.cloud

The Netherlands

Software information

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

inventorymanagement.chainweb.egretail-dev.cloud

chainweb.egretail-dev.cloud

selfservicemonitorbackend.chainweb.egretail-dev.cloud

slotb.chainweb.egretail-dev.cloud

instoremanagement.chainweb.egretail-dev.cloud

slotb.chainweb.egretail-dev.cloud

customerorderv2management.chainweb.egretail-dev.cloud

slotb.inventorymanagement.chainweb.egretail-dev.cloud

posmanagement.chainweb.egretail-dev.cloud

productcatalog.chainweb.egretail-dev.cloud

mobileposmanagement.chainweb.egretail-dev.cloud

slota.promotionmanagement.chainweb.egretail-dev.cloud

slota.giftcardmanagement.chainweb.egretail-dev.cloud

travelmanagement.chainweb.egretail-dev.cloud

slotb.procurementmanagement.chainweb.egretail-dev.cloud

selfservicemonitorbackend.chainweb.egretail-dev.cloud

dispatchmanagement.chainweb.egretail-dev.cloud

slota.procurementmanagement.chainweb.egretail-dev.cloud

bonusmanagement.chainweb.egretail-dev.cloud

slota.storemanagement.chainweb.egretail-dev.cloud

filemanagement.chainweb.egretail-dev.cloud

memberinfomanagement.chainweb.egretail-dev.cloud

inventorymanagement.chainweb.egretail-dev.cloud

paymentservicemanagement.chainweb.egretail-dev.cloud

paymentmanagement.chainweb.egretail-dev.cloud

slotb.promotionmanagement.chainweb.egretail-dev.cloud

messagedistributionmanagement.chainweb.egretail-dev.cloud

giftcardmanagement.chainweb.egretail-dev.cloud

promotionmanagement.chainweb.egretail-dev.cloud

r32komow3j.chainweb.egretail-dev.cloud

storemanagement.chainweb.egretail-dev.cloud

Domain summary

IP summary