Domain lightgd.homes
Japan
Software information
cloudflare
tcp/443
nginx
tcp/443 tcp/80
-
Swagger API description is publicly available
Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
First seen 2025-11-01 23:28
Last seen 2026-02-01 18:55
Open for 91 days-
Severity: info
Fingerprint: 5733ddf49ff49cd1bf890109bf890109bf890109bf890109bf890109bf890109Public Swagger UI/API detected at path: /api-docs/swagger.json
Found on 2026-02-01 18:55
-
-
Open service 172.67.158.97:443 · lightgd.homes
2026-01-23 10:21
HTTP/1.1 200 OK Date: Fri, 23 Jan 2026 10:21:49 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: cloudflare x-xss-protection: 1 x-xss-protection: 1; mode=block x-content-type-options: nosniff x-content-type-options: nosniff x-frame-options: sameorigin x-frame-options: SAMEORIGIN content-security-policy: default-src 'self' https://cdn.zapier.com; connect-src *; font-src 'self' https://cdn.zapier.com data:; frame-src *; img-src * data: blob:; media-src * data:; script-src 'self' 'unsafe-eval' 'sha256-jqxtvDkBbRAl9Hpqv68WdNOieepg8tJSYu1xIy7zT34=' 'sha256-aui5xYk3Lu1dQcnsPlNZI+qDTdfzdUv3fzsw80VLJgw=' https://cdn.zapier.com https://zapier.com; style-src 'self' 'unsafe-inline' https://cdn.zapier.com content-security-policy: default-src 'self' https: data: 'unsafe-inline' 'unsafe-eval'; x-instance-id: aa2571e1-dd79-4472-a2e5-a3ac0368a341 access-control-allow-origin: * x-powered-by: Express vary: Accept-Encoding Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=lEJ5HcwW2Ov2PDQjujpdIl1MDnijgir25egwvUfc2GWqTF0EUJsv7NeLQMaiqn%2B48cRUUiYzhP2Ac%2FxFY8agxPtvaWoHT3x2ki7zNaY%3D"}]} strict-transport-security: max-age=63072000; includeSubDomains; preload referrer-policy: strict-origin-when-cross-origin permissions-policy: geolocation=(), microphone=(), camera=() cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} CF-RAY: 9c2690fa9fa4fcde-SIN alt-svc: h3=":443"; ma=86400Found 2026-01-23 by HttpPluginCreate report
-
Open service 103.230.15.21:80 · lightgd.homes
2026-01-10 14:44
HTTP/1.1 301 Moved Permanently Server: nginx Date: Sat, 10 Jan 2026 14:44:10 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://lightgd.homes/ X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Page title: 301 Moved Permanently <html> <head><title>301 Moved Permanently</title></head> <body> <center><h1>301 Moved Permanently</h1></center> <hr><center>nginx</center> </body> </html>
Found 2026-01-10 by HttpPluginCreate report
-
Open service 103.230.15.21:443 · lightgd.homes
2026-01-10 14:44
HTTP/1.1 200 OK Server: nginx Date: Sat, 10 Jan 2026 14:44:11 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-XSS-Protection: 1 X-Content-Type-Options: nosniff X-Frame-Options: sameorigin Content-Security-Policy: default-src 'self' https://cdn.zapier.com; connect-src *; font-src 'self' https://cdn.zapier.com data:; frame-src *; img-src * data: blob:; media-src * data:; script-src 'self' 'unsafe-eval' 'sha256-jqxtvDkBbRAl9Hpqv68WdNOieepg8tJSYu1xIy7zT34=' 'sha256-aui5xYk3Lu1dQcnsPlNZI+qDTdfzdUv3fzsw80VLJgw=' https://cdn.zapier.com https://zapier.com; style-src 'self' 'unsafe-inline' https://cdn.zapier.com X-Instance-ID: aa2571e1-dd79-4472-a2e5-a3ac0368a341 Access-Control-Allow-Origin: * X-Powered-By: Express Vary: Accept-Encoding Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: geolocation=(), microphone=(), camera=() Content-Security-Policy: default-src 'self' https: data: 'unsafe-inline' 'unsafe-eval';
Found 2026-01-10 by HttpPluginCreate report