LeakIX - Host 104.26.9.90

Host 104.26.9.90

United States

CLOUDFLARENET

Software information

cloudflare

tcp/443 tcp/80 tcp/8443

Git configuration and history exposed

The following URL (usually /.git/config) is publicly accessible and is leaking source code and repository configuration.

IP: 172.105.240.245
Domain: shuigouchao.com
Port: 443
URL: https://shuigouchao.com

First seen 2024-03-19 03:25
Last seen 2026-01-15 21:35
Open for 667 days

Severity: medium
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a652220cc57af

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[submodule]
	active = .
	alternatelocation = superproject
	alternateerrorstrategy = die
[remote "origin"]
	url = git@gitlab.mukicorp.com:muki/101_Shuigouchao.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "formal"]
	remote = origin
	merge = refs/heads/formal

Found on 2026-01-15 21:35

361 Bytes

Severity: medium
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a6522e517fd9e

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[submodule]
	active = .
	alternatelocation = superproject
	alternateerrorstrategy = die
[remote "origin"]
	url = git@gitlab.mukicorp.com:muki/shuigouchao.muki.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "formal"]
	remote = origin
	merge = refs/heads/formal

Found on 2025-06-26 10:33

362 Bytes

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 104.26.9.90
Domain: wshomologa.mapzer.com.br
Port: 443
URL: https://wshomologa.mapzer.com.br

First seen 2025-12-05 15:19
Last seen 2026-01-10 01:15
Open for 35 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549b6ef87c6007765a00aa722cae61304f1671cecea

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /AppVersioning/find/{version}
GET /Client
GET /Client/map/{clientId}
GET /Email/instant
GET /Email/routine
GET /Fale156/GetDepartmentTypes
GET /Fale156/GetServiceOrder
GET /Fale156/GetTypeClasses
GET /Fale156/getClientDepartments
GET /Fale156/getClients
GET /MapInBag/pendingUpload
GET /Occurrence/clearcache
GET /Occurrence/fetchPendingPostProcessing/{limit}
GET /Occurrence/pending
GET /OccurrenceClassType
GET /OccurrenceClassType/default
GET /Route/getUrl
GET /Route/latest/{clientId}
GET /Route/liveRoutes/{mapId}/{afterTime}
GET /v2/Image/get
POST /Auth/login
POST /Counter/create
POST /Email/notification
POST /Fale156/CreateServiceOrder
POST /Fale156/login
POST /MapInBag/create
POST /MapInBag/republish
POST /MapInBag/upload
POST /Occurrence/create
POST /Occurrence/notifyDeleted
POST /Occurrence/updatePostProcessed
POST /Occurrence/uploadfile
POST /Route/create/{clientId}
POST /api/Kilometragem/atualizar-km
POST /v2/Auth/login
POST /v2/PreMapImage/create
POST /v2/PreMapImage/reprocessar
POST /v2/PreMapImage/simular

Found on 2026-01-10 01:15

Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549b6ef87c6007765a00aa722cae61304f19944403e

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /AppVersioning/find/{version}
GET /Client
GET /Client/map/{clientId}
GET /Email/instant
GET /Email/routine
GET /Fale156/GetDepartmentTypes
GET /Fale156/GetServiceOrder
GET /Fale156/GetTypeClasses
GET /Fale156/getClientDepartments
GET /Fale156/getClients
GET /MapInBag/pendingUpload
GET /Occurrence/clearcache
GET /Occurrence/fetchPendingPostProcessing/{limit}
GET /Occurrence/pending
GET /OccurrenceClassType
GET /OccurrenceClassType/default
GET /Route/getUrl
GET /Route/latest/{clientId}
GET /Route/liveRoutes/{mapId}/{afterTime}
GET /v2/Image/get
POST /Auth/login
POST /Counter/create
POST /Email/notification
POST /Fale156/CreateServiceOrder
POST /Fale156/login
POST /MapInBag/create
POST /MapInBag/republish
POST /MapInBag/upload
POST /Occurrence/create
POST /Occurrence/notifyDeleted
POST /Occurrence/updatePostProcessed
POST /Occurrence/uploadfile
POST /Route/create/{clientId}
POST /v2/Auth/login
POST /v2/PreMapImage/create
POST /v2/PreMapImage/reprocessar
POST /v2/PreMapImage/simular

