LeakIX - Host crif.com

Domain crif.com

Italy

Akamai International B.V.

Software information

AmazonS3

tcp/443

CloudFront

tcp/443 tcp/80

awselb awselb 2.0

tcp/443 tcp/80

istio-envoy

tcp/443

nginx nginx 1.27.5

tcp/443

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 212.7.73.124
Domain: neos-portal-svc-ext.crif.com
Port: 443
URL: https://neos-portal-svc-ext.crif.com

First seen 2026-01-09 09:38
Last seen 2026-02-09 18:52
Open for 31 days

Severity: info
Fingerprint: 5733ddf49ff49cd1a8bcc6e561d08ecf7d7bb841b97f37a47096a1db4a8f5839

Public Swagger UI/API detected at path: /webjars/swagger-ui/index.html - sample paths:
DELETE /api/connections/{connectionId}
GET /api/account/accounts
GET /api/accountTransactions/report
GET /api/organizations/{tenantid}/rest/orgs
GET /api/providers
GET /api/providers/{providerId}
GET /api/roles/{tenantid}/rest/roles/{roleName}
GET /api/sessions/current
GET /api/subjects/{subjectId}/analiticsReport
GET /api/subjects/{subjectId}/reports
GET /api/users/{username}
POST /api/chart/balance
POST /api/chart/cashInOut
POST /api/chart/donut
POST /api/chart/line
POST /api/chart/marketing
POST /api/chart/saving
POST /api/chart/score
POST /api/chart/scoreBar
POST /api/chart/shock
POST /api/connections/{connectionId}/refetch
POST /api/errors
POST /api/oru/visibleUsers
POST /api/preview/email
POST /api/preview/sms
POST /api/sessions/orgs
POST /api/subjects
POST /api/subjects/csv
POST /api/subjects/search
POST /api/widget/connect
POST /api/widget/reconnect
POST /public/notifications/connectionFailure
POST /public/notifications/connectionSuccess
PUT /api/organizations/{tenantid}/rest/orgs/extAttrs/{extAttrName}/items/{itemName}
PUT /api/oru/extAttrs/{username}/{extAttr}
PUT /api/roles/{tenantid}/rest/roles/{roleName}/resources/{resourceName}
PUT /api/roles/{tenantid}/rest/users/{username}/orgs
PUT /api/roles/{tenantid}/rest/users/{username}/roles/{roleName}
PUT /api/subjects/{subjectId}

Found on 2026-02-09 18:52

Severity: info
Fingerprint: 5733ddf49ff49cd1926e27d0926e27d0926e27d0926e27d0926e27d0926e27d0
```
Public Swagger UI/API detected at path: /webjars/swagger-ui/index.html
```
Found on 2026-01-09 09:38

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 212.7.73.167
Domain: biapi-uat.crif.com
Port: 443
URL: https://biapi-uat.crif.com

First seen 2025-12-02 11:22
Last seen 2026-02-09 17:21
Open for 69 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-02-09 17:21
- Severity: info
  Fingerprint: 5733ddf49ff49cd1aad03549bb404bb5bb404bb5bb404bb5bb404bb5bb404bb5
```
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /reports/{fileName}
```
  Found on 2026-01-23 11:28
Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 212.7.73.121
Domain: neos-portal-svc.crif.com
Port: 443
URL: https://neos-portal-svc.crif.com

First seen 2025-11-16 07:02
Last seen 2026-02-09 16:27
Open for 85 days

Severity: info
Fingerprint: 5733ddf49ff49cd1926e27d0926e27d0926e27d0926e27d0926e27d0926e27d0
```
Public Swagger UI/API detected at path: /webjars/swagger-ui/index.html
```
Found on 2026-02-09 16:27

Severity: info
Fingerprint: 5733ddf49ff49cd1a8bcc6e561d08ecf7d7bb841b97f37a47096a1db4a8f5839

