Apache
tcp/443 tcp/80
Microsoft-IIS 10.0
tcp/443 tcp/80
nginx 1.23.4
tcp/443
Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1f3d88d60fce68b655c31aa22b1a3a70dcaee0cad4cefd3be
Public Swagger UI/API detected at path: /swagger/v1/swagger.json - sample paths: GET /api/ConsumerApp/v1/AccountDeletionInfo GET /api/ConsumerApp/v1/ChangeEmailConfirmation GET /api/ConsumerApp/v1/CheckCPF GET /api/ConsumerApp/v1/CompleteRegistration GET /api/ConsumerApp/v1/CompleteRegistrationExpiredToken GET /api/ConsumerApp/v1/ConfirmAccount GET /api/ConsumerApp/v1/ExpiredToken GET /api/ConsumerApp/v1/GetAddressByZipCode GET /api/ConsumerApp/v1/GetExtractOccurrenceDetails GET /api/ConsumerApp/v1/GetExtractOccurrenceDetailsItems GET /api/ConsumerApp/v1/GetExtractOccurrences GET /api/ConsumerApp/v1/GetOccurrences GET /api/ConsumerApp/v1/GetOccurrencesByPeriod GET /api/ConsumerApp/v1/GetPromotions GET /api/ConsumerApp/v1/GetPushNotification GET /api/ConsumerApp/v1/GetPushNotifications GET /api/ConsumerApp/v1/GetRedeemAwaitingConsumerAuthorization GET /api/ConsumerApp/v1/GetRewardsAboutToExpire GET /api/ConsumerApp/v1/GetSelectedContractInfo GET /api/ConsumerApp/v1/GetStores GET /api/ConsumerApp/v1/GetStoresWithGPS GET /api/ConsumerApp/v1/GetTermsOfUse GET /api/ConsumerApp/v1/GetUserBasicData GET /api/ConsumerApp/v1/GetUserCellPhoneNumber GET /api/ConsumerApp/v1/GetUserComplementaryData GET /api/ConsumerApp/v1/GetUserEmailAddress GET /api/ConsumerApp/v1/GetWarningMessageForAccountDeletion GET /api/ConsumerApp/v1/Logout GET /api/ConsumerApp/v1/PCPayPrivacyPolicy GET /api/ConsumerApp/v1/PrivacyPolicy GET /api/ConsumerApp/v1/ResetPassword GET /api/ConsumerApp/v1/ResetPasswordConfirmation GET /api/ConsumerApp/v1/SendCompleteRegistrationEmail GET /api/ConsumerApp/v1/SupportInfo GET /api/ConsumerApp/v1/TermsOfUse GET /api/ConsumerApp/v1/TermsOfUseAndPrivacyPolicy GET /api/ConsumerApp/v1/VerifyCellPhoneNumber GET /api/WhatsAppWebhook/v1 POST /api/ConsumerApp/v1/AnswerRedeemAwaitingConsumerAuthorization POST /api/ConsumerApp/v1/AuthenticateWithPassword POST /api/ConsumerApp/v1/AuthorizeAccountDeletion POST /api/ConsumerApp/v1/ChangeConsumerContractBalance POST /api/ConsumerApp/v1/ChangeEmailAddress POST /api/ConsumerApp/v1/CleanConsumerContractLinks POST /api/ConsumerApp/v1/ConfirmCellPhoneNumber POST /api/ConsumerApp/v1/ConfirmCompleteRegistration POST /api/ConsumerApp/v1/DeleteAccount POST /api/ConsumerApp/v1/DeleteConsumerContractLink POST /api/ConsumerApp/v1/EnterConsumerIdentificationBasicData POST /api/ConsumerApp/v1/EnterConsumerRegistrationDataPhase1 POST /api/ConsumerApp/v1/EnterConsumerRegistrationDataPhase2 POST /api/ConsumerApp/v1/EnterPIN POST /api/ConsumerApp/v1/FinishUserCellPhoneNumberChange POST /api/ConsumerApp/v1/FinishUserEmailAddressChange POST /api/ConsumerApp/v1/ForgotPassword POST /api/ConsumerApp/v1/InsertConsumerContractLink POST /api/ConsumerApp/v1/Login POST /api/ConsumerApp/v1/RefreshToken POST /api/ConsumerApp/v1/Register POST /api/ConsumerApp/v1/RequestRedeem POST /api/ConsumerApp/v1/SelectPINSendChannel POST /api/ConsumerApp/v1/SendContactMessage POST /api/ConsumerApp/v1/SendPushNotification POST /api/ConsumerApp/v1/SendToken POST /api/ConsumerApp/v1/StartUserCellPhoneNumberChange POST /api/ConsumerApp/v1/StartUserEmailAddressChange POST /api/ConsumerApp/v1/UserBasicDataChange POST /api/ConsumerApp/v1/UserComplementaryBasicDataChange POST /api/ConsumerApp/v1/ValidateAccountDeletionToken POST /api/WhatsAppWebhook/v1/PlugMessageInstanceConnectedWebhook POST /api/WhatsAppWebhook/v1/PlugMessageInstanceDisconnectedWebhook POST /api/WhatsAppWebhook/v1/PlugMessageMsgReceived POST /api/WhatsAppWebhook/v1/PlugMessageMsgStatusReceived POST /api/WhatsAppWebhook/v1/ReceiveMsgForwardedFromProductionEnvironment
