LeakIX - Host vtcenerji.com

Domain vtcenerji.com

Germany

Hetzner Online GmbH

Software information

ZGS

tcp/443 tcp/80

cloudflare

tcp/443 tcp/80 tcp/8443

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 95.216.93.80
Domain: api.vgen.test.vtcenerji.com
Port: 443
URL: https://api.vgen.test.vtcenerji.com

First seen 2025-11-08 13:25
Last seen 2026-01-16 15:50
Open for 69 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-01-16 15:50
Create report

Open service 167.172.176.66:443 · api.vsensor.vtcenerji.com

2026-02-09 21:12

HTTP/1.1 200 OK
Content-Language: en
Content-Security-Policy: frame-ancestors 'none'
Date: Mon, 09 Feb 2026 21:12:55 GMT
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Xss-Protection: 1; mode=block
Connection: close
Transfer-Encoding: chunked


V-Gen API Gateway

Found 2026-02-09 by HttpPlugin

Create report

Open service 135.181.12.141:80 · consul.vgen-test-contour-hz02.host.vtcenerji.com

2026-01-31 14:53

HTTP/1.1 404 Not Found
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Sat, 31 Jan 2026 14:54:16 GMT
Content-Length: 19
Connection: close


404 page not found

Found 2026-01-31 by HttpPlugin

Create report

Open service 91.99.255.9:80 · spectrade.vgen.test.vtcenerji.com

2026-01-31 00:19

HTTP/1.1 404 Not Found
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Sat, 31 Jan 2026 00:20:28 GMT
Content-Length: 19
Connection: close


404 page not found

Found 2026-01-31 by HttpPlugin

Create report

Open service 91.99.255.9:443 · spectrade.vgen.test.vtcenerji.com

2026-01-31 00:19

HTTP/1.1 302 Found
Content-Length: 101
Content-Type: text/html
Date: Sat, 31 Jan 2026 00:20:28 GMT
Location: /api/auth/login
Vary: Accept-Encoding
Connection: close


<!DOCTYPE html><html><head><meta http-equiv="refresh" content="0; url=/api/auth/login"></head></html>

Found 2026-01-31 by HttpPlugin

Create report

Open service 91.99.255.3:443 · admin.vsensor.demo.vgen.vtcenerji.com

2026-01-26 14:38

HTTP/1.1 502 Bad Gateway
Date: Mon, 26 Jan 2026 14:38:31 GMT
Content-Length: 11
Content-Type: text/plain; charset=utf-8
Connection: close


Bad Gateway

Found 2026-01-26 by HttpPlugin

Create report

Open service 91.99.255.3:80 · admin.vsensor.demo.vgen.vtcenerji.com

2026-01-26 14:38

HTTP/1.1 404 Not Found
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Mon, 26 Jan 2026 14:38:30 GMT
Content-Length: 19
Connection: close


404 page not found

Found 2026-01-26 by HttpPlugin

Create report

Open service 91.99.255.3:443 · rabbitmq.vgen-demo-hz04.host.vtcenerji.com

2026-01-26 13:59

HTTP/1.1 403 Forbidden
Date: Mon, 26 Jan 2026 13:59:45 GMT
Content-Length: 9
Content-Type: text/plain; charset=utf-8
Connection: close


Forbidden

Found 2026-01-26 by HttpPlugin

Create report

Open service 91.99.255.3:80 · rabbitmq.vgen-demo-hz04.host.vtcenerji.com

2026-01-26 13:59

HTTP/1.1 404 Not Found
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Mon, 26 Jan 2026 13:59:45 GMT
Content-Length: 19
Connection: close


404 page not found

Found 2026-01-26 by HttpPlugin

Create report

Open service 91.99.255.3:80 · api.demo.vgen.vtcenerji.com

2026-01-26 13:44

HTTP/1.1 404 Not Found
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Mon, 26 Jan 2026 13:44:32 GMT
Content-Length: 19
Connection: close


404 page not found

Found 2026-01-26 by HttpPlugin

Create report

Open service 91.99.255.3:443 · api.demo.vgen.vtcenerji.com

2026-01-26 13:44

HTTP/1.1 404 Not Found
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Mon, 26 Jan 2026 13:44:32 GMT
Content-Length: 19
Connection: close