Public Swagger UI/API detected at path: /webjars/swagger-ui/index.html - sample paths:
DELETE /api/connections/{connectionId}
GET /api/account/accounts
GET /api/accountTransactions/report
GET /api/organizations/{tenantid}/rest/orgs
GET /api/providers
GET /api/providers/{providerId}
GET /api/roles/{tenantid}/rest/roles/{roleName}
GET /api/sessions/current
GET /api/subjects/{subjectId}/analiticsReport
GET /api/subjects/{subjectId}/reports
GET /api/users/{username}
POST /api/chart/balance
POST /api/chart/cashInOut
POST /api/chart/donut
POST /api/chart/line
POST /api/chart/marketing
POST /api/chart/saving
POST /api/chart/score
POST /api/chart/scoreBar
POST /api/chart/shock
POST /api/connections/{connectionId}/refetch
POST /api/errors
POST /api/oru/visibleUsers
POST /api/preview/email
POST /api/preview/sms
POST /api/sessions/orgs
POST /api/subjects
POST /api/subjects/csv
POST /api/subjects/search
POST /api/widget/connect
POST /api/widget/reconnect
POST /public/notifications/connectionFailure
POST /public/notifications/connectionSuccess
PUT /api/organizations/{tenantid}/rest/orgs/extAttrs/{extAttrName}/items/{itemName}
PUT /api/oru/extAttrs/{username}/{extAttr}
PUT /api/roles/{tenantid}/rest/roles/{roleName}/resources/{resourceName}
PUT /api/roles/{tenantid}/rest/users/{username}/orgs
PUT /api/roles/{tenantid}/rest/users/{username}/roles/{roleName}
PUT /api/subjects/{subjectId}

Found on 2026-01-02 19:11

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 212.7.73.126
Domain: biapi.crif.com
Port: 443
URL: https://biapi.crif.com

First seen 2025-12-02 11:26
Last seen 2026-02-09 17:43
Open for 69 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1aad03549bb404bb5bb404bb5bb404bb5bb404bb5bb404bb5
```
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /reports/{fileName}
```
  Found on 2026-02-09 17:43
- Severity: info
  Fingerprint: 5733ddf49ff49cd1f3d88d60afe542b6afe542b6afe542b6afe542b6afe542b6
```
Public Swagger UI/API detected at path: /swagger/v1/swagger.json - sample paths:
GET /reports/{fileName}
```
  Found on 2026-01-02 18:02
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 212.7.73.124
Domain: neos-widget-svc-hot.crif.com
Port: 443
URL: https://neos-widget-svc-hot.crif.com

First seen 2026-01-09 09:57
Last seen 2026-02-09 14:07
Open for 31 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd151e75e4b302228b00b248fb3c3b18b1745c869287ad89d03
```
Public Swagger UI/API detected at path: /v3/api-docs - sample paths:
DELETE /connections/{connectionBusinessId}
GET /countries
GET /isValidToken
GET /providers
GET /providers/{providerBusinessId}
POST /approve
POST /connections
POST /connections/{connectionBusinessId}/authorize
POST /connections/{connectionBusinessId}/reconnect
POST /errors
POST /histories
POST /setup
```
  Found on 2026-02-09 14:07
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 212.7.73.30
Domain: easycaice.crif.com
Port: 443
URL: https://easycaice.crif.com

First seen 2025-11-05 15:36
Last seen 2026-01-17 00:32
Open for 72 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd151e75e4b7a0bfca3720fef5df4ab050d2597d8f08ffb4c3a
```
Public Swagger UI/API detected at path: /v3/api-docs - sample paths:
DELETE /public/cache/authentications
GET /cf/web/rest/appconfig
GET /cff-ptf-gateway/{brickServiceName}/web/rest/appconfig
GET /eureka/apps
GET /public/cache
GET /public/swagger/info
GET /swagger/reload
GET /web/bac/rest/appconfig
GET /welcome
GET /{brickServiceName}/web/rest/appconfig
```
  Found on 2026-01-17 00:32
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 212.7.72.19
Domain: cashflows-uat.crif.com
Port: 443
URL: https://cashflows-uat.crif.com

First seen 2025-10-22 08:25
Last seen 2026-02-09 14:11
Open for 110 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd110a331ec2d35ea6f564d5663eeded5383db40de49939400a
```
Public Swagger UI/API detected at path: /v2/api-docs - sample paths:
GET /
GET /actuator/gateway/globalfilters
GET /actuator/gateway/routedefinitions
GET /actuator/gateway/routefilters
GET /actuator/gateway/routepredicates
GET /actuator/gateway/routes
GET /actuator/gateway/routes/{id}
GET /actuator/gateway/routes/{id}/combinedfilters
GET /cf/web/rest/appconfig
GET /cff-ptf-gateway/{brickServiceName}/web/rest/appconfig
GET /eureka/apps
GET /web/bac
GET /web/bac/rest/appconfig
GET /web/portal
GET /welcome
GET /{brickServiceName}/web/rest/appconfig
POST /actuator/gateway/refresh
```
  Found on 2026-02-09 14:11
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 212.7.73.158
Domain: neos-widget-svc-int.crif.com
Port: 443
URL: https://neos-widget-svc-int.crif.com

