LeakIX - Host pointsapi.neslotech.co.za

Domain pointsapi.neslotech.co.za

United States

AMAZON-02

Software information

Heroku

tcp/443 tcp/80

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 3.33.249.164
Domain: pointsapi.neslotech.co.za
Port: 80
URL: http://pointsapi.neslotech.co.za

First seen 2025-10-25 00:08
Last seen 2026-01-09 22:48
Open for 76 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd151e75e4b98651d5b19cca270eb6bf91a56007eb2c6d45717
```
Public Swagger UI/API detected at path: /v3/api-docs - sample paths:
GET /actuator
GET /actuator/health
GET /actuator/health/**
GET /api/v1/points/leaders
GET /api/v1/users/{recipientId}/points
GET /error
POST /api/v1/points
```
  Found on 2026-01-09 22:48
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 52.223.53.203
Domain: pointsapi.neslotech.co.za
Port: 443
URL: https://pointsapi.neslotech.co.za

First seen 2025-10-25 00:08
Last seen 2026-01-08 23:30
Open for 75 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd151e75e4b98651d5b19cca270eb6bf91a56007eb2c6d45717
```
Public Swagger UI/API detected at path: /v3/api-docs - sample paths:
GET /actuator
GET /actuator/health
GET /actuator/health/**
GET /api/v1/points/leaders
GET /api/v1/users/{recipientId}/points
GET /error
POST /api/v1/points
```
  Found on 2026-01-08 23:30
Create report

Open service 3.33.249.164:80 · pointsapi.neslotech.co.za

2026-01-09 22:48

HTTP/1.1 401 Unauthorized
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Length: 217
Content-Type: application/json
Date: Fri, 09 Jan 2026 22:49:14 GMT
Expires: 0
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Pragma: no-cache
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=hYpwCgFvo0Uimlcts3VNx5SvPhKcVHNQ5m8g0%2BP6Mq0%3D\u0026sid=812dcc77-0bd0-43b1-a5f1-b25750382959\u0026ts=1767998954"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=hYpwCgFvo0Uimlcts3VNx5SvPhKcVHNQ5m8g0%2BP6Mq0%3D&sid=812dcc77-0bd0-43b1-a5f1-b25750382959&ts=1767998954"
Server: Heroku
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Xss-Protection: 1; mode=block
Connection: close


{"timestamp":"09-01-2026 22:49:14","status":"UNAUTHORIZED","message":"Full authentication is required to access this resource","debugMessage":"Full authentication is required to access this resource","subErrors":null}

Found 2 days ago by HttpPlugin

Create report

Open service 52.223.53.203:443 · pointsapi.neslotech.co.za

2026-01-08 23:30

HTTP/1.1 401 Unauthorized
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Length: 217
Content-Type: application/json
Date: Thu, 08 Jan 2026 23:30:55 GMT
Expires: 0
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Pragma: no-cache
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=7C55jE36jVIJIBXUcDq5O%2Fv%2Fsw%2BOp4xkhRcam7gEBDg%3D\u0026sid=812dcc77-0bd0-43b1-a5f1-b25750382959\u0026ts=1767915055"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=7C55jE36jVIJIBXUcDq5O%2Fv%2Fsw%2BOp4xkhRcam7gEBDg%3D&sid=812dcc77-0bd0-43b1-a5f1-b25750382959&ts=1767915055"
Server: Heroku
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Xss-Protection: 1; mode=block
Connection: close


{"timestamp":"08-01-2026 23:30:55","status":"UNAUTHORIZED","message":"Full authentication is required to access this resource","debugMessage":"Full authentication is required to access this resource","subErrors":null}

Found 2026-01-08 by HttpPlugin

Create report

Open service 52.223.53.203:443 · pointsapi.neslotech.co.za

2026-01-01 22:05

HTTP/1.1 401 Unauthorized
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Length: 217
Content-Type: application/json
Date: Thu, 01 Jan 2026 22:05:37 GMT
Expires: 0
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Pragma: no-cache
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=IjNDTAUsWvpOhE7vlwIuNlkp0fhUqR4heKQee0IZJNY%3D\u0026sid=812dcc77-0bd0-43b1-a5f1-b25750382959\u0026ts=1767305137"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=IjNDTAUsWvpOhE7vlwIuNlkp0fhUqR4heKQee0IZJNY%3D&sid=812dcc77-0bd0-43b1-a5f1-b25750382959&ts=1767305137"
Server: Heroku
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Xss-Protection: 1; mode=block
Connection: close


{"timestamp":"01-01-2026 22:05:37","status":"UNAUTHORIZED","message":"Full authentication is required to access this resource","debugMessage":"Full authentication is required to access this resource","subErrors":null}

Found 2026-01-01 by HttpPlugin

Create report

Open service 3.33.249.164:80 · pointsapi.neslotech.co.za

2025-12-30 12:12

HTTP/1.1 401 Unauthorized
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Length: 217
Content-Type: application/json
Date: Tue, 30 Dec 2025 12:12:29 GMT
Expires: 0
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Pragma: no-cache
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=k5CWkWPK7mEkii7Eca7Qr452UvYFHVgfBCfwmVVKEH0%3D\u0026sid=812dcc77-0bd0-43b1-a5f1-b25750382959\u0026ts=1767096749"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=k5CWkWPK7mEkii7Eca7Qr452UvYFHVgfBCfwmVVKEH0%3D&sid=812dcc77-0bd0-43b1-a5f1-b25750382959&ts=1767096749"
Server: Heroku
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Xss-Protection: 1; mode=block
Connection: close


{"timestamp":"30-12-2025 12:12:29","status":"UNAUTHORIZED","message":"Full authentication is required to access this resource","debugMessage":"Full authentication is required to access this resource","subErrors":null}

Found 2025-12-30 by HttpPlugin

Create report

Open service 52.223.53.203:443 · pointsapi.neslotech.co.za

2025-12-30 06:26

HTTP/1.1 401 Unauthorized
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Length: 217
Content-Type: application/json
Date: Tue, 30 Dec 2025 06:26:13 GMT
Expires: 0
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Pragma: no-cache
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=i66XtxnZO%2BNbv5s%2BTT0QFdyatyTcjxtzEnUwFuCPMHA%3D\u0026sid=812dcc77-0bd0-43b1-a5f1-b25750382959\u0026ts=1767075973"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=i66XtxnZO%2BNbv5s%2BTT0QFdyatyTcjxtzEnUwFuCPMHA%3D&sid=812dcc77-0bd0-43b1-a5f1-b25750382959&ts=1767075973"
Server: Heroku
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Xss-Protection: 1; mode=block
Connection: close


{"timestamp":"30-12-2025 06:26:13","status":"UNAUTHORIZED","message":"Full authentication is required to access this resource","debugMessage":"Full authentication is required to access this resource","subErrors":null}

Found 2025-12-30 by HttpPlugin