LeakIX - Host prod-r0.windows.cloud.microsoft

Domain prod-r0.windows.cloud.microsoft

United States

MICROSOFT-CORP-MSN-AS-BLOCK

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 13.107.213.44
Domain: prod-r0.windows.cloud.microsoft
Port: 443
URL: https://prod-r0.windows.cloud.microsoft

First seen 2025-10-16 03:16
Last seen 2025-12-18 23:26
Open for 63 days

Severity: info
Fingerprint: 5733ddf49ff49cd1f3d88d609b0a7cdbe6b53500bb3bfa1743fe2fbcd42e990f

Public Swagger UI/API detected at path: /swagger/v1/swagger.json - sample paths:
GET /
GET /.well-known/microsoft-identity-association.json
GET /RDWeb/ConsentCallback
GET /RDWeb/Pages/rdp/v2/{tenantId}/{filestem}/{hash}
GET /RDWeb/Pages/rdp/{filestem}/{hash}
GET /RDWeb/Resource/png/v2/{tenantId}/{id}/{hash}
GET /RDWeb/Resource/png/{id}/{hash}
GET /RDWeb/Resource/rawicon/v2/{tenantId}/{id}/{hash}
GET /RDWeb/Resource/rawicon/{id}/{hash}
GET /api/ClientOptions
GET /api/Health
GET /api/Health/lite
GET /api/arm/feeddiscovery
GET /api/arm/feeddiscovery/altfeeds
GET /api/arm/feeddiscovery/altfeeds/check/{aadTenantId}
GET /api/arm/feeddiscovery/hostpool/{hostPoolId}/sessionHost/{sessionHostId}/healthchecks
GET /api/arm/feeddiscovery/tenants/{tenantId}/app/{appId}
GET /api/arm/feeddiscovery/tenants/{tenantId}/icons/{id}
GET /api/arm/feeddiscovery/tenants/{tenantId}/pngs/{id}
GET /api/arm/feeddiscovery/tenants/{tenantId}/rdps/{id}
GET /api/arm/feeddiscovery/tenants/{tenantId}/webfeed
GET /api/arm/hubdiscovery
GET /api/arm/webdownload/tenants/{workspaceId}/resources/{resourceId}
GET /api/arm/weblaunch/tenants/{workspaceId}/resources/{resourceId}
GET /api/arm/weblaunchlink/tenants/{workspaceId}/resources/{resourceId}
GET /api/clientTelemetryHub
GET /api/feeddiscovery/webfeeddiscovery.aspx
GET /api/hubdiscovery/eventhubdiscovery.aspx
GET /arm/webclient/Config/deploymentsettings.js
GET /arm/webclient/legacy/Config/deploymentsettings.js
GET /arm/webclient/v2/Config/deploymentsettings.js
GET /webclient/Config/deploymentsettings.js
GET /webclient/legacy/Config/deploymentsettings.js
GET /webclient/v2/Config/deploymentsettings.js
GET /{tenantid}/RDWeb/Feed/webfeed.aspx
POST /api/AADEvents/v1
POST /api/CSPReport/v1
POST /api/DiagnosticEvents/v1
POST /api/arm/DiagnosticEvents/v1

Found on 2025-12-18 23:26

Create report

Open service 13.107.213.44:443 · prod-r0.windows.cloud.microsoft

2026-01-23 04:41

HTTP/1.1 200 OK
Date: Fri, 23 Jan 2026 04:41:11 GMT
Content-Type: text/html
Content-Length: 1631
Connection: close
Cache-Control: no-store
ETag: 0x8DE588E084F1BF5
Last-Modified: Wed, 21 Jan 2026 01:40:18 GMT
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
x-ms-request-id: b42edb8d-801e-001a-52cd-8b361e000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
x-azure-ref: 20260123T044111Z-16f45f5c75b8qr9mhC1BY1rmbn0000000t9000000000hptc
X-Cache: CONFIG_NOCACHE
x-ms-wvd-service-region: WUS
x-ms-lamport-ts: 10955938010
x-ms-correlation-id: 2f673eed-38f2-47f5-a730-af99f5417b96
X-Powered-By: ASP.NET
X-Content-Type-Options: nosniff


pe.com; worker-src 'self'; form-action 'none'; object-src 'self'; block-all-mixed-content; manifest-src 'self'; report-uri https://edge.skype.net/r/c;frame-ancestors 'self';
Accept-Ranges: bytes

<!doctype html>
<html>
  <head>
    <meta charset="utf-8"/>
    <meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no"/>
    <meta name="theme-color" content="#000000"/>
    <meta name="product" content="Windows App"/>
    <meta name="awa-pageType" content="web"/>
    
    <link rel="manifest" href="./manifest.json"/>
    <link type="image/x-icon" rel="icon" id="dynamic-favicon-ico" href="./favicon.ico">
    <link type="image/png" rel="shortcut icon" id="dynamic-favicon-png" href="./favicon.png">
    <script type="text/javascript">var browserLang=navigator.language||navigator.userLanguage;browserLang||(browserLang="en-us"),document.documentElement.lang=browserLang</script>
  <link href="/static/css/main.1.0.03300.55.css" rel="stylesheet"></head>
  <body>
    <noscript> You need to enable JavaScript to run this app. </noscript>
    <div id="cookie-banner" style="position:fixed;width:100%;bottom:0;z-index:2"></div>
    <div id="root"></div>
    <script>var serviceConfig={brandName:"Windows App",basePath:"",enableAvdHost:"True"}</script>
    <script>var userInfo={version:"1.0.03300.55",env:"PROD"}</script>
    <script>var features={}</script>
    <script src="https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js"></script>
    <script src="https://shell.cdn.office.net/api/shellbootstrapper/business/oneshell"></script>
  <script defer="defer" src="/static/j