LeakIX - Host stifel.com

Domain stifel.com

United States

Akamai International B.V.

Software information

AmazonS3

tcp/443

Apache Apache 2.4.7

tcp/443 tcp/80

CloudFront

tcp/80

Kestrel Kestrel

tcp/443

awselb awselb 2.0

tcp/80

cloudflare

tcp/443 tcp/80 tcp/8443

nginx nginx

tcp/443

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 23.50.131.149
Domain: uattrackagator-api.csa.stifel.com
Port: 443
URL: https://uattrackagator-api.csa.stifel.com

First seen 2025-11-21 19:54
Last seen 2025-11-30 09:39
Open for 8 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549cbf2c224f6c5a17a8931530b216f2d33ff41948a

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
DELETE /api/Prospects/{q2Id}
DELETE /api/accountgroups/{name}
DELETE /api/deliveryPreferences/deleteUserImportFlag/{id}
DELETE /api/deliveryPreferences/deleteUserPreferences/{id}
DELETE /api/enrollment/delete
GET /api/Addepar
GET /api/Advisors
GET /api/BillPay
GET /api/Branch
GET /api/Client
GET /api/ConvertUser/conversionError
GET /api/DeferredCompensation
GET /api/Documents/fast
GET /api/Documents/slow
GET /api/Download/GetDocument
GET /api/Download/GetDocumentNew
GET /api/Download/gets3doc
GET /api/Download/{reportType}/{id}
GET /api/EnrollToBillPay
GET /api/GetCheckImage
GET /api/Group
GET /api/HealthCheck
GET /api/InactivateRxpAccount
GET /api/InactivateRxpSubscriber
GET /api/Inserts
GET /api/Markit/SSO-Start
GET /api/OtherNotices
GET /api/OtherNotices/documentNames
GET /api/PlaidAccounts
GET /api/PlaidAccounts/AccountsIncludingDisabled
GET /api/PlaidAccounts/GetPlaidAccountTypes
GET /api/PlaidInstitutions/AuthVerified/{itemId}
GET /api/PlaidInstitutions/AutoSync/SyncStatus
GET /api/PlaidInstitutions/EnablePlaidAuth/{itemId}
GET /api/PlaidInstitutions/Sync/{itemId}
GET /api/ProductIntRate
GET /api/Prospects
GET /api/ScreenConfiguration
GET /api/ScreenConfiguration/{screen}
GET /api/Statements
GET /api/Statements/range
GET /api/TaxForms
GET /api/Toggle
GET /api/Toggle/getall
GET /api/Toggle/getfeatureJSON/{featureName}
GET /api/Toggle/getfeatureJSONArray/{featureName}
GET /api/Toggle/getfeatureints
GET /api/Toggle/getfeaturestring/{featureName}
GET /api/TokenExchange
GET /api/UpdateRxpKey
GET /api/accountShare/yearlyReminder
GET /api/accountgroups
GET /api/accounts
GET /api/accounts/AccountsWithEligibility/{q2Id}
GET /api/accounts/RealtimeBalanceByProductType/{q2Id}/{productType}/{accountNumber}
GET /api/accounts/mrdc/{q2Id}
GET /api/accountshare
GET /api/accountshare/byOthers
GET /api/accountshare/message/optOut
GET /api/broadridgemailbox/shareholderaccounts
GET /api/cashflow/hierarchy
GET /api/confirms
GET /api/confirms/range
GET /api/csrassist
GET /api/deliveryPreferences/ChangeRequest
GET /api/deliveryPreferences/autoEnroll
GET /api/deliveryPreferences/importShareholderNotices
GET /api/deliverypreferences
GET /api/deliverypreferences/emailstatus
GET /api/holdings/historicalbysecurity
GET /api/holdings/positions/details
GET /api/holdings/realized
GET /api/holdings/unrealized
GET /api/manualaccounts/categories
GET /api/openorders
GET /api/portfolio
GET /api/projectedmonthlyincome
GET /api/quicken
GET /api/realtime/quote
GET /api/registration/sharer
GET /api/research/companydetails
GET /api/research/companyreports/top12