404 page not found

Found 2026-01-26 by HttpPlugin

Create report

Open service 91.99.255.3:443 · demo.vgen.vtcenerji.com

2026-01-26 13:43

HTTP/1.1 302 Found
Content-Length: 101
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' data: https://fonts.gstatic.com https://*.s81c.com; img-src 'self' data: https:; connect-src 'self' https://*.vtcenerji.com wss://*.vtcenerji.com https://*.epias.com.tr wss://*.epias.com.tr https://*.auth0.com https://*.eu.auth0.com https://www.google-analytics.com https://ipapi.co; frame-src 'self' blob: https://*.vtcenerji.com https://app.powerbi.com; frame-ancestors 'self'; base-uri 'self'; form-action 'self'
Content-Type: text/html
Date: Mon, 26 Jan 2026 13:44:23 GMT
Location: /api/auth/login
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
Connection: close


<!DOCTYPE html><html><head><meta http-equiv="refresh" content="0; url=/api/auth/login"></head></html>

Found 2026-01-26 by HttpPlugin

Create report

Open service 91.99.255.3:80 · demo.vgen.vtcenerji.com

2026-01-26 13:43

HTTP/1.1 404 Not Found
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Mon, 26 Jan 2026 13:44:23 GMT
Content-Length: 19
Connection: close


404 page not found

Found 2026-01-26 by HttpPlugin

Create report

Open service 136.143.189.127:443 · v-finance.vtcenerji.com

2026-01-24 05:03

HTTP/1.1 200 
Server: ZGS
Date: Sat, 24 Jan 2026 05:04:01 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 7088
Connection: close
Set-Cookie: zalb_c3a98dd0f1=c33688703ec62d4a96f063a7fcbbf6ca; Path=/; Secure; HttpOnly
X-Content-Type-Options: nosniff
Content-Security-Policy-Report-Only: script-src          'self'          'report-sample'          'unsafe-inline'          'unsafe-eval'               https://*.zohocdn.com          https://static.zohocdn.com.cn       https://*.zohostatic.com          https://*.zohowebstatic.com          https://*.zoho.com          https://salesiq.zoho.com          https://cdn.pagesense.io;         report-uri https://logsapi.zoho.com/csplog?service=creator;
Set-Cookie: zccpn=ad62b077-07cc-48f4-95a7-fca31a4f5f64;path=/;SameSite=None;Secure;priority=high
Set-Cookie: _zcsr_tmp=ad62b077-07cc-48f4-95a7-fca31a4f5f64;path=/;SameSite=Strict;Secure;priority=high
Cache-Control: private,no-cache,no-store,max-age=0,must-revalidate
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
X-Frame-Options: SAMEORIGIN
Vary: sec-fetch-dest,sec-fetch-mode,sec-fetch-site,sec-fetch-user,accept-encoding
Set-Cookie: JSESSIONID=A33429796AF8A852FF5ECB7760FF7EC7; Path=/; Secure; HttpOnly
Set-Cookie: cli_rgn=US; Max-Age=21600; Expires=Sat, 24 Jan 2026 11:04:01 GMT; Path=/; Secure; HttpOnly
Content-Language: en-US
Strict-Transport-Security: max-age=64072000; includeSubDomains; preload

