cloudflare
tcp/443 tcp/80
The following URL (usually /.git/config) is publicly accessible and is leaking source code and repository configuration.
Severity: medium
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a6522e8e796bd
[core] repositoryformatversion = 0 filemode = true bare = false logallrefupdates = true [remote "origin"] url = git@github.com:tacbrandsdnbhd/fpay.git fetch = +refs/heads/*:refs/remotes/origin/* [branch "main"] remote = origin merge = refs/heads/main
The following URL (usually /.git/config) is publicly accessible and is leaking source code and repository configuration.
Severity: medium
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a6522e8e796bd
[core] repositoryformatversion = 0 filemode = true bare = false logallrefupdates = true [remote "origin"] url = git@github.com:tacbrandsdnbhd/fpay.git fetch = +refs/heads/*:refs/remotes/origin/* [branch "main"] remote = origin merge = refs/heads/main
Open service 188.114.97.3:443 · operator.fpay.asia
2026-01-23 06:17
HTTP/1.1 200 OK
Date: Fri, 23 Jan 2026 06:17:05 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
CF-RAY: 9c252a7aebc815e1-SJC
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Access-Control-Allow-Origin: *
Set-Cookie: PHPSESSID=d6a7caa99262a558b5b86e0b99caa715; path=/
Set-Cookie: __cf_bm=BzM1mjBFlaIY1ZHu.qZqGK82F0snUxaKY1brDTnsObk-1769149025-1.0.1.1-29Jg92lFaEUE1Wyk1ntajoAc_kzDGzLRyjbOGCXbyPXdQaQFKjg30WR0HhuVK2.VlgJb8eTGGSM1Wu_Yt4afKSkpuSs89XBDZN.PkLT95kQ; path=/; expires=Fri, 23-Jan-26 06:47:05 GMT; domain=.fpay.asia; HttpOnly; Secure; SameSite=None
Set-Cookie: _cfuvid=7WrDlaCV6uy1J9VGT7gMxPbmtJaSFo4CkLlGbHbDmlY-1769149025061-0.0.1.1-604800000; path=/; domain=.fpay.asia; HttpOnly; Secure; SameSite=None
cf-cache-status: DYNAMIC
Server: cloudflare
Page title: FPay :: Login
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>FPay :: Login</title>
<meta name="description" content="FPay - Top Payment Gateway for Online Payments">
<meta name="author" content="FPay">
<meta property="og:type" content="website" />
<meta property="og:title" content="FPay :: Login" />
<meta property="og:description" content="FPay - Top Payment Gateway for Online Payments" />
<meta property="og:site_name" content="FPay" />
<meta property="og:image" content="https://operator.fpay.asia/asset/img//social.jpg?v2026-01-23:14:17" />
<meta property="og:image:width" content="1200" />
<meta property="og:image:height" content="630" />
<link rel="icon" href="https://operator.fpay.asia/asset/img//favicon.ico?v2026-01-23:14:17">
<link rel="shortcut icon" href="https://operator.fpay.asia/asset/img//favicon.ico?v2026-01-23:14:17">
<link rel="apple-touch-icon" href="https://operator.fpay.asia/asset/img//favicon.ico?v2026-01-23:14:17">
<link rel="stylesheet" href="https://operator.fpay.asia/asset/css/library.min.css?v2026-01-23:14:17">
<link rel="stylesheet" href="https://operator.fpay.asia/asset/css/style.css?v2026-01-23:14:17">
<script type="text/javascript" src="https://operator.fpay.asia/asset/lang/lang_en.js?v2026-01-23:14:17"></script>
<script type="text/javascript">
var userdata = JSON.parse('{}');
</script>
<script type="text/javascript">
var rows = "25",
API_ROOT = "api/",
TZ_GMT_ZONE = "+0800",
TZ_GMT_NAME = "Asia/Kuala_Lumpur",
GA_STATUS = "true",
APP_ENV = "production";
</script>
<script type="text/javascript" src="https://operator.fpay.asia/asset/js/library.min.js?v2026-01-23:14:17"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js"></script>
<script type="text/javascript" src="https://operator.fpay.asia/asset/js/script.js?v2026-01-23:14:17"></script>
<script type="text/javascript">
window.onload = function() {
setTimeout(function() {
$(".loader").fadeOut();
}, 100);
};
</script>