GET /api/research/marketcommentary
GET /api/research/marketcommentary/reportV2
GET /api/research/symbolsanddescriptions
GET /api/totalaccountvalues/historical/deferredcomp
GET /api/totalaccountvalues/historical/manual
GET /api/totalaccountvalues/historical/mortgage
GET /api/totalaccountvalues/historical/plaid
GET /api/totalaccountvalues/historical/pscu
GET /api/totalaccountvalues/historical/spa
GET /api/totalaccountvalues/historical/stifel
GET /api/totalaccountvalues/historical/stifelbank
GET /api/transactions/all
GET /api/transactions/details
GET /api/user
GET /api/user/iscsrallowed
GET /api/user/iscsrallowedexternalmanual
GET /api/users/billpaydetails/{q2Id}
GET /api/users/{q2Id}
GET /api/v2/holdings/historical
GET /api/xignite/globalindices
GET /api/zelle/GetRealtimeBalance
GET /api/zelle/{q2Id}
POST /api/ConvertUser/clearCache
POST /api/ConvertUser/resetAuthFailures
POST /api/ConvertUser/startConversion
POST /api/Logging/Log
POST /api/Logging/Log/{container}
POST /api/Logging/LogForNetZero
POST /api/Markit/ACS
POST /api/Markit/SSO
POST /api/PlaidInstitutions/CreateLinkToken
POST /api/PlaidInstitutions/ExchangeToken/{authOnly}
POST /api/PlaidInstitutions/OauthExchangeToken/{authOnly}
POST /api/accountnickname
POST /api/accounts/RealtimeBalanceByAccount
POST /api/accounts/subscriberid
POST /api/accountshare/edit
POST /api/accountshare/revokeAccess
POST /api/accountshare/revokeByOthers
POST /api/accountshare/updateReminderViewedDate
POST /api/accounttype
POST /api/deliveryPreferences/ChangeRequest/decide-accept
POST /api/deliveryPreferences/ChangeRequest/decide-manual
POST /api/deliveryPreferences/ChangeRequest/decide-reject
POST /api/deliveryPreferences/import
POST /api/deliveryPreferences/setUserPreferences
POST /api/enrollment/referred
POST /api/enrollment/search/clients
POST /api/enrollment/tokens
POST /api/enrollment/unique
POST /api/logins/logout/{loginId}
POST /api/logins/{loginId}/preload
POST /api/manualaccounts
POST /api/manualaccounts/delete
POST /api/notification/userActive
POST /api/preload/clearpreloadcache
POST /api/registration
POST /api/research/marketcommentary/report
POST /api/transactions/notes
POST /api/transactions/split
POST /api/users
POST /connect/token
PUT /api/PlaidAccounts/DisableAccount
PUT /api/PlaidAccounts/DisableExternalTransfer
PUT /api/PlaidAccounts/UpdatePlaidAccount
PUT /api/PlaidInstitutions/{itemId}
PUT /api/transactions
PUT /api/user/iscsrallowed/{isCSRAllowed}
PUT /api/user/iscsrallowedexternalmanual/{isExternal}/{isCSRAllowed}

Found on 2025-11-30 09:39

Create report

Open service 54.192.35.115:80 · eo.fiserv-proxy-dev.csa.stifel.com

2026-02-07 04:43

HTTP/1.1 301 Moved Permanently
Server: CloudFront
Date: Sat, 07 Feb 2026 04:43:18 GMT
Content-Type: text/html
Content-Length: 167
Connection: close
Location: https://eo.fiserv-proxy-dev.csa.stifel.com/
X-Cache: Redirect from cloudfront
Via: 1.1 fed2362c6a1e27e36b5fe03cba76e58e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-P15
X-Amz-Cf-Id: RQXx4Xv_EOZGY8s5ouKmzY0nFnSOiLd31CSvHH7vu2xkWrZj-y3qMw==

Page title: 301 Moved Permanently

<html>
<head><title>301 Moved Permanently</title></head>
<body>
<center><h1>301 Moved Permanently</h1></center>
<hr><center>CloudFront</center>
</body>
</html>

Found 11 hours ago by HttpPlugin