GraphQL introspection is enabled.
This could leak to data leak if not properly configured.
Severity: medium
Fingerprint: c2db3a1c40d490dbf8cbe7e2ec9680bdfd55045f9908aead1e22f76a625de20b
GraphQL introspection enabled at /graphql/api Types: 507 (by kind: ENUM: 43, INPUT_OBJECT: 117, INTERFACE: 25, OBJECT: 317, SCALAR: 5) Operations: - Query: Query | fields: authnetcimHostedPaymentFormParams, authnetcimHostedProfileFormParams, availableStores, cart, categories - Mutation: Mutation | fields: addBundleProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addGiftRegistryRegistrants, addProductsToCart Directives: deprecated, include, oneOf, skip (total: 4) Detected: Magento
Severity: medium
Fingerprint: c2db3a1c40d490dbf8cbe7e2ec9680bdfd55045f9908aead1e22f76ad5d80774
GraphQL introspection enabled at /graphql/api Types: 507 (by kind: ENUM: 43, INPUT_OBJECT: 117, INTERFACE: 25, OBJECT: 317, SCALAR: 5) Operations: - Query: Query | fields: authnetcimHostedPaymentFormParams, authnetcimHostedProfileFormParams, availableStores, cart, categories - Mutation: Mutation | fields: addBundleProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addGiftRegistryRegistrants, addProductsToCart Directives: deprecated, include, oneOf, skip (total: 4)
Severity: medium
Fingerprint: c2db3a1c40d490dbf8cbe7e2f8cbe7e2f8cbe7e2f8cbe7e2f8cbe7e2f8cbe7e2
GraphQL introspection enabled at /graphql/api
Open service 151.101.1.91:443 · www.ringside.com
2026-01-09 22:52
HTTP/1.1 200 OK
Connection: close
Content-Length: 323837
Content-Type: text/html; charset=UTF-8
Pragma: cache
Expires: Sat, 10 Jan 2026 22:37:45 GMT
Report-To: {"group":"report-endpoint","max_age":10886400,"endpoints":[{"url":"https:\/\/12eae6a6-5979-48bd-9019-db3491c174d7.sansec.watch\/"}]}
treegateway.com c.paypal.com pay.google.com api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com *.paypal.com songbirdstag.cardinalcommerce.com *.googleapis.com *.addthis.com *.moatads.com *.addthisedge.com *.facebook.com *.pinterest.com *.hsforms.net *.hsforms.com *.gstatic.com https://www.googletagmanager.com tagmanager.google.com https://chimpstatic.com acsbap.com *.alicdn.com *.doubleclick.net *.googleadservices.com *.google-analytics.com *.googlesyndication.com *.googletagmanager.com *.paypalobjects.com *.ringside.com s3.amazonaws.com *.viralsweep.com 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; style-src *.adobe.com *.googleapis.com *.static.olark.com *.olark.com downloads.mailchimp.com unsafe-inline assets.braintreegateway.com *.gstatic.com tagmanager.google.com *.fontawesome.com *.googletagmanager.com *.mailchimp.com *.typekit.net 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; object-src 'self' 'unsafe-inline'; media-src *.adobe.com *.acsbapp.com *.static.olark.com https://*.olark.com *.olark.com *.bing.com *.google.com *.gstatic.com 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; manifest-src 'self' 'unsafe-inline'; connect-src dpm.demdex.net amcglobal.sc.omtrdc.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net vimeo.