Open service 108.167.151.52:80 · lp.pontocash.com.br
2026-02-09 13:07
HTTP/1.1 200 OK
Date: Mon, 09 Feb 2026 13:08:03 GMT
Server: Apache
Vary: User-Agent,Accept-Encoding
Upgrade: h2,h2c
Connection: Upgrade, close
Accept-Ranges: bytes
Content-Length: 261580
Cache-Control: max-age=0, public
Expires: Mon, 09 Feb 2026 13:08:03 GMT
X-Powered-By: WP Rocket/3.11.4.2
Content-Type: text/html; charset=UTF-8
Page title: Ponto Cash
<!DOCTYPE html>
<html lang="pt-BR">
<head><meta charset="UTF-8"><script>if(navigator.userAgent.match(/MSIE|Internet Explorer/i)||navigator.userAgent.match(/Trident\/7\..*?rv:11/i)){var href=document.location.href;if(!href.match(/[?&]nowprocket/)){if(href.indexOf("?")==-1){if(href.indexOf("#")==-1){document.location.href=href+"?nowprocket=1"}else{document.location.href=href.replace("#","?nowprocket=1#")}}else{if(href.indexOf("#")==-1){document.location.href=href+"&nowprocket=1"}else{document.location.href=href.replace("#","&nowprocket=1#")}}}}</script><script>class RocketLazyLoadScripts{constructor(){this.triggerEvents=["keydown","mousedown","mousemove","touchmove","touchstart","touchend","wheel"],this.userEventHandler=this._triggerListener.bind(this),this.touchStartHandler=this._onTouchStart.bind(this),this.touchMoveHandler=this._onTouchMove.bind(this),this.touchEndHandler=this._onTouchEnd.bind(this),this.clickHandler=this._onClick.bind(this),this.interceptedClicks=[],window.addEventListener("pageshow",(e=>{this.persisted=e.persisted})),window.addEventListener("DOMContentLoaded",(()=>{this._preconnect3rdParties()})),this.delayedScripts={normal:[],async:[],defer:[]},this.allJQueries=[]}_addUserInteractionListener(e){document.hidden?e._triggerListener():(this.triggerEvents.forEach((t=>window.addEventListener(t,e.userEventHandler,{passive:!0}))),window.addEventListener("touchstart",e.touchStartHandler,{passive:!0}),window.addEventListener("mousedown",e.touchStartHandler),document.addEventListener("visibilitychange",e.userEventHandler))}_removeUserInteractionListener(){this.triggerEvents.forEach((e=>window.removeEventListener(e,this.userEventHandler,{passive:!0}))),document.removeEventListener("visibilitychange",this.userEventHandler)}_onTouchStart(e){"HTML"!==e.target.tagName&&(window.addEventListener("touchend",this.touchEndHandler),window.addEventListener("mouseup",this.touchEndHandler),window.addEventListener("touchmove",this.touchMoveHandler,{passive:!0}),window.addEventListener("mousemove",this.touchMoveHandler),e.target.addEventListener("click",this.clickHandler),this._renameDOMAttribute(e.target,"onclick","rocket-onclick"))}_onTouchMove(e){window.removeEventListener("touchend",this.touchEndHandler),window.removeEventListener("mouseup",this.touchEndHandler),window.removeEventListener("touchmove",this.touchMoveHandler,{passive:!0}),window.removeEventListener("mousemove",this.touchMoveHandler),e.target.removeEventListener("click",this.clickHandler),this._renameDOMAttribute(e.target,"rocket-onclick","onclick")}_onTouchEnd(e){window.removeEventListener("touchend",this.touchEndHandler),window.removeEventListener("mouseup",this.touchEndHandler),window.removeEventListener("touchmove",this.touchMoveHandler,{passive:!0}),window.removeEventListener("mousemove",this.touchMoveHandler)}_onClick(e){e.target.removeEventListener("click",this.clickHandler),this._renameDOMAttribute(e.target,"rocket-onclick","onclick"),this.interceptedClicks.push(e),e.preventDefault(),e.stopPropagation(),e.stopImmediatePropagation()}_replayClicks(){window.removeEventListener("touchstart",this.touchStartHandler,{passive:!0}),window.removeEventListener("mousedown",this.touchStartHandler),this.interceptedClicks.forEach((e=>{e.target.dispatchEvent(new