Page title: V-Finance Customer Login

<!-- $Id$ -->

<!DOCTYPE html> <html><head><meta charset="UTF-8" /><meta name="robots" content="noindex">
<meta name="viewport" content="width=device-width, initial-scale=1.0"/><title>V-Finance Customer Login</title>
<link href='https&#x3a;&#x2f;&#x2f;creator.zoho.com&#x2f;userhome&#x2f;713706050&#x2f;setup&#x2f;companydetails&#x2f;downloadLogo&#x3f;filepath&#x3d;&#x2f;1617020909319_upload_9f08c6ba_3031_46ec_ab18_79dc29463d9f_00000002.tmp' rel="SHORTCUT ICON"> 
<link rel="stylesheet" type="text/css" href="https://static.zohocdn.com/creator/app/css/newDefaultPortalCss.297b24ff9ef9514700cb36869e43b968.css"/>
<script type="text/javascript" src="https://static.zohocdn.com/creator/zcs1/js/jquery.586ebc8153c2550ef27f2ce2eb58b9c7.js"></script>
<link rel="stylesheet" type="text/css" href="https://static.zohocdn.com/creator/zcs1/css/font-latonew.9eed39f534c23948c9af56aee271f0a5.css"/>
<script type="text/javascript" src="https://static.zohocdn.com/creator/zcs1/js/tp-xregexp.4e97aa1b9e2629f25170377706314afb.js"></script>
<link rel="stylesheet" type="text/css" href="https://static.zohocdn.com/creator/zcs1/css/jquery-intlTelInput.85726f72bbc1a9669ebaef42dc4fe457.css"/>
<script type="text/javascript" src="https://static.zohocdn.com/creator/zcs1/js/jquery-intlTelInput.a44cbd73630f1b14b8e061f2f7fdadec.js"></script>
<script type="text/javascript" src="https://static.zohocdn.com/creator/zcs1/js/jquery-intlTelInput-utils.83591d7ec466481e50cf5e37208fe6f1.js"></script>
<script nonce="dyRN35+liyAO50vtPygLug==">var d=document, s=d.createElement("div");s.id="zquartztracker";
s.setAttribute("data-zqSettings",'{"consoleLogLevel":"All","sensitiveHeaders":"","sensitiveParams":""}');
t=d.getElementsByTagName("script")[0]; t.parentNode.insertBefore(s,t);</script><script src="https://static.zohocdn.com/quartz/feedback/v2/zquartz-tracker.js" defer crossorigin="anonymous"></script>
<script type="text/javascript" src='https://static.zohocdn.com/creator/app/js/portalLivePage.b8da99cfb223f3645e5a58dacc6205f4.js'></script><script nonce="dyRN35+liyAO50vtPygLug==">var isEmailAllowed = true;
var isMobileNumberAllowed = false;
var isSignupPage = false;
var signupPortalType = 1;
var countryCode = 'US';
if(typeof ZCGlobal != 'undefined' && ZCGlobal.isPortal)
{
location.reload();
}
$(document).ready(function(){
var currentCountryCode = 'US';
if(isSignupPage) {
var loginIdField = $("#Email");
portalLivePage.setupSignupForm(loginIdField, isEmailAllowed, isMobileNumberAllowed,currentCountryCode);
}

portalLivePage.setIframeSrc('v\x2Dfinance\x2Dcustomer');

var errMsg = '';
if(errMsg != '')
{
portalLivePage.showErrorMsg(errMsg);
}
if(false) {
if ('serviceWorker' in navigator) {
navigator.serviceWorker.register("/serviceworker", {'scope':'../../'}).then(function(registration) {  //No I18N
console.log('ServiceWorker registration successful with scope: ', registration.scope);
}, function(err) {
console.log('ServiceWorker registration failed: ', err);
});
}
window.addEventListener('offline', function(){
if(!navigator.onLine)
{
window.location.href = "/";
}
});
window.addEventListener('beforeinstallprompt', function(event) {
console.log('beforeinstallprompt');
});
}
$("#signupBtn").click(function(){
return portalLivePage.submitSignUpForm('713706050', false, false, 'v-finance-customer', isEmailAllowed, isMobileNumberAllowed, '/');
});
$("#zcPortalCaptchaReload").click(function(){
$('#reloadCaptcha').addClass('zc-captcha-icon-rotated');
portalLivePage.getNewCaptcha('713706050', 'v-finance-customer');
$('#reloadCaptcha').removeClass('zc-captcha-icon-rotated');
});
});
var i18n = {
'zc.settings.live.cp.captchaabove'		: 'Enter\x20the\x20text\x20you\x20see\x20in\x20the\x20image\x20above', 
'zc.cp.nameempty' 	: 'Name\x20can\x20not\x20be\x20empty.', 
'zc.cp.namemaxlen' 	: 'Name\x20must\x20be\x20less\x20than\x2050\x20characters.', 
'zc.cp.emailmaxlen' : 'Email\x20must\x20be\x20less\x20than\x2050\x20characters.', 
'zc.cp.invalidemail': 'Please\x20enter\x20the\x20valid\x20email\x20address.', 
'zc.cp.new.validnumber': 'Please\x20enter\x20a\x20valid\x20mobile\x20number', 
'zc.cp.captch

Found 2026-01-24 by HttpPlugin

Create report

Open service 136.143.189.127:80 · v-finance.vtcenerji.com

2026-01-24 05:03

HTTP/1.1 301 Moved Permanently
Server: ZGS
Date: Sat, 24 Jan 2026 05:04:01 GMT
Content-Type: text/html
Content-Length: 134
Connection: close
Location: https://v-finance.vtcenerji.com/

Page title: 301 Moved Permanently

<html>
<head><title>301 Moved Permanently</title></head>
<body>
<center><h1>301 Moved Permanently</h1></center>
</body>
</html>

Found 2026-01-24 by HttpPlugin