<script type="text/javascript">
var web_setting = "operator";
</script>
</head>
<body class="hold-transition sidebar-mini layout-fixed layout-navbar-fixed layout-footer-fixed">
<div class="wrapper"> <div class="loader"><img class="wow pulse" data-wow-iteration="infinite" src="https://operator.fpay.asia/asset/img/loader.gif?v2026-01-23:14:17"></div>
<div class="ajaxLoader"><img class="wow pulse" data-wow-iteration="infinite" src="https://operator.fpay.asia/asset/img/loader.gif?v2026-01-23:14:17"></div>
<style type="text/css">
.captchaNum span:nth-child(1) {
font-style: normal;
-webkit-transform: rotate(-18deg);
-moz-transform: rotate(-18deg);
-ms-transform: rotate(-18deg);
-o-transform: rotate(-18deg);
}
.captchaNum span:nth-child(2) {
font-weight: 400;
font-style: normal;
font-family: 'Roboto', sans-serif;
}
.captchaNum span:nth-child(3) {
font-style: italic;
}
.captchaNum span:nth-child(4) {
font-weight: 500;
}
</style>
<input id="captchaID" hidden value="0458" />
<style type="text/css">body{ overflow: hidden;}</style>
<div class="box-login">
<div class="box-login-l float-left wow slideInLeft">
</div>
<div class="box-login-r float-right wow slideInRight">
<div class="box-login-logo text-center">
<a href="/">
<img class="wow pulse" data-wow-iteration="3" src="https://operator.fpay.asia/asset/img//logo.png?v2026-01-23:14:17">
</a>
</div>
<div class=
Open service 188.114.97.3:443 · operator.fpay.asia
2026-01-09 20:43
HTTP/1.1 200 OK
Date: Fri, 09 Jan 2026 20:43:28 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
CF-RAY: 9bb6c460deb36cc1-SIN
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Access-Control-Allow-Origin: *
Set-Cookie: PHPSESSID=8c2c5feabfb10b4ea2a790742f5642ce; path=/
Set-Cookie: __cf_bm=3SbGz7ZrTBaED4thmxl5KvuWdgurLTLOz2tQNSKq0Xk-1767991408-1.0.1.1-XpeXyNPK5y6d0JnEeNMJ7JZjqe52b...toVjz3IyKvz0cgU7ravARTu81qH.GRyux.W17qpnbRYO6jaNQsLOVMqJNHSVeOQPpeJ9gR_O9gw; path=/; expires=Fri, 09-Jan-26 21:13:28 GMT; domain=.fpay.asia; HttpOnly; Secure; SameSite=None
Set-Cookie: _cfuvid=ab0nWnyhnznGqHl0aaDvibGsuqzM6B5FU090M5Pd5J8-1767991408837-0.0.1.1-604800000; path=/; domain=.fpay.asia; HttpOnly; Secure; SameSite=None
cf-cache-status: DYNAMIC
Server: cloudflare
Page title: FPay :: Login
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>FPay :: Login</title>
<meta name="description" content="FPay - Top Payment Gateway for Online Payments">
<meta name="author" content="FPay">
<meta property="og:type" content="website" />
<meta property="og:title" content="FPay :: Login" />
<meta property="og:description" content="FPay - Top Payment Gateway for Online Payments" />
<meta property="og:site_name" content="FPay" />
<meta property="og:image" content="https://operator.fpay.asia/asset/img//social.jpg?v2026-01-10:04:43" />
<meta property="og:image:width" content="1200" />
<meta property="og:image:height" content="630" />
<link rel="icon" href="https://operator.fpay.asia/asset/img//favicon.ico?v2026-01-10:04:43">
<link rel="shortcut icon" href="https://operator.fpay.asia/asset/img//favicon.ico?v2026-01-10:04:43">
<link rel="apple-touch-icon" href="https://operator.fpay.asia/asset/img//favicon.ico?v2026-01-10:04:43">
<link rel="stylesheet" href="https://operator.fpay.asia/asset/css/library.min.css?v2026-01-10:04:43">
<link rel="stylesheet" href="https://operator.fpay.asia/asset/css/style.css?v2026-01-10:04:43">
<script type="text/javascript" src="https://operator.fpay.asia/asset/lang/lang_en.js?v2026-01-10:04:43"></script>
<script type="text/javascript">
var userdata = JSON.parse('{}');
</script>
<script type="text/javascript">
var rows = "25",
API_ROOT = "api/",
TZ_GMT_ZONE = "+0800",
TZ_GMT_NAME = "Asia/Kuala_Lumpur",
GA_STATUS = "true",