MouseEvent("click",{view:e.view,bubbles:!0,cancelable:!0}))}))}_renameDOMAttribute(e,t,n){e.hasAttribute&&e.hasAttribute(t)&&(event.target.setAttribute(n,event.target.getAttribute(t)),event.target.removeAttribute(t))}_triggerListener(){this._removeUserInteractionListener(this),"loading"===document.readyState?document.addEventListener("DOMContentLoaded",this._loadEverythingNow.bind(this)):this._loadEverythingNow()}_preconnect3rdParties(){let e=[];document.querySelectorAll("script[type=rocketlazyloadscript]").forEach((t=>{if(t.hasAttribute("src")){const n=new URL(t.src).origin;n!==location.origin&&e.push({src:n,crossOrigin:t.crossOrigin||"module"===t.getAttribute("data-rocket-type")})}})),e=[...new Map(e.map((e=>[JSON.stringify(e),e]))).values()],this._batchInjectResourceHints(e,"preconnect")}async _loadEverythi
Open service 167.234.235.22:80 · click.pontocash.com.br
2026-01-26 03:10
HTTP/1.1 301 Moved Permanently Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Location: https://click.pontocash.com.br/ Server: Microsoft-IIS/10.0 Access-Control-Max-Age: 1728000 Set-Cookie: ASP.NET_SessionId=itlhkysn1ebc2yevlxmonlan; path=/; HttpOnly; SameSite=Lax X-AspNetMvc-Version: 5.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, HEAD, POST, DEBUG, PUT, DELETE, PATCH, OPTIONS Date: Mon, 26 Jan 2026 03:10:51 GMT Connection: close Content-Length: 148 Page title: Object moved <html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="https://click.pontocash.com.br/">here</a>.</h2> </body></html>
Open service 167.234.235.22:443 · click.pontocash.com.br
2026-01-26 03:10
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Server: Microsoft-IIS/10.0
Access-Control-Max-Age: 1728000
Set-Cookie: ASP.NET_SessionId=kt25px5f1z1pjmgutw2tmjbo; path=/; HttpOnly; SameSite=Lax
X-AspNetMvc-Version: 5.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: *
Access-Control-Allow-Methods: GET, HEAD, POST, DEBUG, PUT, DELETE, PATCH, OPTIONS
Date: Mon, 26 Jan 2026 03:10:51 GMT
Connection: close
Content-Length: 565
Page title: leadlovers
<!DOCTYPE html>
<html>
<head>
<meta name="viewport" content="width=device-width" />
<title>leadlovers</title>
<style type="text/css">
html, body {
height: 100%;
}
body {
margin: 0 !important;
overflow: hidden !important;
padding: 0 !important;
}
iframe {
width: 100%;
height: 100%;
}
</style>
</head>
<body>
<iframe src="https://ll-send.com/domain" frameborder="0"></iframe>
</body>
</html>
Open service 108.167.151.52:443 · pontocash.com.br
2026-01-23 11:45
HTTP/1.1 200 OK
Date: Fri, 23 Jan 2026 11:45:19 GMT
Server: Apache
Vary: User-Agent,Accept-Encoding
Upgrade: h2,h2c
Connection: Upgrade, close
Accept-Ranges: bytes
Content-Length: 206281
Cache-Control: max-age=0, public
Expires: Fri, 23 Jan 2026 11:45:19 GMT
X-Powered-By: WP Rocket/3.17.3
Content-Type: text/html; charset=UTF-8
Page title: Ponto Cash – Cashback e Descontos
<!DOCTYPE html>
