AmazonS3
tcp/443
CloudFront
tcp/443
The following URL (usually /.git/config) is publicly accessible and is leaking source code and repository configuration.
Severity: high
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a6522d993bf6b
[core] repositoryformatversion = 0 filemode = true bare = false logallrefupdates = true [remote "origin"] url = https://mariofrescas@bitbucket.org/stella-tech/velpay-front-landing.git fetch = +refs/heads/*:refs/remotes/origin/* [branch "master"] remote = origin merge = refs/heads/master [branch "develop"] remote = origin merge = refs/heads/develop
Open service 13.33.187.91:443 · velpay.mx
2026-01-08 23:28
HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 30971
Connection: close
Date: Thu, 08 Jan 2026 23:28:54 GMT
Last-Modified: Wed, 25 Jan 2023 18:17:56 GMT
ETag: "e3522163bd7c7b2128055946d0a6b032"
x-amz-server-side-encryption: AES256
x-amz-version-id: TgxbrKm1ABQo5ZNxF3EMFNX6gf4z70iD
Accept-Ranges: bytes
Server: AmazonS3
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload
Content-Security-Policy: default-src 'none'; font-src 'self'; img-src 'self' https: https://cdn-images.mailchimp.com https://*.velpay.mx; script-src 'self' https://www.google-analytics.com/analytics.js https://cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js https://www.googletagmanager.com/gtm.js https://stackpath.bootstrapcdn.com https://cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js https://code.jquery.com https://cdnjs.cloudflare.com; connect-src 'self' https://www.google-analytics.com https://stats.g.doubleclick.net https://*.velpay.mx; style-src 'self' https://cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css https://cdn-images.mailchimp.com https://stackpath.bootstrapcdn.com; base-uri 'self'; form-action 'self' https://velpay.us4.list-manage.com; object-src 'none'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Referrer-Policy: same-origin
Cache-Control: no-cache; no-store
X-Cache: Miss from cloudfront
Via: 1.1 840e16b680c94fee8c48b15e01dda782.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P9
X-Amz-Cf-Id: UV6V93B0z8FRB2dcnq3Ny9lpqsxJwv0JP2Fo8iwSiTuYlwwkeYBbxg==
Page title: Velpay | Facilitador de pagos
<!doctype html>
<html lang="es-mx">
<head>
<!--<meta http-equiv="Content-Security-Policy" content="
default-src 'none';
font-src 'self';
img-src 'self' https: https://cdn-images.mailchimp.com https://*.velpay.mx;
script-src 'self' https://www.googletagmanager.com/gtm.js https://cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js https://stackpath.bootstrapcdn.com https://cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js https://code.jquery.com https://cdnjs.cloudflare.com https://www.google-analytics.com/analytics.js;
connect-src 'self' https://*.velpay.mx https://www.google-analytics.com;
style-src 'self' https://dn-images.mailchimp.com/embedcode/horizontal-slim-10_7.css https://cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css https://cdn-images.mailchimp.com https://stackpath.bootstrapcdn.com;
base-uri 'self';
form-action 'self' https://velpay.us4.list-manage.com;
object-src 'none'"
>--!>
<meta charset="utf-8">
<meta http-equiv="refresh" content="1; url=https://velpay.com.mx">
<script>
window.location.href = "https://velpay.com.mx"
</script>
<title>Velpay | Facilitador de pagos</title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="description"
content="Velpay es la siguiente generación de dispositivos en aceptación de medios, experiencias de pago para clientes y comercios." />
<meta name="author" content="Velpay" />
<meta name="copyright" content="Vel Pay, S.A. de C.V." />
<meta name="keywords" content="agregadores de pago, punto de venta, metodos de pago, pagos con tarjeta, smartpos, cobro con tarjeta, terminal para cobro con tarjeta, clip terminal, clip terminal bancaria, mercado pago, sr pago, terminal de cobro con tarjeta, aplicacion para cobrar con tarjeta, dispositivo para cobrar con tarjeta, maquina para cobrar con tarjeta" />
<meta name="Resource-type" CONTENT="Document" />
<meta name="DateCreated" CONTENT="Fri, 17 April 2020 03:19:00 GMT+6" />
<meta name="Revisit-after" CONTENT="30 days">
<meta name="robots" content="index, nofollow" />
<meta property="og:type" content="website">
<meta property="og:title" content="Velpay PayFac">
<meta property="og:description"
content="Velpay es la siguiente generación de dispositivos en aceptación de medios, experiencias de pago para clientes y comercios.">
<meta property="og:image" content="http://velpay.mx/assets/images/slider-next/mdpi/terminal-velpay.png">
<meta property="og:url" content="https://velpay.mx/">
<meta name="twitter:description"
content="Velpay es la siguiente generación de dispositivos en aceptación de medios, experiencias de pago para clientes y comercios.">
<meta name="twitter:title" content="Velpay PayFac">
<meta name="twitter:card" content="summary" />
<meta name="twitter:image" content="http://velpay.mx/assets/images/slider-next/mdpi/terminal-velpay.png" />