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com *.affirm.com *.affirm.ca https://checkout.iwdagency.com *.acsbapp.com consentcdn.cookiebot.com *.olark.com wss://*.noibu.com https://*.noibu.com https://*.doubleclick.net https://rum.browser-intake-us5-datadoghq.com session-replay.browser-intake-us5-datadoghq.com pagead2.googlesyndication.com *.kaptcha.com *.authorize.net api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com *.braintree-api.com *.paypal.com *.cardinalcommerce.com *.google.com google.com *.cloudflare.com *.googleapis.com *.addthis.com https://graph.instagram.com t.elasticsuite.io *.hsforms.net *.hsforms.com *.google-analytics.com https://www.google-analytics.com acsbap.com *.bing.com *.bing.net browser-intake-us5-datadoghq.com *.browser-intake-us5-datadoghq.com *.cookiebot.com *.doubleclick.net *.facebook.com *.googleadservices.com *.googlesyndication.com *.gstatic.com *.sentry.io *.wikipedia.org 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; child-src assets.braintreegateway.com c.paypal.com *.paypal.com http: https: blob: 'self' 'unsafe-inline'; default-src wss://*.noibu.com https://*.noibu.com *.googleapis.com 'self' 'unsafe-inline' 'unsafe-eval'; base-uri 'self' 'unsafe-inline'; report-uri https://12eae6a6-5979-48bd-9019-db3491c174d7.sansec.watch/; report-to report-endpoint;, upgrade-insecure-requests;
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
X-UA-Compatible: IE=edge
X-Frame-Options: SAMEORIGIN
X-Cache-Via: varnish
X-FRAME-OPTIONS: SAMEORIGIN
Accept-Ranges: bytes
Date: Fri, 09 Jan 2026 22:52:34 GMT
Age: 888
X-Served-By: cache-chi-kigq8000179-CHI, cache-lga21963-LGA
X-Cache: HIT, HIT
X-Cache-Hits: 13, 1
X-Timer: S1767999155.791660,VS0,VE5
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Vary: Accept-Encoding, Accept-Encoding,Cookie
Strict-Transport-Security: max-age=31557600
<!doctype html>
<html lang="en">
<head >
<script>
var LOCALE = 'en\u002DUS';
var BASE_URL = 'https\u003A\u002F\u002Fwww.ringside.com\u002F';
var require = {
'baseUrl': 'https\u003A\u002F\u002Fwww.ringside.com\u002Fstatic\u002Fversion1764080006\u002Ffrontend\u002FSmartwave\u002Fcombat_brands\u002Fen_US'
};</script> <meta charset="utf-8"/><script type="text/javascript">(window.NREUM||(NREUM
Open service 151.101.1.91:443 · www.ringside.com
2026-01-02 15:21
HTTP/1.1 200 OK
Connection: close
Content-Length: 324560
Content-Type: text/html; charset=UTF-8
Pragma: cache
Expires: Sat, 03 Jan 2026 15:07:49 GMT
Report-To: {"group":"report-endpoint","max_age":10886400,"endpoints":[{"url":"https:\/\/12eae6a6-5979-48bd-9019-db3491c174d7.sansec.watch\/"}]}
treegateway.com c.paypal.com pay.google.com api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com *.paypal.com songbirdstag.cardinalcommerce.com *.googleapis.com *.addthis.com *.moatads.com *.addthisedge.com *.facebook.com *.pinterest.com *.hsforms.net *.hsforms.com *.gstatic.com https://www.googletagmanager.com tagmanager.google.com https://chimpstatic.com acsbap.com *.alicdn.com *.doubleclick.net *.googleadservices.com *.google-analytics.com *.googlesyndication.com *.googletagmanager.com *.paypalobjects.com *.ringside.com s3.amazonaws.com *.viralsweep.com 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; style-src *.adobe.com *.googleapis.com *.static.olark.com *.olark.com downloads.mailchimp.com unsafe-inline assets.braintreegateway.com *.gstatic.com tagmanager.google.com *.fontawesome.com *.googletagmanager.com *.mailchimp.com *.typekit.net 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; object-src 'self' 'unsafe-inline'; media-src *.adobe.com *.acsbapp.com *.static.olark.com https://*.olark.com *.olark.com *.bing.com *.google.com *.gstatic.com 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; manifest-src 'self' 'unsafe-inline'; connect-src dpm.demdex.net amcglobal.sc.omtrdc.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net vimeo.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com *.affirm.com *.affirm.ca https://checkout.iwdagency.com *.acsbapp.com consentcdn.cookiebot.com *.olark.com wss://*.noibu.com https://*.noibu.com https://*.doubleclick.net https://rum.browser-intake-us5-datadoghq.com session-replay.browser-intake-us5-datadoghq.com pagead2.googlesyndication.com *.kaptcha.com *.authorize.net api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com *.braintree-api.com *.paypal.com *.cardinalcommerce.com *.google.com google.com *.cloudflare.com *.googleapis.com *.addthis.com https://graph.instagram.com t.elasticsuite.io *.hsforms.net *.hsforms.com *.google-analytics.com https://www.google-analytics.com acsbap.com *.bing.com *.bing.net browser-intake-us5-datadoghq.com *.browser-intake-us5-datadoghq.com *.cookiebot.com *.doubleclick.net *.facebook.com *.googleadservices.com *.googlesyndication.com *.gstatic.com *.sentry.io *.wikipedia.org 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; child-src assets.braintreegateway.com c.paypal.com *.paypal.com http: https: blob: 'self' 'unsafe-inline'; default-src wss://*.noibu.com https://*.noibu.com *.googleapis.com 'self' 'unsafe-inline' 'unsafe-eval'; base-uri 'self' 'unsafe-inline'; report-uri https://12eae6a6-5979-48bd-9019-db3491c174d7.sansec.watch/; report-to report-endpoint;, upgrade-insecure-requests;
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
X-UA-Compatible: IE=edge
X-Frame-Options: SAMEORIGIN
X-Cache-Via: varnish
X-FRAME-OPTIONS: SAMEORIGIN
Accept-Ranges: bytes
Date: Fri, 02 Jan 2026 15:21:49 GMT
Age: 839
X-Served-By: cache-chi-kigq8000179-CHI, cache-lga21937-LGA
X-Cache: HIT, HIT
X-Cache-Hits: 8, 1
X-Timer: S1767367310.529017,VS0,VE1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Vary: Accept-Encoding, Accept-Encoding,Cookie
Strict-Transport-Security: max-age=31557600
<!doctype html>
<html lang="en">
<head >
<script>
var LOCALE = 'en\u002DUS';
var BASE_URL = 'https\u003A\u002F\u002Fwww.ringside.com\u002F';
var require = {
'baseUrl': 'https\u003A\u002F\u002Fwww.ringside.com\u002Fstatic\u002Fversion1764080006\u002Ffrontend\u002FSmartwave\u002Fcombat_brands\u002Fen_US'
};</script> <meta charset="utf-8"/><script type="text/javascript">(window.NREUM||(NREUM=
Open service 151.101.1.91:443 · www.ringside.com
2025-12-23 03:06
HTTP/1.1 200 OK
Connection: close
Content-Length: 327914
Content-Type: text/html; charset=UTF-8
Pragma: cache
Expires: Tue, 23 Dec 2025 16:02:49 GMT
Report-To: {"group":"report-endpoint","max_age":10886400,"endpoints":[{"url":"https:\/\/12eae6a6-5979-48bd-9019-db3491c174d7.sansec.watch\/"}]}
treegateway.com c.paypal.com pay.google.com api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com *.paypal.com songbirdstag.cardinalcommerce.com *.googleapis.com *.addthis.com *.moatads.com *.addthisedge.com *.facebook.com *.pinterest.com *.hsforms.net *.hsforms.com *.gstatic.com https://www.googletagmanager.com tagmanager.google.com https://chimpstatic.com acsbap.com *.alicdn.com *.doubleclick.net *.googleadservices.com *.google-analytics.com *.googlesyndication.com *.googletagmanager.com *.paypalobjects.com *.ringside.com s3.amazonaws.com *.viralsweep.com 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; style-src *.adobe.com *.googleapis.com *.static.olark.com *.olark.com downloads.mailchimp.com unsafe-inline assets.braintreegateway.com *.gstatic.com tagmanager.google.com *.fontawesome.com *.googletagmanager.com *.mailchimp.com *.typekit.net 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; object-src 'self' 'unsafe-inline'; media-src *.adobe.com *.acsbapp.com *.static.olark.com https://*.olark.com *.olark.com *.bing.com *.google.com *.gstatic.com 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; manifest-src 'self' 'unsafe-inline'; connect-src dpm.demdex.net amcglobal.sc.omtrdc.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net vimeo.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com *.affirm.com *.affirm.ca https://checkout.iwdagency.com *.acsbapp.com consentcdn.cookiebot.com *.olark.com wss://*.noibu.com https://*.noibu.com https://*.doubleclick.net https://rum.browser-intake-us5-datadoghq.com session-replay.browser-intake-us5-datadoghq.com pagead2.googlesyndication.com *.kaptcha.com *.authorize.net api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com *.braintree-api.com *.paypal.com *.cardinalcommerce.com *.google.com google.com *.cloudflare.com *.googleapis.com *.addthis.com https://graph.instagram.com t.elasticsuite.io *.hsforms.net *.hsforms.com *.google-analytics.com https://www.google-analytics.com acsbap.com *.bing.com *.bing.net browser-intake-us5-datadoghq.com *.browser-intake-us5-datadoghq.com *.cookiebot.com *.doubleclick.net *.facebook.com *.googleadservices.com *.googlesyndication.com *.gstatic.com *.sentry.io *.wikipedia.org 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; child-src assets.braintreegateway.com c.paypal.com *.paypal.com http: https: blob: 'self' 'unsafe-inline'; default-src wss://*.noibu.com https://*.noibu.com *.googleapis.com 'self' 'unsafe-inline' 'unsafe-eval'; base-uri 'self' 'unsafe-inline'; report-uri https://12eae6a6-5979-48bd-9019-db3491c174d7.sansec.watch/; report-to report-endpoint;, upgrade-insecure-requests;
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
X-UA-Compatible: IE=edge
X-Frame-Options: SAMEORIGIN
X-Cache-Via: varnish
X-FRAME-OPTIONS: SAMEORIGIN
Accept-Ranges: bytes
Age: 39816
Date: Tue, 23 Dec 2025 03:06:26 GMT
X-Served-By: cache-chi-klot8100113-CHI, cache-pao-kpao1770048-PAO
X-Cache: HIT, HIT
X-Cache-Hits: 31, 0
X-Timer: S1766459186.213883,VS0,VE1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Vary: Accept-Encoding, Accept-Encoding,Cookie
Strict-Transport-Security: max-age=31557600
<!doctype html>
<html lang="en">
<head >
<script>
var LOCALE = 'en\u002DUS';
var BASE_URL = 'https\u003A\u002F\u002Fwww.ringside.com\u002F';
var require = {
'baseUrl': 'https\u003A\u002F\u002Fwww.ringside.com\u002Fstatic\u002Fversion1764080006\u002Ffrontend\u002FSmartwave\u002Fcombat_brands\u002Fen_US'
};</script> <meta charset="utf-8"/><script type="text/javascript">(window.NREU
Open service 151.101.1.91:443 · www.ringside.com
2025-12-20 17:50
HTTP/1.1 200 OK
Connection: close
Content-Length: 327877
Content-Type: text/html; charset=UTF-8
Pragma: cache
Expires: Sat, 20 Dec 2025 19:47:34 GMT
Report-To: {"group":"report-endpoint","max_age":10886400,"endpoints":[{"url":"https:\/\/12eae6a6-5979-48bd-9019-db3491c174d7.sansec.watch\/"}]}
treegateway.com c.paypal.com pay.google.com api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com *.paypal.com songbirdstag.cardinalcommerce.com *.googleapis.com *.addthis.com *.moatads.com *.addthisedge.com *.facebook.com *.pinterest.com *.hsforms.net *.hsforms.com *.gstatic.com https://www.googletagmanager.com tagmanager.google.com https://chimpstatic.com acsbap.com *.alicdn.com *.doubleclick.net *.googleadservices.com *.google-analytics.com *.googlesyndication.com *.googletagmanager.com *.paypalobjects.com *.ringside.com s3.amazonaws.com *.viralsweep.com 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; style-src *.adobe.com *.googleapis.com *.static.olark.com *.olark.com downloads.mailchimp.com unsafe-inline assets.braintreegateway.com *.gstatic.com tagmanager.google.com *.fontawesome.com *.googletagmanager.com *.mailchimp.com *.typekit.net 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; object-src 'self' 'unsafe-inline'; media-src *.adobe.com *.acsbapp.com *.static.olark.com https://*.olark.com *.olark.com *.bing.com *.google.com *.gstatic.com 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; manifest-src 'self' 'unsafe-inline'; connect-src dpm.demdex.net amcglobal.sc.omtrdc.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net vimeo.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com *.affirm.com *.affirm.ca https://checkout.iwdagency.com *.acsbapp.com consentcdn.cookiebot.com *.olark.com wss://*.noibu.com https://*.noibu.com https://*.doubleclick.net https://rum.browser-intake-us5-datadoghq.com session-replay.browser-intake-us5-datadoghq.com pagead2.googlesyndication.com *.kaptcha.com *.authorize.net api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com *.braintree-api.com *.paypal.com *.cardinalcommerce.com *.google.com google.com *.cloudflare.com *.googleapis.com *.addthis.com https://graph.instagram.com t.elasticsuite.io *.hsforms.net *.hsforms.com *.google-analytics.com https://www.google-analytics.com acsbap.com *.bing.com *.bing.net browser-intake-us5-datadoghq.com *.browser-intake-us5-datadoghq.com *.cookiebot.com *.doubleclick.net *.facebook.com *.googleadservices.com *.googlesyndication.com *.gstatic.com *.sentry.io *.wikipedia.org 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-hashes'; child-src assets.braintreegateway.com c.paypal.com *.paypal.com http: https: blob: 'self' 'unsafe-inline'; default-src wss://*.noibu.com https://*.noibu.com *.googleapis.com 'self' 'unsafe-inline' 'unsafe-eval'; base-uri 'self' 'unsafe-inline'; report-uri https://12eae6a6-5979-48bd-9019-db3491c174d7.sansec.watch/; report-to report-endpoint;, upgrade-insecure-requests;
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
X-UA-Compatible: IE=edge
X-Frame-Options: SAMEORIGIN
X-Cache-Via: varnish
X-FRAME-OPTIONS: SAMEORIGIN
Accept-Ranges: bytes
Age: 79372
Date: Sat, 20 Dec 2025 17:50:27 GMT
X-Served-By: cache-chi-klot8100113-CHI, cache-vie6380-VIE
X-Cache: HIT, HIT
X-Cache-Hits: 11, 0
X-Timer: S1766253028.691405,VS0,VE2
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Vary: Accept-Encoding, Accept-Encoding,Cookie
Strict-Transport-Security: max-age=31557600
<!doctype html>
<html lang="en">
<head >
<script>
var LOCALE = 'en\u002DUS';
var BASE_URL = 'https\u003A\u002F\u002Fwww.ringside.com\u002F';
var require = {
'baseUrl': 'https\u003A\u002F\u002Fwww.ringside.com\u002Fstatic\u002Fversion1764080006\u002Ffrontend\u002FSmartwave\u002Fcombat_brands\u002Fen_US'
};</script> <meta charset="utf-8"/><script type="text/javascript">(window.NREUM||(NREU