<html lang="pt-BR">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Ponto Cash – Cashback e Descontos</title><link rel="preload" data-rocket-preload as="image" href="https://pontocash.com.br/wp-content/uploads/2025/09/IMAGEM-1-997x740-2.png" imagesrcset="https://pontocash.com.br/wp-content/uploads/2025/09/IMAGEM-1-997x740-2.png 997w, https://pontocash.com.br/wp-content/uploads/2025/09/IMAGEM-1-997x740-2-300x223.png 300w, https://pontocash.com.br/wp-content/uploads/2025/09/IMAGEM-1-997x740-2-768x570.png 768w" imagesizes="(max-width: 997px) 100vw, 997px" fetchpriority="high">
<meta name='robots' content='max-image-preview:large' />
<link rel='dns-prefetch' href='//use.fontawesome.com' />
<link rel="alternate" type="application/rss+xml" title="Feed para Ponto Cash »" href="https://pontocash.com.br/feed/" />
<link rel="alternate" type="application/rss+xml" title="Feed de comentários para Ponto Cash »" href="https://pontocash.com.br/comments/feed/" />
<link rel="alternate" title="oEmbed (JSON)" type="application/json+oembed" href="https://pontocash.com.br/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fpontocash.com.br%2F" />
<link rel="alternate" title="oEmbed (XML)" type="text/xml+oembed" href="https://pontocash.com.br/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fpontocash.com.br%2F&format=xml" />
<style id='wp-img-auto-sizes-contain-inline-css'>
img:is([sizes=auto i],[sizes^="auto," i]){contain-intrinsic-size:3000px 1500px}
/*# sourceURL=wp-img-auto-sizes-contain-inline-css */
</style>
<link rel='stylesheet' id='elementor-frontend-css' href='https://pontocash.com.br/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.33.4' media='all' />
<link rel='stylesheet' id='elementor-post-4795-css' href='https://pontocash.com.br/wp-content/uploads/elementor/css/post-4795.css?ver=1764832614' media='all' />
<link rel='stylesheet' id='elementor-post-4700-css' href='https://pontocash.com.br/wp-content/uploads/elementor/css/post-4700.css?ver=1764832614' media='all' />
<style id='wp-emoji-styles-inline-css'>
img.wp-smiley, img.emoji {
display: inline !important;
border: none !important;
box-shadow: none !important;
height: 1em !important;
width: 1em !important;
margin: 0 0.07em !important;
vertical-align: -0.1em !important;
background: none !important;
padding: 0 !important;
}
/*# sourceURL=wp-emoji-styles-inline-css */
</style>
<style id='classic-theme-styles-inline-css'>
/*! This file is auto-generated */
.wp-block-button__link{color:#fff;background-color:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}
/*# sourceURL=/wp-includes/css/classic-themes.min.css */
</style>
<style id='joinchat-button-style-inline-css'>
.wp-block-joinchat-button{border:none!important;text-align:center}.wp-block-joinchat-button figure{display:table;margin:0 auto;padding:0}.wp-block-joinchat-button figcaption{font:normal normal 400 .6em/2em var(--wp--preset--font-family--system-font,sans-serif);margin:0;padding:0}.wp-block-joinchat-button .joinchat-button__qr{background-color:#fff;border:6px solid #25d366;border-radius:30px;box-sizing:content-box;display:block;height:200px;margin:auto;overflow:hidden;padding:10px;width:200px}.wp-block-joinchat-button .joinchat-button__qr canvas,.wp-block-joinchat-button .joinchat-button__qr img{display:block;margin:auto}.wp-block-joinchat-button .joinchat-button__link{align-items:center;background-color:#25d366;border:6px solid #25d366;border-radius:30px;display:inline-flex;flex-flow:row nowrap;justify-content:center;line-height:1.25em;margin:0 auto;text-decoration:none}.wp-block-joinchat-button .joinchat-button__link:before{background:transparent var(--joinchat-ico) no-repeat center;background-size:100%;content:"";display:block;height:1.5em;margin:-.75em .75em -.75em 0;width:1.5em}.wp-block-joinchat-button figure+.joinchat-button__link{margin-
