Domain nhtsa.dot.gov
Germany
Software information
AkamaiGHost
tcp/80
BigIP
tcp/80
-
Swagger API description is publicly available
Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
First seen 2025-10-27 16:58
Last seen 2026-02-16 23:25
Open for 112 days-
Severity: info
Fingerprint: 5733ddf49ff49cd151e75e4b5e5c7c65f9771582b98c07735f50ecb018708d44Public Swagger UI/API detected at path: /v3/api-docs - sample paths: GET /nhtsa/component/api/v1/component-database-test-results GET /nhtsa/component/api/v1/component-database-test-results/by-search GET /nhtsa/component/api/v1/component-database-test-results/get-component-detail-info/{compNo}/{testNo} GET /nhtsa/component/api/v1/component-database-test-results/get-component-geometry-info/{testNo} GET /nhtsa/component/api/v1/component-database-test-results/get-component-info/{testNo} GET /nhtsa/component/api/v1/component-database-test-results/get-component-pedpred-info/{testNo} GET /nhtsa/component/api/v1/component-database-test-results/get-component-photos-info/{testNo} GET /nhtsa/component/api/v1/component-database-test-results/get-component-reports-info/{testNo} GET /nhtsa/component/api/v1/component-database-test-results/get-component-testResult-info/{testNo} GET /nhtsa/component/api/v1/component-database-test-results/get-component-videos-info/{testNo} GET /nhtsa/component/api/v1/component-database-test-results/get-configuration-detail-info/{confNo}/{testNo} GET /nhtsa/component/api/v1/component-database-test-results/get-configuration-info/{testNo} GET /nhtsa/component/api/v1/component-database-test-results/get-instrumentation-detail-info/{curveNo}/{testNo} GET /nhtsa/component/api/v1/component-database-test-results/get-instrumentation-info/{testNo} GET /nhtsa/component/api/v1/component-database-test-results/get-multimedia-files/{testNo} GET /nhtsa/component/api/v1/component-database-test-results/get-test-detail/{testNo} GET /nhtsa/component/api/v1/component-database-test-results/get-vehicle-detail-info/{vehicleNo}/{testNo} GET /nhtsa/component/api/v1/component-database-test-results/get-vehicle-info/{testNo} GET /nhtsa/component/api/v1/component-database-test-results/metadata/{testNo} GET /nhtsa/component/api/v1/component-database-test-results/occupant-types GET /nhtsa/component/api/v1/component-database-test-results/test-no/{testNo} GET /nhtsa/component/api/v1/component-database-test-results/test-reference-no/{testReferenceNo} GET /nhtsa/component/api/v1/component-documents/test-no/{testNo} GET /nhtsa/component/api/v1/downloadDataFile GET /nhtsa/nhtsadb/api/v1/decode/{codeName}/{code} GET /nhtsa/nhtsadb/api/v1/filterclass/{senatt}/{sentyp}/{units} GET /nhtsa/nhtsadb/api/v1/list/{codeName} GET /nhtsa/nhtsadb/api/v1/model/ GET /nhtsa/nhtsadb/api/v1/model/list/{make} GET /nhtsa/nhtsadb/api/v1/model/{make}/{model} GET /nhtsa/nhtsadb/api/v1/ncodes GET /nhtsa/nhtsadb/api/v1/testPerformers/{database}Found on 2026-02-16 23:25
-
-
Open service 2a02:26f0:2780:70::215:ef1f:80 · nhtsa.dot.gov
2026-02-09 19:24
HTTP/1.1 301 Moved Permanently Server: AkamaiGHost Content-Length: 0 Location: https://nhtsa.dot.gov/ Date: Mon, 09 Feb 2026 19:25:23 GMT Connection: close X-Content-Type-Options: nosniff
Found 2026-02-09 by HttpPluginCreate report
-
Open service 2.16.183.25:443 · egrants.nhtsa.dot.gov