Found on 2026-01-02 18:17

Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549b6ef87c6007765a00aa722cae61304f155f163bb

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /AppVersioning/find/{version}
GET /Client
GET /Client/map/{clientId}
GET /Email/instant
GET /Email/routine
GET /Fale156/GetDepartmentTypes
GET /Fale156/GetServiceOrder
GET /Fale156/GetTypeClasses
GET /Fale156/getClientDepartments
GET /Fale156/getClients
GET /Occurrence/clearcache
GET /Occurrence/fetchPendingPostProcessing/{limit}
GET /Occurrence/pending
GET /OccurrenceClassType
GET /OccurrenceClassType/default
GET /Route/getUrl
GET /Route/latest/{clientId}
GET /Route/liveRoutes/{mapId}/{afterTime}
GET /v2/Image/get
POST /Auth/login
POST /Counter/create
POST /Email/notification
POST /Fale156/CreateServiceOrder
POST /Fale156/login
POST /Occurrence/create
POST /Occurrence/notifyDeleted
POST /Occurrence/updatePostProcessed
POST /Occurrence/uploadfile
POST /Route/create/{clientId}
POST /v2/Auth/login
POST /v2/PreMapImage/create
POST /v2/PreMapImage/reprocessar
POST /v2/PreMapImage/simular

Found on 2025-12-05 15:19

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 104.26.9.90
Domain: api.ava.solutions
Port: 443
URL: https://api.ava.solutions

First seen 2025-10-22 09:26
Last seen 2026-01-09 11:10
Open for 79 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad035493bdfd21c0ba0c9bcc822d1187e80e334f8aeb0f5

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /DetailedLookup/AccessibleAssets
GET /DetailedLookup/AccessibleAssets/{routeName}
GET /DetailedLookup/AccountAssetGroups/{accountNameOrGuid}
GET /DetailedLookup/AssetClasses
GET /DetailedLookup/AssetTypes/{accountNameOrGuid}
GET /DetailedLookup/GeofenceMaterialTypes/{accountNameOrGuid}
GET /DetailedLookup/Geofences/{accountNameOrGuid}
GET /DetailedLookup/MaintenanceCategories/{accountNameOrGuid}
GET /DetailedLookup/MaterialTypes/{accountNameOrGuid}
GET /DetailedLookup/MineAreas/{accountNameOrGuid}
GET /Lookup/AccessibleAccounts
GET /Lookup/AccessibleAssets
GET /Lookup/AccessibleAssets/{routeName}
GET /Lookup/AccessibleMineAreas
GET /Lookup/AccessibleMineAreas/{routeName}
GET /Lookup/AccountAssetGroups/{accountNameOrGuid}
GET /Lookup/AssetClasses
GET /Lookup/AssetTypes/{accountNameOrGuid}
GET /Lookup/DatasetsAndTheirLimits
GET /Lookup/FilterTypes
GET /Lookup/GeofenceMaterialTypes/{accountNameOrGuid}
GET /Lookup/MaterialTypes/{accountNameOrGuid}
GET /Lookup/ReportDateTimeParameterTypes
GET /Lookup/ShiftPlans/{accountNameOrGuid}
POST /Authentication
POST /api/AccountUserLastLogin
POST /api/AccountUserLoginHistory
POST /api/AggrOperationalEvents
POST /api/AggregatedOperationalTime
POST /api/AnalyzeRequest/{datasetName}
POST /api/AssetAllowedOperators
POST /api/AssetGeofence
POST /api/AssetReceivedFuelingEvent
POST /api/AssetTasks
POST /api/Assets
POST /api/BucketEvents
POST /api/CumulativeFuelUsage
POST /api/CumulativePayload
POST /api/CycleReview
POST /api/DailyShift
POST /api/DashCameraEvents
POST /api/DeliveryTask
POST /api/DeviceLastTelemetryTime
POST /api/DispatchInstructions
POST /api/EngineEvents
POST /api/EngineHours
POST /api/EngineOnEvents
POST /api/EngineOnHours
POST /api/EngineOnHoursByShift
POST /api/FinalProductTasks
POST /api/FuelLevelEvent
POST /api/FuelingEvent
POST /api/GateEntry
POST /api/GeofenceEngineHours
POST /api/GeofenceIgnitionHours
POST /api/HaulCycles
POST /api/HaulRoadAnalysis
POST /api/Idling
POST /api/Ignition
POST /api/IgnitionHours
POST /api/IgnitionHoursByShift
POST /api/LatencyHistogram
POST /api/LicensePlate
POST /api/LoadCell
POST /api/LoaderCycle
POST /api/LogisticsCycleReview
POST /api/Maintenance
POST /api/ManualHaulCycles
POST /api/MoveMaterialTasks
POST /api/Movement
POST /api/MultiShift
POST /api/Notifications
POST /api/OpenMaintenance
POST /api/OperationalDelayAnnotations
POST /api/OperationalDelays
POST /api/OperationalHaulDelays
POST /api/OperationalNonHaulDelays
POST /api/OperatorEvents
POST /api/OperatorInfo
POST /api/OperatorShift
POST /api/OpsDelay
POST /api/PendingCycles
POST /api/PersonnelTagsExpiring
POST /api/RawMaterialTasks
POST /api/ReconFueling
POST /api/ShiftEngineHours
POST /api/ShiftEngineOnEventHours
POST /api/ShiftInstanceTasks
POST /api/ShiftInstances
POST /api/Simulation
POST /api/SpatialCompliance
POST /api/Speeding
POST /api/TimeAndMotion
POST /api/VesselCycles
POST /api/WeighbridgeEvent

Found on 2026-01-09 11:10

Severity: info
Fingerprint: 5733ddf49ff49cd1aad035493bdfd21c0ba0c9bcc822d1187e80e3344229f947

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /DetailedLookup/AccessibleAssets
GET /DetailedLookup/AccessibleAssets/{routeName}
GET /DetailedLookup/AccountAssetGroups/{accountNameOrGuid}
GET /DetailedLookup/AssetClasses
GET /DetailedLookup/AssetTypes/{accountNameOrGuid}
GET /DetailedLookup/GeofenceMaterialTypes/{accountNameOrGuid}
GET /DetailedLookup/Geofences/{accountNameOrGuid}
GET /DetailedLookup/MaintenanceCategories/{accountNameOrGuid}
GET /DetailedLookup/MaterialTypes/{accountNameOrGuid}
GET /DetailedLookup/MineAreas/{accountNameOrGuid}
GET /Lookup/AccessibleAccounts
GET /Lookup/AccessibleAssets
GET /Lookup/AccessibleAssets/{routeName}
GET /Lookup/AccessibleMineAreas
GET /Lookup/AccessibleMineAreas/{routeName}
GET /Lookup/AccountAssetGroups/{accountNameOrGuid}
GET /Lookup/AssetClasses
GET /Lookup/AssetTypes/{accountNameOrGuid}
GET /Lookup/DatasetsAndTheirLimits
GET /Lookup/FilterTypes
GET /Lookup/GeofenceMaterialTypes/{accountNameOrGuid}
GET /Lookup/MaterialTypes/{accountNameOrGuid}
GET /Lookup/ReportDateTimeParameterTypes
GET /Lookup/ShiftPlans/{accountNameOrGuid}
POST /Authentication
POST /api/AccountUserLastLogin
POST /api/AccountUserLoginHistory
POST /api/AggrOperationalEvents
POST /api/AggregatedOperationalTime
POST /api/AnalyzeRequest/{datasetName}
POST /api/AssetGeofence
POST /api/AssetReceivedFuelingEvent
POST /api/AssetTasks
POST /api/Assets
POST /api/BucketEvents
POST /api/CumulativeFuelUsage
POST /api/CumulativePayload
POST /api/CycleReview
POST /api/DailyShift
POST /api/DashCameraEvents
POST /api/DeliveryTask
POST /api/DeviceLastTelemetryTime
POST /api/DispatchInstructions
POST /api/EngineEvents
POST /api/EngineHours
POST /api/EngineOnEvents
POST /api/EngineOnHours
POST /api/EngineOnHoursByShift
POST /api/FinalProductTasks
POST /api/FuelLevelEvent
POST /api/FuelingEvent
POST /api/GateEntry
POST /api/GeofenceEngineHours
POST /api/GeofenceIgnitionHours
POST /api/HaulCycles
POST /api/HaulRoadAnalysis
POST /api/Idling
POST /api/Ignition
POST /api/IgnitionHours
POST /api/IgnitionHoursByShift
POST /api/LatencyHistogram
POST /api/LicensePlate
POST /api/LoadCell
POST /api/LoaderCycle
POST /api/LogisticsCycleReview
POST /api/Maintenance
POST /api/ManualHaulCycles
POST /api/MoveMaterialTasks
POST /api/Movement
POST /api/MultiShift
POST /api/Notifications
POST /api/OpenMaintenance
POST /api/OperationalDelayAnnotations
POST /api/OperationalDelays
POST /api/OperationalHaulDelays
POST /api/OperationalNonHaulDelays
POST /api/OperatorEvents
POST /api/OperatorInfo
POST /api/OperatorShift
POST /api/OpsDelay
POST /api/PendingCycles
POST /api/RawMaterialTasks
POST /api/ReconFueling
POST /api/ShiftEngineHours
POST /api/ShiftEngineOnEventHours
POST /api/ShiftInstanceTasks
POST /api/ShiftInstances
POST /api/Simulation
POST /api/SpatialCompliance
POST /api/Speeding
POST /api/TimeAndMotion
POST /api/VesselCycles
POST /api/WeighbridgeEvent

Found on 2025-12-21 14:44

Severity: info
Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
Found on 2025-11-02 23:12

Severity: info
Fingerprint: 5733ddf49ff49cd1aad035493bdfd21c0ba0c9bcc822d1187e80e334dce1bf27

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /DetailedLookup/AccessibleAssets
GET /DetailedLookup/AccessibleAssets/{routeName}
GET /DetailedLookup/AccountAssetGroups/{accountNameOrGuid}
GET /DetailedLookup/AssetClasses
GET /DetailedLookup/AssetTypes/{accountNameOrGuid}
GET /DetailedLookup/GeofenceMaterialTypes/{accountNameOrGuid}
GET /DetailedLookup/Geofences/{accountNameOrGuid}
GET /DetailedLookup/MaintenanceCategories/{accountNameOrGuid}
GET /DetailedLookup/MaterialTypes/{accountNameOrGuid}
GET /DetailedLookup/MineAreas/{accountNameOrGuid}
GET /Lookup/AccessibleAccounts
GET /Lookup/AccessibleAssets
GET /Lookup/AccessibleAssets/{routeName}
GET /Lookup/AccessibleMineAreas
GET /Lookup/AccessibleMineAreas/{routeName}
GET /Lookup/AccountAssetGroups/{accountNameOrGuid}
GET /Lookup/AssetClasses
GET /Lookup/AssetTypes/{accountNameOrGuid}
GET /Lookup/DatasetsAndTheirLimits
GET /Lookup/FilterTypes
GET /Lookup/GeofenceMaterialTypes/{accountNameOrGuid}
GET /Lookup/MaterialTypes/{accountNameOrGuid}
GET /Lookup/ReportDateTimeParameterTypes
GET /Lookup/ShiftPlans/{accountNameOrGuid}
POST /Authentication
POST /api/AccountUserLastLogin
POST /api/AccountUserLoginHistory
POST /api/AggrOperationalEvents
POST /api/AggregatedOperationalTime
POST /api/AnalyzeRequest/{datasetName}
POST /api/AssetGeofence
POST /api/AssetReceivedFuelingEvent
POST /api/AssetTasks
POST /api/Assets
POST /api/BucketEvents
POST /api/CumulativeFuelUsage
POST /api/CumulativePayload
POST /api/CycleReview
POST /api/DailyShift
POST /api/DeliveryTask
POST /api/DeviceLastTelemetryTime
POST /api/DispatchInstructions
POST /api/EngineEvents
POST /api/EngineHours
POST /api/EngineOnEvents
POST /api/EngineOnHours
POST /api/EngineOnHoursByShift
POST /api/FinalProductTasks
POST /api/FuelLevelEvent
POST /api/FuelingEvent
POST /api/GateEntry
POST /api/GeofenceEngineHours
POST /api/GeofenceIgnitionHours
POST /api/HaulCycles
POST /api/HaulRoadAnalysis
POST /api/Idling
POST /api/Ignition
POST /api/IgnitionHours
POST /api/IgnitionHoursByShift
POST /api/LatencyHistogram
POST /api/LicensePlate
POST /api/LoadCell
POST /api/LoaderCycle
POST /api/LogisticsCycleReview
POST /api/Maintenance
POST /api/ManualHaulCycles
POST /api/MoveMaterialTasks
POST /api/Movement
POST /api/MultiShift
POST /api/Notifications
POST /api/OpenMaintenance
POST /api/OperationalDelayAnnotations
POST /api/OperationalDelays
POST /api/OperationalHaulDelays
POST /api/OperationalNonHaulDelays
POST /api/OperatorEvents
POST /api/OperatorInfo
POST /api/OperatorShift
POST /api/OpsDelay
POST /api/PendingCycles
POST /api/RawMaterialTasks
POST /api/ReconFueling
POST /api/ShiftEngineHours
POST /api/ShiftEngineOnEventHours
POST /api/ShiftInstanceTasks
POST /api/ShiftInstances
POST /api/Simulation
POST /api/SpatialCompliance
POST /api/Speeding
POST /api/TimeAndMotion
POST /api/VesselCycles
POST /api/WeighbridgeEvent

Found on 2025-10-28 10:32

Create report

Git configuration and history exposed

The following URL (usually /.git/config) is publicly accessible and is leaking source code and repository configuration.

IP: 104.26.9.90
Domain: uniscore.vn
Port: 443
URL: https://uniscore.vn

First seen 2025-11-21 09:22
Last seen 2026-01-03 00:22
Open for 42 days
- Severity: medium
  Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a6522f6bb6cca
```
[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[remote "origin"]
	url = https://gitlab.com/nolan20/uniscore-tracker.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "main"]
	remote = origin
	merge = refs/heads/main
```
  Found on 2026-01-03 00:22
  
  268 Bytes
Create report
GraphQL introspection is enabled.

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 104.26.9.90
Domain: gitlab.cheel.ch
Port: 443
URL: https://gitlab.cheel.ch

First seen 2025-11-21 23:15
Last seen 2026-01-02 20:13
Open for 41 days
- Severity: medium
  Fingerprint: c2db3a1c40d490db2337d3d603073f8703073f8703073f8703073f8703073f87
```
GraphQL introspection enabled at /api/graphql
Detected: GitLab
```
  Found on 2026-01-02 20:13
- Severity: medium
  Fingerprint: c2db3a1c40d490db2337d3d62337d3d62337d3d62337d3d62337d3d62337d3d6
```
GraphQL introspection enabled at /api/graphql
```
  Found on 2025-12-12 13:51
Create report

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 104.26.9.90
Domain: help.drupal-wiki.com
Port: 443
URL: https://help.drupal-wiki.com

First seen 2025-11-08 00:30
Last seen 2026-01-02 08:24
Open for 55 days

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa36fb841079b9d20b5673acd9c8e6353c204b7067f

GraphQL introspection enabled at /graphql
Types: 733 (by kind: ENUM: 77, INPUT_OBJECT: 218, INTERFACE: 1, OBJECT: 429, SCALAR: 8)
Operations:
- Query: Query | fields: featureFlag, featureFlags, features, space, spaces
- Mutation: Mutation | fields: attachmentDelete, attachmentUpdate, pageChangeOwner, pageMove, pageShare
Directives: deprecated, extends, external, include, key, oneOf, provides, requires, skip, specifiedBy (total: 12)

Found on 2026-01-02 08:24

424.1 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3334f4789bca865ab42ee187ad6b9dfefa917d6bc

GraphQL introspection enabled at /graphql
Types: 732 (by kind: ENUM: 76, INPUT_OBJECT: 218, INTERFACE: 1, OBJECT: 429, SCALAR: 8)
Operations:
- Query: Query | fields: featureFlag, featureFlags, features, space, spaces
- Mutation: Mutation | fields: attachmentDelete, attachmentUpdate, pageMove, pageShare, searchReIndex
Directives: deprecated, extends, external, include, key, oneOf, provides, requires, skip, specifiedBy (total: 12)

Found on 2025-11-29 05:50

420.5 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa30834182d5bee6c8f54dbbbae0794d37bc64b0870

GraphQL introspection enabled at /graphql
Types: 731 (by kind: ENUM: 76, INPUT_OBJECT: 217, INTERFACE: 1, OBJECT: 429, SCALAR: 8)
Operations:
- Query: Query | fields: featureFlag, featureFlags, features, space, spaces
- Mutation: Mutation | fields: attachmentDelete, attachmentUpdate, pageMove, pageShare, searchReIndex
Directives: deprecated, extends, external, include, key, oneOf, provides, requires, skip, specifiedBy (total: 12)

Found on 2025-11-12 04:17

420.3 kBytes

Create report

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 104.26.9.90
Domain: goedit.drupal-wiki.com
Port: 443
URL: https://goedit.drupal-wiki.com

First seen 2025-11-08 00:30
Last seen 2026-01-02 04:22
Open for 55 days

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa36fb841079b9d20b5673acd9c8e6353c204b7067f

GraphQL introspection enabled at /graphql
Types: 733 (by kind: ENUM: 77, INPUT_OBJECT: 218, INTERFACE: 1, OBJECT: 429, SCALAR: 8)
Operations:
- Query: Query | fields: featureFlag, featureFlags, features, space, spaces
- Mutation: Mutation | fields: attachmentDelete, attachmentUpdate, pageChangeOwner, pageMove, pageShare
Directives: deprecated, extends, external, include, key, oneOf, provides, requires, skip, specifiedBy (total: 12)

Found on 2026-01-02 04:22

424.1 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3334f4789bca865ab42ee187ad6b9dfefa917d6bc

GraphQL introspection enabled at /graphql
Types: 732 (by kind: ENUM: 76, INPUT_OBJECT: 218, INTERFACE: 1, OBJECT: 429, SCALAR: 8)
Operations:
- Query: Query | fields: featureFlag, featureFlags, features, space, spaces
- Mutation: Mutation | fields: attachmentDelete, attachmentUpdate, pageMove, pageShare, searchReIndex
Directives: deprecated, extends, external, include, key, oneOf, provides, requires, skip, specifiedBy (total: 12)

Found on 2025-11-28 03:32

420.5 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa30834182d5bee6c8f54dbbbae0794d37bc64b0870

GraphQL introspection enabled at /graphql
Types: 731 (by kind: ENUM: 76, INPUT_OBJECT: 217, INTERFACE: 1, OBJECT: 429, SCALAR: 8)
Operations:
- Query: Query | fields: featureFlag, featureFlags, features, space, spaces
- Mutation: Mutation | fields: attachmentDelete, attachmentUpdate, pageMove, pageShare, searchReIndex
Directives: deprecated, extends, external, include, key, oneOf, provides, requires, skip, specifiedBy (total: 12)

Found on 2025-11-12 04:17

420.3 kBytes

Create report

Git configuration and history exposed

The following URL (usually /.git/config) is publicly accessible and is leaking source code and repository configuration.