APP_ENV = "production";
</script>
<script type="text/javascript" src="https://operator.fpay.asia/asset/js/library.min.js?v2026-01-10:04:43"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js"></script>
<script type="text/javascript" src="https://operator.fpay.asia/asset/js/script.js?v2026-01-10:04:43"></script>
<script type="text/javascript">
window.onload = function() {
setTimeout(function() {
$(".loader").fadeOut();
}, 100);
};
</script>
<script type="text/javascript">
var web_setting = "operator";
</script>
</head>
<body class="hold-transition sidebar-mini layout-fixed layout-navbar-fixed layout-footer-fixed">
<div class="wrapper"> <div class="loader"><img class="wow pulse" data-wow-iteration="infinite" src="https://operator.fpay.asia/asset/img/loader.gif?v2026-01-10:04:43"></div>
<div class="ajaxLoader"><img class="wow pulse" data-wow-iteration="infinite" src="https://operator.fpay.asia/asset/img/loader.gif?v2026-01-10:04:43"></div>
<style type="text/css">
.captchaNum span:nth-child(1) {
font-style: italic;
}
.captchaNum span:nth-child(2) {
font-weight: 500;
}
.captchaNum span:nth-child(3) {
font-style: normal;
-webkit-transform: rotate(-18deg);
-moz-transform: rotate(-18deg);
-ms-transform: rotate(-18deg);
-o-transform: rotate(-18deg);
}
.captchaNum span:nth-child(4) {
font-style: normal;
-webkit-transform: rotate(-18deg);
-moz-transform: rotate(-18deg);
-ms-transform: rotate(-18deg);
-o-transform: rotate(-18deg);
}
</style>
<input id="captchaID" hidden value="2878" />
<style type="text/css">body{ overflow: hidden;}</style>
<div class="box-login">
<div class="box-login-l float-left wow slideInLeft">
</div>
<div class="box-login-r float-right wow slideInRight">
<div class="box-login-logo text-center">
<a href="/">
<img class="wow pulse" data-wow-iteration="3" src="https://operator.fpa
Open service 104.18.28.2:80 · operator.fpay.asia
2026-01-08 19:06
HTTP/1.1 301 Moved Permanently Date: Thu, 08 Jan 2026 19:06:03 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Thu, 08 Jan 2026 20:06:03 GMT Location: https://operator.fpay.asia/ Set-Cookie: __cf_bm=XND7fmSCYLzQlGorzmlUYAGE0Z6x6vGyWu2Pvr1dkaw-1767899163-1.0.1.1-P3T2LIx9uEPfdFCflLaW_qy0OwLONwJiDdrh8Vy_GGJJJW6NvOj.M3PGcocyTjsZozueSCUplFVT7WI7GRiAO5XnRpDuyF3iUNo9mBYTlQ0; path=/; expires=Thu, 08-Jan-26 19:36:03 GMT; domain=.fpay.asia; HttpOnly Set-Cookie: _cfuvid=ynJ1RFsSAdwiZKy3E6tv9.zC74359Uh.zycLHPEUMY8-1767899163347-0.0.1.1-604800000; path=/; domain=.fpay.asia; HttpOnly Server: cloudflare CF-RAY: 9badf84acb9368ef-FRA Page title: 301 Moved Permanently <html> <head><title>301 Moved Permanently</title></head> <body> <center><h1>301 Moved Permanently</h1></center> <hr><center>cloudflare</center> </body> </html>
Open service 104.18.28.2:80 · operator.fpay.asia
2026-01-01 19:58
HTTP/1.1 301 Moved Permanently Date: Thu, 01 Jan 2026 19:58:13 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Thu, 01 Jan 2026 20:58:13 GMT Location: https://operator.fpay.asia/ Set-Cookie: __cf_bm=tj9efW1ZqI6PNkh1Eq6AYBZcyCK3_UGp5809qlbSGRc-1767297493-1.0.1.1-Rgru2fLsed27orkm3BxIdqHalxJHVurP_i0LU80obS5emaNeNpSpToKtXT8vRJQ4zxEZtAUZbFs8pX7DWdcVKT5YmGVC5RX.3Cxfs08ogQw; path=/; expires=Thu, 01-Jan-26 20:28:13 GMT; domain=.fpay.asia; HttpOnly Server: cloudflare CF-RAY: 9b7497184aff7f0d-LHR Page title: 301 Moved Permanently <html> <head><title>301 Moved Permanently</title></head> <body> <center><h1>301 Moved Permanently</h1></center> <hr><center>cloudflare</center> </body> </html>
Open service 188.114.97.3:443 · operator.fpay.asia
2025-12-22 10:36
HTTP/1.1 200 OK
Date: Mon, 22 Dec 2025 10:36:09 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
CF-RAY: 9b1ef9fb0b4b4fcb-YYZ
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Access-Control-Allow-Origin: *