<meta name="twitter:site" content="https://velpay.mx/" />
<link rel="icon" type="image/x-icon" href="favicon.ico">
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css"
integrity="sha384-B0vP5xmATw1+K9KRQjQERJvTumQW0nPEzvF6L/Z6nronJ3oUOFUFpCjEUQouq2+l" crossorigin="anonymous">
<script src="https://code.jquery.com/jquery-3.5.1.slim.min.js"
integrity="sha384-DfXdz2htPH0lsSSs5nCTpuj/zy4C+OGpamoFVy38MVBnE+IbbVYUew+OrCXaRkfj"
crossorigin="anonymous"></script>
<script src="https://cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js"
integrity="sha384-9/reFTGAW83EW2RDu2S0VKaIzap3H66lZH81PoYlFhbGU+6BZp6G7niu735Sk7lN"
crossorigin="anonymous"></script>
<script src="https://cdn.jsdelivr.net/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js"
integrity="sha384-+YQ4JLhjyBLPDQt//I+STsc9iw4uQqACwlvpslubQzn4u2UU2UFM80nGisd026JF"
crossorigin="anonymous"></script>
<script defer src="scripts/velpay-front-calculator.js"></script>
<scri
Open service 13.33.187.91:443 · velpay.mx
2026-01-01 23:27
HTTP/1.1 403 Forbidden Server: CloudFront Date: Thu, 01 Jan 2026 23:27:15 GMT Content-Type: text/html Content-Length: 919 Connection: close X-Cache: Error from cloudfront Via: 1.1 ccd3e547bd5d86bbfbaca15b4307ce70.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P9 X-Amz-Cf-Id: CEkmLERDGfB-wdWKC45BqQtkn3e-wbCeq5AkHqc1QrtG-8HqkLNWIQ== Page title: ERROR: The request could not be satisfied <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <TITLE>ERROR: The request could not be satisfied</TITLE> </HEAD><BODY> <H1>403 ERROR</H1> <H2>The request could not be satisfied.</H2> <HR noshade size="1px"> Request blocked. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner. <BR clear="all"> If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation. <BR clear="all"> <HR noshade size="1px"> <PRE> Generated by cloudfront (CloudFront) Request ID: CEkmLERDGfB-wdWKC45BqQtkn3e-wbCeq5AkHqc1QrtG-8HqkLNWIQ== </PRE> <ADDRESS> </ADDRESS> </BODY></HTML>
Open service 13.33.187.91:443 · velpay.mx
2025-12-30 07:04
HTTP/1.1 403 Forbidden Server: CloudFront Date: Tue, 30 Dec 2025 07:04:05 GMT Content-Type: text/html Content-Length: 919 Connection: close X-Cache: Error from cloudfront Via: 1.1 de142d0ad142b3c0e86791d0b145349a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P9 X-Amz-Cf-Id: hgps2gB7fcV6kUUB8DY2zCDkidHhxBJB2t61sq88RlqUchsuXsZ-hA== Page title: ERROR: The request could not be satisfied <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <TITLE>ERROR: The request could not be satisfied</TITLE> </HEAD><BODY> <H1>403 ERROR</H1> <H2>The request could not be satisfied.</H2> <HR noshade size="1px"> Request blocked. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner. <BR clear="all"> If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation. <BR clear="all"> <HR noshade size="1px"> <PRE> Generated by cloudfront (CloudFront) Request ID: hgps2gB7fcV6kUUB8DY2zCDkidHhxBJB2t61sq88RlqUchsuXsZ-hA== </PRE> <ADDRESS> </ADDRESS> </BODY></HTML>
Open service 13.33.187.91:443 · velpay.mx
2025-12-22 11:44
HTTP/1.1 403 Forbidden Server: CloudFront Date: Mon, 22 Dec 2025 11:44:17 GMT Content-Type: text/html Content-Length: 919 Connection: close X-Cache: Error from cloudfront Via: 1.1 2ad26f5878b778b17955978bf962dc9a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P9 X-Amz-Cf-Id: 9RCagSETaA1G5d3qHQE2mV6wcafb8LZqE_-d4EInM_nPsNbTbyZpew== Page title: ERROR: The request could not be satisfied <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <TITLE>ERROR: The request could not be satisfied</TITLE> </HEAD><BODY> <H1>403 ERROR</H1> <H2>The request could not be satisfied.</H2> <HR noshade size="1px"> Request blocked. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner. <BR clear="all"> If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation. <BR clear="all"> <HR noshade size="1px"> <PRE> Generated by cloudfront (CloudFront) Request ID: 9RCagSETaA1G5d3qHQE2mV6wcafb8LZqE_-d4EInM_nPsNbTbyZpew== </PRE> <ADDRESS> </ADDRESS> </BODY></HTML>
Open service 13.33.187.91:443 · velpay.mx
2025-12-20 12:14
HTTP/1.1 403 Forbidden Server: CloudFront Date: Sat, 20 Dec 2025 12:14:53 GMT Content-Type: text/html Content-Length: 919 Connection: close X-Cache: Error from cloudfront Via: 1.1 3677df2c828d68a6a84555cd8a40cf50.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P9 X-Amz-Cf-Id: ho-WpaLMRj_CQrMI1SL8zk5n5LNAmIUDtA6fHzUYS2OPbbJwUw8fHw== Page title: ERROR: The request could not be satisfied <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <TITLE>ERROR: The request could not be satisfied</TITLE> </HEAD><BODY> <H1>403 ERROR</H1> <H2>The request could not be satisfied.</H2> <HR noshade size="1px"> Request blocked. We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner. <BR clear="all"> If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation. <BR clear="all"> <HR noshade size="1px"> <PRE> Generated by cloudfront (CloudFront) Request ID: ho-WpaLMRj_CQrMI1SL8zk5n5LNAmIUDtA6fHzUYS2OPbbJwUw8fHw== </PRE> <ADDRESS> </ADDRESS> </BODY></HTML>