First seen 2026-01-09 10:13
Last seen 2026-02-09 10:53
Open for 31 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd151e75e4b302228b00b248fb3c3b18b1745c869287ad89d03
```
Public Swagger UI/API detected at path: /v3/api-docs - sample paths:
DELETE /connections/{connectionBusinessId}
GET /countries
GET /isValidToken
GET /providers
GET /providers/{providerBusinessId}
POST /approve
POST /connections
POST /connections/{connectionBusinessId}/authorize
POST /connections/{connectionBusinessId}/reconnect
POST /errors
POST /histories
POST /setup
```
  Found on 2026-02-09 10:53
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 212.7.73.124
Domain: neos-widget-svc-ext.crif.com
Port: 443
URL: https://neos-widget-svc-ext.crif.com

First seen 2026-01-09 09:47
Last seen 2026-02-09 06:45
Open for 30 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd151e75e4b302228b00b248fb3c3b18b1745c869287ad89d03
```
Public Swagger UI/API detected at path: /v3/api-docs - sample paths:
DELETE /connections/{connectionBusinessId}
GET /countries
GET /isValidToken
GET /providers
GET /providers/{providerBusinessId}
POST /approve
POST /connections
POST /connections/{connectionBusinessId}/authorize
POST /connections/{connectionBusinessId}/reconnect
POST /errors
POST /histories
POST /setup
```
  Found on 2026-02-09 06:45
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 212.7.73.121
Domain: neos-widget-svc.crif.com
Port: 443
URL: https://neos-widget-svc.crif.com

First seen 2025-11-16 07:02
Last seen 2026-01-02 04:18
Open for 46 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd151e75e4b302228b00b248fb3c3b18b1745c869287ad89d03
```
Public Swagger UI/API detected at path: /v3/api-docs - sample paths:
DELETE /connections/{connectionBusinessId}
GET /countries
GET /isValidToken
GET /providers
GET /providers/{providerBusinessId}
POST /approve
POST /connections
POST /connections/{connectionBusinessId}/authorize
POST /connections/{connectionBusinessId}/reconnect
POST /errors
POST /histories
POST /setup
```
  Found on 2026-01-02 04:18
Create report

Open service 212.7.72.20:443 · esg-gate.crif.com

2026-01-26 09:22

HTTP/1.1 200 
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Content-Type: text/html
Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Mon, 26 Jan 2026 09:22:35 GMT
Keep-Alive: timeout=20
Accept-Ranges: bytes
ETag: W/"22794-1761290039759"
X-Content-Type-Options: nosniff
Connection: close
Last-Modified: Fri, 24 Oct 2025 07:13:59 GMT
Content-Length: 22794


<!-- <!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>cmp-esg</title>
  <base href="/">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <link rel="icon" type="image/x-icon" href="favicon.ico">
  <link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css?family=Montserrat:100" rel="stylesheet">
<link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.5.0/css/all.css" integrity="sha384-B4dIYHKNBt8Bc12p+WXckhzcICo0wtJAoU8YZTY5qE0Id1GSseTk6S+L3BlXeVIU" crossorigin="anonymous">
</head>
<body>
  <app-root></app-root>
</body>
</html> --><!DOCTYPE html><html lang="en"><head>
  <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css" integrity="sha384-ggOyR0iXCbMQv3Xipma34MD+dH/1fQ784/j6cY/iJTQUOhcWr7x9JvoRxT2MZw1T" crossorigin="anonymous">
  <script src="https://code.jquery.com/jquery-3.3.1.slim.min.js" integrity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo" crossorigin="anonymous"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js" integrity="sha384-UO2eT0CpHqdSJQ6hJty5KVphtPhzWj9WO1clHTMGa3JDZwrnQq4sF86dIHNDz0W1" crossorigin="anonymous"></script>
<script src="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js" integrity="sha384-JjSmVgyd0p3pXB1rRibZUAYoIIy6OrQ6VrjIEaFf/nJGzIxFDsf4x0xIM+B07jRM" crossorigin="anonymous"></script>
<!--  <script id="usercentrics-cmp" src="https://app.usercentrics.eu/browser-ui/latest/loader.js" data-version="preview" data-settings-id="BenZqU4lGykUom" async></script> -->
 <script id="usercentrics-cmp" src="https://app.usercentrics.eu/browser-ui/latest/loader.js" data-settings-id="BenZqU4lGykUom" async=""></script>