Set-Cookie: PHPSESSID=a2c7842caa7b54f52dbd1cddb8231d92; path=/
Set-Cookie: __cf_bm=OPE67smT5_5H22ywM9jrERAdsoR66v_7tcocO_DLriQ-1766399769-1.0.1.1-9uQFgkOgm9_7BaiBCiiGJRp3eK9JvKY7kv4KvBqngvSYWYu0lxA9WDk13L.o9kiJ1OvnGio1YdOTnyXkw4Ykq5kfiK.CGu0MpawkNZQxNsw; path=/; expires=Mon, 22-Dec-25 11:06:09 GMT; domain=.fpay.asia; HttpOnly; Secure; SameSite=None
cf-cache-status: DYNAMIC
Server: cloudflare
Page title: FPay :: Login
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>FPay :: Login</title>
<meta name="description" content="FPay - Top Payment Gateway for Online Payments">
<meta name="author" content="FPay">
<meta property="og:type" content="website" />
<meta property="og:title" content="FPay :: Login" />
<meta property="og:description" content="FPay - Top Payment Gateway for Online Payments" />
<meta property="og:site_name" content="FPay" />
<meta property="og:image" content="https://operator.fpay.asia/asset/img//social.jpg?v2025-12" />
<meta property="og:image:width" content="1200" />
<meta property="og:image:height" content="630" />
<link rel="icon" href="https://operator.fpay.asia/asset/img//favicon.ico?v2025-12">
<link rel="shortcut icon" href="https://operator.fpay.asia/asset/img//favicon.ico?v2025-12">
<link rel="apple-touch-icon" href="https://operator.fpay.asia/asset/img//favicon.ico?v2025-12">
<link rel="stylesheet" href="https://operator.fpay.asia/asset/css/library.min.css?v2025-12">
<link rel="stylesheet" href="https://operator.fpay.asia/asset/css/style.css?v2025-12">
<script type="text/javascript" src="https://operator.fpay.asia/asset/lang/lang_en.js?v2025-12"></script>
<script type="text/javascript">
var userdata = JSON.parse('{}');
</script>
<script type="text/javascript">
var rows = "25",
API_ROOT = "api/",
TZ_GMT_ZONE = "+0800",
TZ_GMT_NAME = "Asia/Kuala_Lumpur",
GA_STATUS = "true",
APP_ENV = "production";
</script>
<script type="text/javascript" src="https://operator.fpay.asia/asset/js/library.min.js?v2025-12"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js"></script>
<script type="text/javascript" src="https://operator.fpay.asia/asset/js/script.js?v2025-12"></script>
<script type="text/javascript">
window.onload = function() {
setTimeout(function() {
$(".loader").fadeOut();
}, 100);
};
</script>
<script type="text/javascript">
var web_setting = "operator";
</script>
</head>
<body class="hold-transition sidebar-mini layout-fixed layout-navbar-fixed layout-footer-fixed">
<div class="wrapper"> <div class="loader"><img class="wow pulse" data-wow-iteration="infinite" src="https://operator.fpay.asia/asset/img/loader.gif?v2025-12"></div>
<div class="ajaxLoader"><img class="wow pulse" data-wow-iteration="infinite" src="https://operator.fpay.asia/asset/img/loader.gif?v2025-12"></div>
<style type="text/css">
.captchaNum span:nth-child(1) {
font-style: italic;
}
.captchaNum span:nth-child(2) {
font-weight: 500;
}
.captchaNum span:nth-child(3) {
font-style: normal;
-webkit-transform: rotate(-18deg);
-moz-transform: rotate(-18deg);
-ms-transform: rotate(-18deg);
-o-transform: rotate(-18deg);
}
.captchaNum span:nth-child(4) {
font-style: normal;
-webkit-transform: rotate(-18deg);
-moz-transform: rotate(-18deg);
-ms-transform: rotate(-18deg);
-o-transform: rotate(-18deg);
}
</style>
<input id="captchaID" hidden value="8614" />
<style type="text/css">body{ overflow: hidden;}</style>
<div class="box-login">
<div class="box-login-l float-left wow slideInLeft">
</div>
<div class="box-login-r float-right wow slideInRight">
<div class="box-login-logo text-center">
<a href="/">
<img class="wow pulse" data-wow-iteration="3" src="https://operator.fpay.asia/asset/img//logo.png?v2025-12">
</a>
</div>
<div class="login-for