2026-02-09 19:24
HTTP/1.1 301 Moved Permanently Vary: Accept-Encoding Location: https://egrants.nhtsa.dot.gov/eGrants/ Content-Length: 0 Expires: Mon, 09 Feb 2026 19:25:02 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 09 Feb 2026 19:25:02 GMT Connection: close Set-Cookie: CookieConsentPolicy=0:1; path=/; expires=Tue, 09-Feb-2027 19:25:02 GMT; Max-Age=31536000; secure Set-Cookie: LSKey-c$CookieConsentPolicy=0:1; path=/; expires=Tue, 09-Feb-2027 19:25:02 GMT; Max-Age=31536000; secure Server-Timing: cdn-cache; desc=MISS Server-Timing: edge; dur=266 Server-Timing: origin; dur=374 Alt-Svc: h3=":443"; ma=93600 Strict-Transport-Security: max-age=31536000 ; includeSubDomains Server-Timing: ak_p; desc="1770665101643_34610649_3238939163_63850_7784_8_40_-";dur=1
Found 2026-02-09 by HttpPluginCreate report
-
Open service 2a02:26f0:2780:70::215:ef1f:443 · ncap.nhtsa.dot.gov
2026-02-09 19:24
HTTP/1.1 403 Forbidden Mime-Version: 1.0 Content-Type: text/html Content-Length: 376 Expires: Mon, 09 Feb 2026 19:25:01 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 09 Feb 2026 19:25:01 GMT Connection: close Server-Timing: cdn-cache; desc=HIT Server-Timing: edge; dur=1 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 ; includeSubDomains ; preload Server-Timing: ak_p; desc="1770665101801_1600490693_1217874024_182_11802_81_136_-";dur=1 Page title: Access Denied <HTML><HEAD> <TITLE>Access Denied</TITLE> </HEAD><BODY> <H1>Access Denied</H1> You don't have permission to access "http://ncap.nhtsa.dot.gov/" on this server.<P> Reference #18.c58c655f.1770665101.48974868 <P>https://errors.edgesuite.net/18.c58c655f.1770665101.48974868</P> </BODY> </HTML>
Found 2026-02-09 by HttpPluginCreate report
-
Open service 204.68.194.72:80 · origin-vpic.nhtsa.dot.gov
2026-02-04 23:16
HTTP/1.0 301 Moved Permanently Location: https://origin-vpic.nhtsa.dot.gov/ Server: BigIP Connection: close Content-Length: 0
Found 2026-02-04 by HttpPluginCreate report
-
Open service 104.102.39.162:443 · nrd.api.nhtsa.dot.gov
2026-01-23 11:47
HTTP/1.1 200 OK Content-Type: text/html Last-Modified: Thu, 21 Nov 2024 02:58:33 GMT ETag: "9da20a35a94044ab6052270ef5f613a1" x-amz-version-id: pog1H2gQ4vLydaWybE.AdUyvEpb7lPwG Accept-Ranges: bytes Access-Control-Allow-Origin: * X-Akamai-Transformed: 9 3338 0 pmb=mRUM,2 Expires: Fri, 23 Jan 2026 11:47:55 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Fri, 23 Jan 2026 11:47:55 GMT Content-Length: 8045 Connection: close Server-Timing: cdn-cache; desc=MISS Server-Timing: edge; dur=112 Server-Timing: origin; dur=105 Strict-Transport-Security: max-age=31536000 ; includeSubDomains ; preload X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Server-Timing: ak_p; desc="1769168875082_34911176_269777665_21685_5058_90_168_-";dur=1 Page title: API Use Policy | NHTSA <!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="canonical" href="https://api.nhtsa.gov/index.html" /> <link rel="shortlink" href="https://api.nhtsa.gov/" /> <meta property="og:type" content="government" /> <meta property="og:site_name" content="NHTSA" /> <meta property="og:title" content="API Use Policy" /> <meta property="og:url" content="https://nrd.api.nhtsa.dot.gov/" /> <meta property="og:description" content="The NHTSA Crash test databases API" /> <meta property="og:image" content="https://www.nhtsa.gov/sites/nhtsa.dot.gov/files/about-hero_0.jpg" /> <meta property="og:image:secure_url" content="https://www.nhtsa.gov/sites/nhtsa.dot.gov/files/about-hero_0.jpg" /> <meta property="og:image:type" content="image/png" /> <meta name="dcterms.title" content="API Use Policy" /> <meta name="dcterms.creator" content="nhtsaitsupport@dot.gov" /> <meta name="dcterms.date" content="2017-07-14T18:36-05:00" /> <meta name="dcterms.type" content="Text" /> <meta name="dcterms.format" content="text/html" /> <meta name="dcterms.identifier" content="https://nrd.api.nhtsa.dot.gov/" /> <title>API Use Policy | NHTSA</title> <!-- HTML5 element support for IE6-8--><!--[if IE 8]> <script src="//html5shiv.googlecode.com/svn/trunk/html5.js"></script> <script src="../../js/respond.js"></script><![endif]--> <script>(window.BOOMR_mq=window.BOOMR_mq||[]).push(["addVar",{"rua.upush":"false","rua.cpush":"false","rua.upre":"false","rua.cpre":"false","rua.uprl":"false","rua.cprl":"false","rua.cprf":"false","rua.trans":"","rua.cook":"false","rua.ims":"false","rua.ufprl":"false","rua.cfprl":"false","rua.isuxp":"false","rua.texp":"norulematch","rua.ceh":"false","rua.ueh":"false","rua.ieh.st":"0"}]);</script> <script>!function(e){var n="https://s.go-mpulse.net/boomerang/";if("False"=="True")e.BOOMR_config=e.BOOMR_config||{},e.BOOMR_config.PageParams=e.BOOMR_config.PageParams||{},e.BOOMR_config.PageParams.pci=!0,n="https://s2.go-mpulse.net/boomerang/";if(window.BOOMR_API_key="5DDRB-AW9CH-6V94W-T7MGM-K6JEA",function(){function e(){if(!o){var e=document.createElement("script");e.id="boomr-scr-as",e.src=window.BOOMR.url,e.async=!0,i.parentNode.appendChild(e),o=!0}}function t(e){o=!0;var n,t,a,r,d=document,O=window;if(window.BOOMR.snippetMethod=e?"if":"i",t=function(e,n){var t=d.createElement("script");t.id=n||"boomr-if-as",t.src=window.BOOMR.url,BOOMR_lstart=(new Date).getTime(),e=e||d.body,e.appendChild(t)},!window.addEventListener&&window.attachEvent&&navigator.userAgent.match(/MSIE [67]\./))return window.BOOMR.snippetMethod="s",void t(i.parentNode,"boomr-async");a=document.createElement("IFRAME"),a.src="about:blank",a.title="",a.role="presentation",a.loading="eager",r=(a.frameElement||a).style,r.width=0,r.height=0,r.border=0,r.display="none",i.parentNode.appendChild(a);try{O=a.contentWindow,d=O.document.open()}catch(_){n=document.domain,a.src="javascript:var d=document.open();d.domain='"+n+"';void(0);",O=a.contentWindow,d=O.document.open()}if(n)d._boomrl=function(){this.domain=n,t()},d.write("<bo"+"dy onload='document._boomrl();'>");else if(O._boomrl=function(){t()},O.addEventListener)O.addEventListener("load",O._boomrl,!1);else if(O.attachEvent)O.attachEvent("onload",O._boomrl);d.close()}function a(e){window.BOOMR_onload=e&&e.timeStamp||(new Date).getTime()}if(!window.BOOMR||!window.BOOMR.version&&!window.BOOMR.snippetExecuted){window.BOOMR=window.BOOMR||{},window.BOOMR.snippetStart=(new Date).getTime(),window.BOOMR.snippetExecuted=!0,window.BOOMR.snippetVersion=12,window.BOOMR.url=n+"5DDRB-AW9CH-6V94W-T7MGM-K6JEA";var i=document.currentScript||document.getElementsByTagName("script")[0],o=!1,r=document.createElement("link");if(r.relList&&"function"==typeof r.relList.supports&&r.relList.supports("preload")Found 2026-01-23 by HttpPluginCreate report