LeakIX - Host exman.online

Domain exman.online

United States

MICROSOFT-CORP-MSN-AS-BLOCK

Software information

Kestrel Kestrel

tcp/443

Microsoft-HTTPAPI 2.0

tcp/80

Microsoft-IIS 10.0

tcp/443 tcp/80

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.11.40.37
Domain: tagxapi.exman.online
Port: 80
URL: http://tagxapi.exman.online

First seen 2025-12-13 12:06
Last seen 2026-02-09 23:37
Open for 58 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad035495176b43ac2dff8144849143261c362381b26c6eb

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/ActionMethod
GET /api/CheckInvalidRole/{userId}
GET /api/GetAssetGroupList/{clientId}
GET /api/GetAssetGroupPropertyMapByClientId/{clientId}
GET /api/GetAssetLimitStatusByCustomerId/{customerId}
GET /api/GetClientById/{clientId}
GET /api/GetFieldKVByLocationRole
GET /api/GetFieldList/{clientId}/{userId}/{topRole}
GET /api/GetHashTagList/{customerId}
GET /api/GetHashTagMapListByFieldList/{userId}/{clientId}/{fieldStr}
GET /api/GetLocationKV
GET /api/GetLocationList/{clientId}/{userId}/{topRole}
GET /api/GetPropertyDropdownItemByClientId/{clientId}
GET /api/GetPropertyGroupList/{clientId}
GET /api/GetPropertyList/{clientId}
GET /api/ProtectedMethod
POST /api/CheckPostedDataValid
POST /api/GetAccountWriteSASToken
POST /api/GetAssetImageListByFieldList
POST /api/GetAssetListByFieldList
POST /api/GetAssetNotificationListByFieldList
POST /api/GetAssetPropertyValueByFieldList
POST /api/GetClientKVByUser
POST /api/GetSASReadToken
POST /api/LogAppError
POST /api/LogSyncData
POST /api/SubmitSigninLog
POST /api/SubmitSyncLog
POST /api/SyncBundleAssetList
POST /api/UploadFile
POST /api/ValidateAppUser

Found on 2026-02-09 23:37

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.11.40.37
Domain: tagxapi.exman.online
Port: 443
URL: https://tagxapi.exman.online

First seen 2025-10-19 12:47
Last seen 2026-02-09 19:44
Open for 113 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad035495176b43ac2dff8144849143261c362381b26c6eb

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/ActionMethod
GET /api/CheckInvalidRole/{userId}
GET /api/GetAssetGroupList/{clientId}
GET /api/GetAssetGroupPropertyMapByClientId/{clientId}
GET /api/GetAssetLimitStatusByCustomerId/{customerId}
GET /api/GetClientById/{clientId}
GET /api/GetFieldKVByLocationRole
GET /api/GetFieldList/{clientId}/{userId}/{topRole}
GET /api/GetHashTagList/{customerId}
GET /api/GetHashTagMapListByFieldList/{userId}/{clientId}/{fieldStr}
GET /api/GetLocationKV
GET /api/GetLocationList/{clientId}/{userId}/{topRole}
GET /api/GetPropertyDropdownItemByClientId/{clientId}
GET /api/GetPropertyGroupList/{clientId}
GET /api/GetPropertyList/{clientId}
GET /api/ProtectedMethod
POST /api/CheckPostedDataValid
POST /api/GetAccountWriteSASToken
POST /api/GetAssetImageListByFieldList
POST /api/GetAssetListByFieldList
POST /api/GetAssetNotificationListByFieldList
POST /api/GetAssetPropertyValueByFieldList
POST /api/GetClientKVByUser
POST /api/GetSASReadToken
POST /api/LogAppError
POST /api/LogSyncData
POST /api/SubmitSigninLog
POST /api/SubmitSyncLog
POST /api/SyncBundleAssetList
POST /api/UploadFile
POST /api/ValidateAppUser

Found on 2026-02-09 19:44

Create report

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 20.11.40.37
Domain: manual.exman.online
Port: 80
URL: http://manual.exman.online

First seen 2025-10-23 16:34
Last seen 2026-02-09 12:21
Open for 108 days

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3dec863f59258a9f72eacd4d9eb5bbc5a957af4f2

GraphQL introspection enabled at /graphql
Types: 134 (by kind: ENUM: 10, INPUT_OBJECT: 12, OBJECT: 107, SCALAR: 5)
Operations:
- Query: Query | fields: analytics, assets, authentication, comments, contribute
- Mutation: Mutation | fields: analytics, assets, authentication, comments, groups
- Subscription: Subscription | fields: loggingLiveTrail
Directives: auth, cacheControl, deprecated, include, rateLimit, skip, specifiedBy (total: 7)

Found on 2026-02-09 12:21

190.9 kBytes

Create report

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 20.11.40.37
Domain: manual.exman.online
Port: 443
URL: https://manual.exman.online

First seen 2025-10-23 16:34
Last seen 2026-02-03 19:20
Open for 103 days

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3dec863f59258a9f72eacd4d9eb5bbc5a957af4f2

GraphQL introspection enabled at /graphql
Types: 134 (by kind: ENUM: 10, INPUT_OBJECT: 12, OBJECT: 107, SCALAR: 5)
Operations:
- Query: Query | fields: analytics, assets, authentication, comments, contribute
- Mutation: Mutation | fields: analytics, assets, authentication, comments, groups
- Subscription: Subscription | fields: loggingLiveTrail
Directives: auth, cacheControl, deprecated, include, rateLimit, skip, specifiedBy (total: 7)

Found on 2026-02-03 19:20

190.9 kBytes

Create report

Open service 34.202.63.170:80 · exman.online

2026-02-04 14:56

HTTP/1.1 301 Moved Permanently
Date: Wed, 04 Feb 2026 14:56:11 GMT
Content-Type: application/json
Content-Length: 0
Connection: close
x-amzn-RequestId: c619fea9-1505-467b-b062-2b248839c7a7
x-amzn-Remapped-content-length: 0
set-cookie: INGRESSCOOKIE=7F0CFB129CB8136D6F0BBE53A0E9D9C2; Path=/; HttpOnly
location: https://exman.online/
X-Amzn-Trace-Id: Root=1-69835e0b-354065c27e1979e802b847db;Parent=6755e898aa3d7cca;Sampled=0;Lineage=1:a5f8c33e:0
x-amzn-Remapped-date: Wed, 04 Feb 2026 14:56:11 GMT
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff

Found 2026-02-04 by HttpPlugin

Domain exman.online

United States

Software information

Swagger API description is publicly available

Swagger API description is publicly available

GraphQL introspection is enabled.

GraphQL introspection is enabled.

manual.exman.online

tagxapi.exman.online

cohotest.exman.online

testapp.exman.online

test.exman.online

license.exman.online

api.exman.online

offline.exman.online

aitest.exman.online

app.exman.online

tagx.exman.online

exman.onlinewww.exman.online

manual.exman.online

Domain summary

IP summary