  <meta charset="utf-8">
  <title></title>
  <base href="/">
  <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
  <link rel="icon" type="image/x-icon" href="favicon.ico">
  <!-- Font Montserrat -->
  <link rel="preconnect" href="https://fonts.googleapis.com">
  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin="">


  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/8.0.0/normalize.min.css" integrity="sha512-Yu3tDzlofwBycOX5qb6K4tGJKGD72LA/9ckyioo8plGOdLwIeESQgo+KY4M+gvBJvDguqYeweLVTIn+S/9ZC/Q==" crossorigin="anonymous" referrerpolicy="no-referrer">



  <!-- Stili indispensabili -->
  <style type="text/css">@font-face{font-family:'Montserrat';font-style:italic;font-weight:400;font-display:swap;src:url(https://fonts.gstatic.com/s/montserrat/v31/JTUQjIg1_i6t8kCHKm459WxRxC7m0dR9pBOi.woff2) format('woff2');unicode-range:U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}@font-face{font-family:'Montserrat';font-style:italic;font-weight:400;font-display:swap;src:url(https://fonts.gstatic.com/s/montserrat/v31/JTUQjIg1_i6t8kCHKm459WxRzS7m0dR9pBOi.woff2) format('woff2');unicode-range:U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;}@font-face{font-family:'Montserrat';font-style:italic;font-weight:400;font-display:swap;src:url(https://fonts.gstatic.com/s/montserrat/v31/JTUQjIg1_i6t8kCHKm459WxRxi7m0dR9pBOi.woff2) format('woff2');unicode-range:U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;}@font-face{font-family:'Montserrat';font-style:italic;font-weight:400;font-display:swap;src:url(https://fonts.gstatic.com/s/montserrat/v31/JTUQjIg1_i6t8kCHKm459WxRxy7m0dR9pBOi.woff2) format('woff2');unicode-range:U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;}@font-face{font-family:'Montserrat';font-style:italic;font-weight:400;font-display:swap;src:url(https://fonts.gstatic.com/s/montserrat/v31/JTUQjIg1_i6t8kCHKm459WxRyS7m0dR9pA.woff2) forma

Found 2026-01-26 by HttpPlugin

Domain crif.com

Italy

Software information

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

esg-gate.crif.com

biapi.crif.com

at-uat.margo.crif.com

www.margo.crif.comwww.margo.crif.itwww.margo.cribis.itwww.margo.cribis.commargo.crif.itmargo-f5.crif.commargo.crif.com

ch-uat.margo.crif.com

biapi-uat.crif.com

studio-iam.crif.com

neos-widget-hot.crif.comneos-widget-svc-hot.crif.com

neos-portal-ext.crif.comneos-portal-svc-ext.crif.com

neos-portal-svc.crif.com

cbist-uat.web.crif.com

dra-ux.crif.comdra-uat.crif.com

api.elavondigital.crif.com

auth.preprod.elavondigital.crif.com

auth.elavondigital.crif.com

api.preprod.elavondigital.crif.com

financemeeting.crif.com

www.financemeeting.crif.com

crif.com

www.crif.com

hermes-uat.crif.comadminx-hermes-uat.crif.com

easycaice.crif.comeasycaice-ocp.crif.com

www.margo-uat.crif.commargo-uat.crif.com

neos-widget.crif.comneos-widget-svc.crif.com

neos-widget-int.crif.comneos-widget-svc-int.crif.com

neos-widget-hot.crif.comneos-widget-svc-hot.crif.com

neos-widget-ext.crif.comneos-widget-svc-ext.crif.com

neos-portal-ext.crif.comneos-portal-svc-ext.crif.com

cashflows-uat.crif.comwww.cashflows-uat.crif.com

margolaunchpad.crif.com

hosted.unityfOne.s1ur.crif.com

status.crif.com

Domain summary

IP summary