LeakIX - Host goodleap.com

Domain goodleap.com

United States

Akamai International B.V.

Amazon

Software information

AkamaiGHost

tcp/443 tcp/80

Apache Apache 2.4.61

tcp/443

Caddy

tcp/443 tcp/80

CloudFront

tcp/443 tcp/80

Kestrel Kestrel

tcp/443

PHP PHP 7.0.33

tcp/443

Vercel

tcp/443 tcp/80

awselb awselb 2.0

tcp/443

cloudflare

tcp/443 tcp/80 tcp/8443

envoy

tcp/443 tcp/80

kong 3.12.0.0-enterprise-edition

tcp/443

MacOS file listing through .DS_Store file

.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS).

They store information about the files within a folder, including display options of folders, such as icon positions and view settings.

It may happen that .DS_Store files inadvertently leak filenames such as database backups or private administration panels.

IP: 13.225.78.76
Domain: goodleap.com
Port: 443
URL: https://goodleap.com

First seen 2021-08-04 04:07
Last seen 2024-12-06 14:00
Open for 1220 days
- Severity: low
  Fingerprint: 5f32cf5d6962f09c026392ab026392abd6a5e2f97215ead148bf737c575656bb
```
Found 7 files trough .DS_Store spidering:

/downloads
/downloads/GoodLeap Partner Logo Pack
/licenses
/licenses/21_SL_Licence_02214_Name_Change.pdf
/media-kit
/media-kit/images
/media-kit/images/goodleap-images
```
  Found on 2024-12-06 14:00
- Severity: low
  Fingerprint: 5f32cf5d6962f09c3c1fc5e93c1fc5e91a48c187cb7aded36be9528e4b69996a
```
Found 5 files trough .DS_Store spidering:

/downloads
/downloads/GoodLeap Partner Logo Pack
/licenses
/licenses/21_SL_Licence_02214_Name_Change.pdf
/media-kit
```
  Found on 2024-06-04 13:04
- Severity: low
  Fingerprint: 5f32cf5d6962f09c2eda814e2eda814e092aacd877d9a276999d928db1d4498e
```
Found 6 files trough .DS_Store spidering:

/downloads
/downloads/GoodLeap Partner Logo Pack
/licenses
/licenses/21_SL_Licence_02214_Name_Change.pdf
/media-kit
/media-kit/images
```
  Found on 2023-04-18 02:59
- Severity: low
  Fingerprint: 5f32cf5d6962f09c0215adfc0215adfc173440be9034e5d8c233a41779dba4d9
```
Found 4 files trough .DS_Store spidering:

/downloads
/downloads/GoodLeap Partner Logo Pack
/licenses
/media-kit
```
  Found on 2023-03-27 04:24
- Severity: low
  Fingerprint: 5f32cf5d6962f09c3c1fc5e93c1fc5e91a48c187cb7aded36be9528eae0c190b
```
Found 5 files trough .DS_Store spidering:

/downloads
/downloads/GoodLeap Partner Logo Pack
/licenses
/media-kit
/media-kit/images
```
  Found on 2023-03-24 03:25
- Severity: low
  Fingerprint: 5f32cf5d6962f09c2eda814e2eda814e092aacd877d9a276999d928d3ddebc4d
```
Found 6 files trough .DS_Store spidering:

/downloads
/downloads/GoodLeap Partner Logo Pack
/licenses
/media-kit
/media-kit/images
/media-kit/logos
```
  Found on 2023-02-17 20:33
- Severity: low
  Fingerprint: 5f32cf5d6962f09c3c1fc5e93c1fc5e91a48c1877aa7a982ae8b84fce4659830
```
Found 5 files trough .DS_Store spidering:

/downloads
/licenses
/media-kit
/media-kit/images
/media-kit/logos
```
  Found on 2022-12-12 16:41
- Severity: low
  Fingerprint: 5f32cf5d6962f09c63442d9d63442d9db8364d3bb8364d3bb8364d3bb8364d3b
```
Found 1 files trough .DS_Store spidering:

/downloads
```
  Found on 2021-09-03 01:15
- Severity: low
  Fingerprint: 5f32cf5d6962f09c0215adfc0215adfc173440be0203df4f47bdb5baad7044c1
```
Found 4 files trough .DS_Store spidering:

/downloads
/downloads/newsroom
/licenses
/newsroom
```
  Found on 2021-08-12 03:27
- Severity: low
  Fingerprint: 5f32cf5d6962f09c7cf176427cf17642acac498cf3194bcbf3194bcbf3194bcb
```
Found 2 files trough .DS_Store spidering:

/downloads
/licenses
```
  Found on 2021-08-04 04:07
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 52.10.49.139
Domain: api.sandbox-ordermgmt.goodleap.com
Port: 443
URL: https://api.sandbox-ordermgmt.goodleap.com

First seen 2025-10-31 13:16
- Severity: info
  Fingerprint: 5733ddf49ff49cd1aad03549733d818175d71e449522fb830404cba2fee8b7c6
```
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/v1/DistributorFunding
GET /api/v1/Loans/{loanId}
GET /api/v1/Loans/{loanId}/orders
GET /api/v1/Orders
GET /api/v1/Orders/GetLoanOrderDetails/{loanId}
GET /api/v1/Orders/GetOrderDetails/{orderId}
GET /api/v1/Orders/reasons/counter
GET /api/v1/Orders/reasons/deny
GET /api/v1/Orders/{orderId}
GET /api/v1/Partners/{partnerId}
POST /api/v1/Orders/changePayee
POST /api/v1/Orders/export
POST /api/v1/Orders/{orderId}/Submit
POST /api/v1/Orders/{orderId}/approve
POST /api/v1/Orders/{orderId}/counter
POST /api/v1/Orders/{orderId}/deny
POST /api/v1/webhook
```
  Found on 2025-10-31 13:16
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 35.164.227.112
Domain: api.goodleap.com
Port: 443
URL: https://api.goodleap.com

First seen 2025-12-02 17:26
Last seen 2026-01-16 02:29
Open for 44 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-01-16 02:29
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 44.239.171.216
Domain: api.ordermgmt.goodleap.com
Port: 443
URL: https://api.ordermgmt.goodleap.com

First seen 2025-10-21 00:52
- Severity: info
  Fingerprint: 5733ddf49ff49cd1aad03549733d818175d71e449522fb830404cba2fee8b7c6
```
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/v1/DistributorFunding
GET /api/v1/Loans/{loanId}
GET /api/v1/Loans/{loanId}/orders
GET /api/v1/Orders
GET /api/v1/Orders/GetLoanOrderDetails/{loanId}
GET /api/v1/Orders/GetOrderDetails/{orderId}
GET /api/v1/Orders/reasons/counter
GET /api/v1/Orders/reasons/deny
GET /api/v1/Orders/{orderId}
GET /api/v1/Partners/{partnerId}
POST /api/v1/Orders/changePayee
POST /api/v1/Orders/export
POST /api/v1/Orders/{orderId}/Submit
POST /api/v1/Orders/{orderId}/approve
POST /api/v1/Orders/{orderId}/counter
POST /api/v1/Orders/{orderId}/deny
POST /api/v1/webhook
```
  Found on 2025-10-21 00:52
Create report

Open service 2600:9000:20e8:fe00:9:a6ca:1f40:93a1:80 · documents-api.stage.goodleap.com

2026-01-27 05:37

HTTP/1.1 301 Moved Permanently
Server: CloudFront
Date: Tue, 27 Jan 2026 05:37:48 GMT
Content-Type: text/html
Content-Length: 167
Connection: close
Location: https://documents-api.stage.goodleap.com/
X-Cache: Redirect from cloudfront
Via: 1.1 b74d6c89144cb8da91c4c493eac8fb22.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-P13
X-Amz-Cf-Id: wddeBSJGR_Y63w3UtUM9V00pR0rbns8mHp4ZQ8nvQF2asKF8UzXslg==

Page title: 301 Moved Permanently

<html>
<head><title>301 Moved Permanently</title></head>
<body>
<center><h1>301 Moved Permanently</h1></center>
<hr><center>CloudFront</center>
</body>
</html>

Found 2026-01-27 by HttpPlugin

Create report

Open service 54.230.228.49:443 · pricing-service.sandbox01.goodleap.com

2026-01-27 05:33

HTTP/1.1 403 Forbidden
Server: CloudFront
Date: Tue, 27 Jan 2026 05:33:53 GMT
Content-Type: text/html
Content-Length: 919
Connection: close
X-Cache: Error from cloudfront
Via: 1.1 7b7e33ce27dedf9c28b39ecc0309b556.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MUC50-P5
X-Amz-Cf-Id: ulpHohMJQ5LOtvuqcNa9640vQ1z86_g2SrG6S8fkyVzAi0XJFm9Ztg==

Page title: ERROR: The request could not be satisfied

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<TITLE>ERROR: The request could not be satisfied</TITLE>
</HEAD><BODY>
<H1>403 ERROR</H1>
<H2>The request could not be satisfied.</H2>
<HR noshade size="1px">
Request blocked.
We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.
<BR clear="all">
If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.
<BR clear="all">
<HR noshade size="1px">
<PRE>
Generated by cloudfront (CloudFront)
Request ID: ulpHohMJQ5LOtvuqcNa9640vQ1z86_g2SrG6S8fkyVzAi0XJFm9Ztg==
</PRE>
<ADDRESS>
</ADDRESS>
</BODY></HTML>

Found 2026-01-27 by HttpPlugin