IP: 172.105.240.245
Domain: app.shuigouchao.com
Port: 443
URL: https://app.shuigouchao.com

First seen 2022-07-07 03:21
Last seen 2026-01-02 02:46
Open for 1274 days

Severity: medium
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a652220cc57af

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[submodule]
	active = .
	alternatelocation = superproject
	alternateerrorstrategy = die
[remote "origin"]
	url = git@gitlab.mukicorp.com:muki/101_Shuigouchao.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "formal"]
	remote = origin
	merge = refs/heads/formal

Found on 2026-01-02 02:46

361 Bytes

Severity: medium
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a6522e517fd9e

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[submodule]
	active = .
	alternatelocation = superproject
	alternateerrorstrategy = die
[remote "origin"]
	url = git@gitlab.mukicorp.com:muki/shuigouchao.muki.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "formal"]
	remote = origin
	merge = refs/heads/formal

Found on 2025-06-26 17:01

362 Bytes

Severity: medium
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a6522b040ecb6

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[submodule]
	active = .
[remote "origin"]
	url = git@gitlab.mukicorp.com:muki/shuigouchao.muki.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "formal"]
	remote = origin
	merge = refs/heads/formal

Found on 2023-11-01 11:53

298 Bytes

Create report

MacOS file listing through .DS_Store file

.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS).

They store information about the files within a folder, including display options of folders, such as icon positions and view settings.

It may happen that .DS_Store files inadvertently leak filenames such as database backups or private administration panels.

IP: 104.26.9.90
Domain: request-a-ride.com
Port: 443
URL: https://request-a-ride.com

First seen 2025-04-25 23:38
Last seen 2025-10-17 01:21
Open for 174 days
- Severity: low
  Fingerprint: 5f32cf5d6962f09c11d3744d11d3744d00a9f2f0acd41fb65986bc3ce34fe7af
```
Found 12 files trough .DS_Store spidering:

/data
/data/about-us-en.json
/data/app-icons
/data/app-images
/data/apps-data
/data/categories-data
/data/icons
/data/terms-en.json
/favicon.ico
/favicon.svg
/models
/robots.txt
```
  Found on 2025-10-17 01:21
Create report

Git configuration and history exposed

The following URL (usually /.git/config) is publicly accessible and is leaking source code and repository configuration.

IP: 104.26.9.90
Domain: legalsavingshub.com
Port: 80
URL: http://legalsavingshub.com

First seen 2023-08-30 08:36
Last seen 2024-05-12 21:10
Open for 256 days

Severity: high
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a65221d2231d6

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[remote "origin"]
	url = https://peter-cepsys@bitbucket.org/peter-cepsys/legalsavings.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "master"]
	remote = origin
	merge = refs/heads/master
[branch "live_changes_1004"]
	remote = origin
	merge = refs/heads/live_changes_1004
[branch "live_changes_231023"]
	remote = origin
	merge = refs/heads/live_changes_231023

Found on 2024-05-12 21:10

461 Bytes

Severity: high
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a6522ca6592b5

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[remote "origin"]
	url = https://peter-cepsys@bitbucket.org/peter-cepsys/legalsavings.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "master"]
	remote = origin
	merge = refs/heads/master
[branch "live_changes_1004"]
	remote = origin
	merge = refs/heads/live_changes_1004

Found on 2023-10-11 01:54

373 Bytes

Severity: high
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a652241db9c0c

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[remote "origin"]
	url = https://peter-cepsys@bitbucket.org/peter-cepsys/legalsavings.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "master"]
	remote = origin
	merge = refs/heads/master

Found on 2023-10-03 14:50

289 Bytes

Create report

Open service 104.26.9.90:8443 · koro.com.fj

2026-01-13 01:06

HTTP/1.1 521 <none>
Date: Tue, 13 Jan 2026 01:06:34 GMT
Content-Type: text/plain; charset=UTF-8
Content-Length: 15
Connection: close
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Referrer-Policy: same-origin
X-Frame-Options: SAMEORIGIN
Server: cloudflare
CF-RAY: 9bd0fde77a8cd9de-FRA


error code: 521

Found 3 days ago by HttpPlugin

Host 104.26.9.90

United States

Software information

Git configuration and history exposed

Swagger API description is publicly available

Swagger API description is publicly available

Git configuration and history exposed

GraphQL introspection is enabled.

GraphQL introspection is enabled.

GraphQL introspection is enabled.

Git configuration and history exposed

MacOS file listing through .DS_Store file

Git configuration and history exposed