LeakIX - Host development.kanzleipilot.de

Domain development.kanzleipilot.de

Germany

Outscale SASU

Software information

Netlify

tcp/443 tcp/80

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 35.157.26.135
Domain: development.kanzleipilot.de
Port: 443
URL: https://development.kanzleipilot.de

First seen 2025-11-03 03:02
Last seen 2026-01-02 02:12
Open for 59 days

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa354a4d27a29cb2f2abc0fc735cb5e18baaa0f10ce

GraphQL introspection enabled at /graphql
Types: 298 (by kind: ENUM: 37, INPUT_OBJECT: 103, OBJECT: 147, SCALAR: 10, UNION: 1)
Operations:
- Query: Query | fields: categories, categoryItem, categoryItems, libraryCategories, validateAllItemPricingFormulas
- Mutation: Mutation | fields: copyCategoryItem, createCategoryItem, deleteCategoryItem, duplicateCategoryItem, moveCategoryItem
- Subscription: Subscription | fields: cpuGraph, cpuUsage, logLine, memUsage, notification
Directives: auth, deprecated, dev, include, oneOf, signeeAuth, skip, specifiedBy, superAdminOrDev (total: 9)

Found on 2026-01-02 02:12

370.9 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa32a97a61ad087978a7c727cd5db1843dafdba0fae

GraphQL introspection enabled at /graphql
Types: 297 (by kind: ENUM: 37, INPUT_OBJECT: 103, OBJECT: 146, SCALAR: 10, UNION: 1)
Operations:
- Query: Query | fields: categories, categoryItem, categoryItems, libraryCategories, validateAllItemPricingFormulas
- Mutation: Mutation | fields: copyCategoryItem, createCategoryItem, deleteCategoryItem, duplicateCategoryItem, moveCategoryItem
- Subscription: Subscription | fields: cpuGraph, cpuUsage, logLine, memUsage, notification
Directives: auth, deprecated, dev, include, oneOf, signeeAuth, skip, specifiedBy, superAdminOrDev (total: 9)

Found on 2025-11-10 16:35

369.8 kBytes

Create report

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 109.232.236.90
Domain: ws.development.kanzleipilot.de
Port: 80
URL: http://ws.development.kanzleipilot.de

First seen 2025-11-04 10:12
Last seen 2026-01-03 10:14
Open for 60 days

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa354a4d27a29cb2f2abc0fc735cb5e18baaa0f10ce

GraphQL introspection enabled at /graphql
Types: 298 (by kind: ENUM: 37, INPUT_OBJECT: 103, OBJECT: 147, SCALAR: 10, UNION: 1)
Operations:
- Query: Query | fields: categories, categoryItem, categoryItems, libraryCategories, validateAllItemPricingFormulas
- Mutation: Mutation | fields: copyCategoryItem, createCategoryItem, deleteCategoryItem, duplicateCategoryItem, moveCategoryItem
- Subscription: Subscription | fields: cpuGraph, cpuUsage, logLine, memUsage, notification
Directives: auth, deprecated, dev, include, oneOf, signeeAuth, skip, specifiedBy, superAdminOrDev (total: 9)

Found on 2026-01-03 10:14

370.9 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa32a97a61ad087978a7c727cd5db1843dafdba0fae

GraphQL introspection enabled at /graphql
Types: 297 (by kind: ENUM: 37, INPUT_OBJECT: 103, OBJECT: 146, SCALAR: 10, UNION: 1)
Operations:
- Query: Query | fields: categories, categoryItem, categoryItems, libraryCategories, validateAllItemPricingFormulas
- Mutation: Mutation | fields: copyCategoryItem, createCategoryItem, deleteCategoryItem, duplicateCategoryItem, moveCategoryItem
- Subscription: Subscription | fields: cpuGraph, cpuUsage, logLine, memUsage, notification
Directives: auth, deprecated, dev, include, oneOf, signeeAuth, skip, specifiedBy, superAdminOrDev (total: 9)

Found on 2025-11-06 14:41

369.8 kBytes

Create report

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 5.104.101.30
Domain: ws.development.kanzleipilot.de
Port: 443
URL: https://ws.development.kanzleipilot.de

First seen 2025-11-04 10:12
Last seen 2026-01-03 10:14
Open for 60 days

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa354a4d27a29cb2f2abc0fc735cb5e18baaa0f10ce

GraphQL introspection enabled at /graphql
Types: 298 (by kind: ENUM: 37, INPUT_OBJECT: 103, OBJECT: 147, SCALAR: 10, UNION: 1)
Operations:
- Query: Query | fields: categories, categoryItem, categoryItems, libraryCategories, validateAllItemPricingFormulas
- Mutation: Mutation | fields: copyCategoryItem, createCategoryItem, deleteCategoryItem, duplicateCategoryItem, moveCategoryItem
- Subscription: Subscription | fields: cpuGraph, cpuUsage, logLine, memUsage, notification
Directives: auth, deprecated, dev, include, oneOf, signeeAuth, skip, specifiedBy, superAdminOrDev (total: 9)

Found on 2026-01-03 10:14

370.9 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa32a97a61ad087978a7c727cd5db1843dafdba0fae

GraphQL introspection enabled at /graphql
Types: 297 (by kind: ENUM: 37, INPUT_OBJECT: 103, OBJECT: 146, SCALAR: 10, UNION: 1)
Operations:
- Query: Query | fields: categories, categoryItem, categoryItems, libraryCategories, validateAllItemPricingFormulas
- Mutation: Mutation | fields: copyCategoryItem, createCategoryItem, deleteCategoryItem, duplicateCategoryItem, moveCategoryItem
- Subscription: Subscription | fields: cpuGraph, cpuUsage, logLine, memUsage, notification
Directives: auth, deprecated, dev, include, oneOf, signeeAuth, skip, specifiedBy, superAdminOrDev (total: 9)

Found on 2025-11-08 21:45

369.8 kBytes

Create report

Open service 35.157.26.135:443 · development.kanzleipilot.de

2026-01-09 04:52

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4
Cache-Control: public,max-age=0,must-revalidate
Cache-Status: "Netlify Edge"; hit
Content-Length: 2174
Content-Type: text/html; charset=UTF-8
Date: Fri, 09 Jan 2026 04:52:12 GMT
Etag: "6de53f6931e89b1b79c4ab5f1db89d72-ssl"
Server: Netlify
Strict-Transport-Security: max-age=31536000
X-Nf-Request-Id: 01KEGHJ3D8P7K4SC6T9FWZYZRB
Connection: close

Page title: KanzleiPilot

<!DOCTYPE html>
<html lang="de" xml:lang="de" xmlns="http://www.w3.org/1999/xhtml">
  <head>
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1" />
    <meta name="theme-color" content="#000000" />
    <meta
      name="description"
      content="KanzleiPilot: Der Honorarrechner für Steuerberater. Angebote und Verträge schnell erstellen. Mandantenwert steigern. Wertvolle Zeit sparen."
    />
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" />
    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" />
    <link href="/fonts?name=ProximaNova" rel="stylesheet" />
    <link rel="manifest" href="/site.webmanifest" />
    <link rel="mask-icon" href="/safari-pinned-tab.svg" color="#5bbad5" />
    <meta name="msapplication-TileColor" content="#603cba" />
    <meta name="theme-color" content="#ffffff" />
    <title>KanzleiPilot</title>
    <script>
      (function () {
        var title = 'KanzleiPilot';
        var url = window.location.href;
        if (url.includes(':3000')) {
          title = 'Kanzleipilot Localhost';
        } else if (url.includes('development')) {
          title = 'Kanzleipilot Development';
        } else if (url.includes('staging')) {
          title = 'Kanzleipilot Staging';
        }
        document.title = title;
      })();
    </script>
    <script type="module" crossorigin src="/assets/index-d10UqLBV.js"></script>
    <link rel="modulepreload" crossorigin href="/assets/vendor-1-nAk3nJ.js">
    <link rel="modulepreload" crossorigin href="/assets/antd-DIKaO1vJ.js">
    <link rel="modulepreload" crossorigin href="/assets/apollo-Cp-WW06B.js">
    <link rel="modulepreload" crossorigin href="/assets/formik-DOPF5jOA.js">
    <link rel="modulepreload" crossorigin href="/assets/antd-icons-B9bo8mKI.js">
    <link rel="stylesheet" crossorigin href="/assets/index-C5D5TCKA.css">
  </head>

  <body>
    <noscript>You need to enable JavaScript to run this app.</noscript>
    <div id="root"></div>
    <div id="pdfViewer"></div>
  </body>
</html>

Found 2026-01-09 by HttpPlugin

Create report

Open service 5.104.101.30:443 · ws.development.kanzleipilot.de

2026-01-08 20:36

HTTP/1.1 400 Bad Request
Date: Thu, 08 Jan 2026 20:36:48 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 406
Connection: close
X-Request-ID: 097cd2d7-181d-45a8-b399-c7c9c30f483d
X-Powered-By: Express
Access-Control-Allow-Origin: *
ETag: W/"196-HUCJKwlQurC5GNaaJnH0d+HOnRw"


{"errors":[{"message":"This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight\n","extensions":{"code":"BAD_REQUEST"}}]}

Found 2026-01-08 by HttpPlugin

Create report

Open service 109.232.233.130:80 · ws.development.kanzleipilot.de

2026-01-03 10:14

HTTP/1.1 400 Bad Request
Date: Sat, 03 Jan 2026 10:14:28 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 406
Connection: close
X-Request-ID: 1a904074-ecb0-4c01-b664-8967b59b6a82
X-Powered-By: Express
Access-Control-Allow-Origin: *
ETag: W/"196-HUCJKwlQurC5GNaaJnH0d+HOnRw"


{"errors":[{"message":"This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight\n","extensions":{"code":"BAD_REQUEST"}}]}

Found 2026-01-03 by HttpPlugin

Create report

Open service 109.232.236.90:80 · ws.development.kanzleipilot.de

2026-01-03 10:14

HTTP/1.1 400 Bad Request
Date: Sat, 03 Jan 2026 10:14:27 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 406
Connection: close
X-Request-ID: a397e501-d96c-4c0f-a473-5288903cdab5
X-Powered-By: Express
Access-Control-Allow-Origin: *
ETag: W/"196-HUCJKwlQurC5GNaaJnH0d+HOnRw"


{"errors":[{"message":"This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight\n","extensions":{"code":"BAD_REQUEST"}}]}

Found 2026-01-03 by HttpPlugin

Create report

Open service 148.253.75.120:80 · ws.development.kanzleipilot.de

2026-01-03 10:14

HTTP/1.1 400 Bad Request
Date: Sat, 03 Jan 2026 10:14:28 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 406
Connection: close
X-Request-ID: 4d2ce4aa-ec46-486d-b81b-d88043000dee
X-Powered-By: Express
Access-Control-Allow-Origin: *
ETag: W/"196-HUCJKwlQurC5GNaaJnH0d+HOnRw"


{"errors":[{"message":"This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight\n","extensions":{"code":"BAD_REQUEST"}}]}

Found 2026-01-03 by HttpPlugin

Create report

Open service 148.253.75.120:443 · ws.development.kanzleipilot.de

2026-01-03 10:14

HTTP/1.1 400 Bad Request
Date: Sat, 03 Jan 2026 10:14:27 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 406
Connection: close
X-Request-ID: 7b4b894f-baa5-4520-935f-dc1fe5671d18
X-Powered-By: Express
Access-Control-Allow-Origin: *
ETag: W/"196-HUCJKwlQurC5GNaaJnH0d+HOnRw"


{"errors":[{"message":"This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight\n","extensions":{"code":"BAD_REQUEST"}}]}

Found 2026-01-03 by HttpPlugin

Create report

Open service 5.104.101.30:443 · ws.development.kanzleipilot.de

2026-01-03 10:14

HTTP/1.1 400 Bad Request
Date: Sat, 03 Jan 2026 10:14:27 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 406
Connection: close
X-Request-ID: beb7bba3-2b29-4021-9dff-01e688644a3e
X-Powered-By: Express
Access-Control-Allow-Origin: *
ETag: W/"196-HUCJKwlQurC5GNaaJnH0d+HOnRw"


{"errors":[{"message":"This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight\n","extensions":{"code":"BAD_REQUEST"}}]}

Found 2026-01-03 by HttpPlugin