LeakIX - Host echonews.app

Domain echonews.app

Germany

Hetzner Online GmbH

Debian

Software information

cloudflare

tcp/443 tcp/80 tcp/8443

Git configuration and history exposed

The following URL (usually /.git/config) is publicly accessible and is leaking source code and repository configuration.

IP: 91.99.2.68
Domain: mail-service.echonews.app
Port: 443
URL: https://mail-service.echonews.app

First seen 2025-07-29 21:09
Last seen 2025-12-01 14:13
Open for 124 days
- Severity: medium
  Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a65228fe5b146
```
[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
	ignorecase = true
	precomposeunicode = true
[remote "origin"]
	url = git@github.com:tekinburak/echo-email-service.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "main"]
	remote = origin
	merge = refs/heads/main
	vscode-merge-base = origin/main
```
  Found on 2025-12-01 14:13
  
  347 Bytes
Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 91.99.2.68
Domain: api.echonews.app
Port: 443
URL: https://api.echonews.app

First seen 2025-11-28 05:36
Last seen 2025-12-08 06:49
Open for 10 days

Severity: info
Fingerprint: 5733ddf49ff49cd151e75e4b87baf8080f9c51fbba2e77cedcd36599555861ce

Public Swagger UI/API detected at path: /v3/api-docs - sample paths:
GET /article
GET /article/{code}
GET /bot/chat
GET /category
GET /followed/author/article
GET /login/oauth2/code/google
GET /member/category
GET /member/notification/category/settings
GET /member/role/editor/apply/agreement
GET /member/signup/agreement
GET /notification
GET /profile
GET /profile/author/{authorId}
GET /tags/search
POST /article/comment
POST /article/interaction/dislike
POST /article/interaction/like
POST /article/report
POST /image
POST /member/blocked
POST /member/device
POST /member/follow
POST /member/followers
POST /member/following
POST /member/forgot-credential/complete
POST /member/forgot-credential/init
POST /member/forgot-credential/verify
POST /member/guest/signin
POST /member/guest/signup
POST /member/notification/category/subscribe
POST /member/notification/category/unsubscribe
POST /member/role/editor/apply/initialize
POST /member/role/editor/apply/verify
POST /member/search
POST /member/signin
POST /member/signup/initialize
POST /member/signup/verify
POST /member/token/invalidate
POST /member/token/refresh
POST /member/unfollow
POST /profile/image
POST /tag
POST /tag/article
POST /v1/oauth/login
POST /v2/article
POST /v2/article/public
POST /v2/member/signup/initialize

Found on 2025-12-08 06:49

Create report

MacOS file listing through .DS_Store file

.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS).

They store information about the files within a folder, including display options of folders, such as icon positions and view settings.

It may happen that .DS_Store files inadvertently leak filenames such as database backups or private administration panels.

IP: 91.99.2.68
Domain: mail-service.echonews.app
Port: 443
URL: https://mail-service.echonews.app

First seen 2025-07-29 21:09
Last seen 2025-12-01 14:13
Open for 124 days
- Severity: low
  Fingerprint: 5f32cf5d6962f09c7cf176427cf17642eeca31dda0ae51efa0ae51efa0ae51ef
```
Found 2 files trough .DS_Store spidering:

/index.php
/README.md
```
  Found on 2025-12-01 14:13
Create report

Open service 172.67.184.153:443 · echonews.app

2026-01-11 21:02

HTTP/1.1 404 Not Found
Date: Sun, 11 Jan 2026 21:02:44 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 107
Connection: close
Cache-Control: public, max-age=0, must-revalidate
Server: cloudflare
strict-transport-security: max-age=63072000
x-vercel-error: DEPLOYMENT_NOT_FOUND
x-vercel-id: bom1::d6wdn-1768165364776-5dcff47074c1
cf-cache-status: DYNAMIC
Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Speculation-Rules: "/cdn-cgi/speculation"
Server-Timing: cfCacheStatus;desc="DYNAMIC"
Server-Timing: cfEdge;dur=5,cfOrigin;dur=7
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Z%2Ba9FC51FeEz0bEGPGiODnToSff%2BHlHqLrTHcd4r3xVLRmSGfw%2B%2Fb09gViJZsyLeZRTJthjKdvMe1ubskxUttSF8H2rJXEBb4Fa7FQ%3D%3D"}]}
CF-RAY: 9bc75b59a90447b1-BOM
alt-svc: h3=":443"; ma=86400


The deployment could not be found on Vercel.

DEPLOYMENT_NOT_FOUND

bom1::d6wdn-1768165364776-5dcff47074c1

Found 9 hours ago by HttpPlugin

Domain echonews.app

Germany

Software information

Git configuration and history exposed

Swagger API description is publicly available

MacOS file listing through .DS_Store file

echonews.app*.echonews.app

Domain summary

IP summary