Open service 108.167.151.52:443 · www.lp.pontocash.com.br
2026-01-23 11:06
HTTP/1.1 301 Moved Permanently Date: Fri, 23 Jan 2026 11:06:49 GMT Server: Apache X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: https://lp.pontocash.com.br/ Cache-Control: max-age=0 Expires: Fri, 23 Jan 2026 11:06:49 GMT Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8
Open service 191.235.81.73:443 · sandbox-ctf.integration.pontocash.com.br
2026-01-23 11:03
HTTP/1.1 404 Not Found Content-Length: 0 Connection: close Date: Fri, 23 Jan 2026 11:04:04 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=ee244e50f500fb8b8b314e0e13b49bd52be6ec78d6021fe24f2e864f733cd36a;Path=/;HttpOnly;Secure;Domain=sandbox-ctf.integration.pontocash.com.br Set-Cookie: ARRAffinitySameSite=ee244e50f500fb8b8b314e0e13b49bd52be6ec78d6021fe24f2e864f733cd36a;Path=/;HttpOnly;SameSite=None;Secure;Domain=sandbox-ctf.integration.pontocash.com.br Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff
Open service 108.167.151.52:443 · www.hub.pontocash.com.br
2026-01-23 08:13
HTTP/1.1 301 Moved Permanently Date: Fri, 23 Jan 2026 08:13:04 GMT Server: nginx/1.23.4 Content-Type: text/html; charset=UTF-8 Content-Length: 0 X-Redirect-By: WordPress Location: https://hub.pontocash.com.br/ X-Server-Cache: true X-Proxy-Cache: EXPIRED
Open service 191.235.81.73:443 · sandbox-hmg.consumer.pontocash.com.br
2026-01-22 23:03
HTTP/1.1 301 Moved Permanently Content-Length: 0 Connection: close Date: Thu, 22 Jan 2026 23:03:48 GMT Server: Microsoft-IIS/10.0 Location: index.html Set-Cookie: ARRAffinity=ee244e50f500fb8b8b314e0e13b49bd52be6ec78d6021fe24f2e864f733cd36a;Path=/;HttpOnly;Secure;Domain=sandbox-hmg.consumer.pontocash.com.br Set-Cookie: ARRAffinitySameSite=ee244e50f500fb8b8b314e0e13b49bd52be6ec78d6021fe24f2e864f733cd36a;Path=/;HttpOnly;SameSite=None;Secure;Domain=sandbox-hmg.consumer.pontocash.com.br Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff
Open service 191.235.90.70:80 · integration.pontocash.com.br
2026-01-12 19:42
HTTP/1.1 301 Moved Permanently Content-Length: 0 Connection: close Date: Mon, 12 Jan 2026 19:43:47 GMT Location: https://integration.pontocash.com.br/
Open service 191.235.90.70:443 · integration.pontocash.com.br
2026-01-12 19:42
HTTP/1.1 404 Not Found Content-Length: 0 Connection: close Date: Mon, 12 Jan 2026 19:43:46 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=15f80ac832a314c85765a7bb0ed37e698c16c9e42ec5a7357f7d0cd44b91b220;Path=/;HttpOnly;Secure;Domain=integration.pontocash.com.br Set-Cookie: ARRAffinitySameSite=15f80ac832a314c85765a7bb0ed37e698c16c9e42ec5a7357f7d0cd44b91b220;Path=/;HttpOnly;SameSite=None;Secure;Domain=integration.pontocash.com.br Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff
Open service 191.235.81.73:443 · sandbox-hmg.consumer.pontocash.com.br
2026-01-10 02:23
HTTP/1.1 301 Moved Permanently Content-Length: 0 Connection: close Date: Sat, 10 Jan 2026 02:24:20 GMT Server: Microsoft-IIS/10.0 Location: index.html Set-Cookie: ARRAffinity=089720f887b5df6daa708956d9ec1ab93980c637808befba9b064fe0fafe23a8;Path=/;HttpOnly;Secure;Domain=sandbox-hmg.consumer.pontocash.com.br Set-Cookie: ARRAffinitySameSite=089720f887b5df6daa708956d9ec1ab93980c637808befba9b064fe0fafe23a8;Path=/;HttpOnly;SameSite=None;Secure;Domain=sandbox-hmg.consumer.pontocash.com.br Strict-Transport-Security: max-age=31536000; includeSubDomains X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff