LeakIX - Host 138.199.24.219

Host 138.199.24.219

Singapore

Datacamp Limited

Software information

BunnyCDN-SG1-1272

tcp/443 tcp/80

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 138.199.24.219
Domain: api-crew.spolive.com
Port: 80
URL: http://api-crew.spolive.com

First seen 2025-10-15 07:12
Last seen 2026-01-11 09:02
Open for 88 days

Severity: info
Fingerprint: 5733ddf49ff49cd1a8bcc6e57e66e560407df7b7c241da3a5f7d6b1385fd22c7

Public Swagger UI/API detected at path: /webjars/swagger-ui/index.html - sample paths:
DELETE /api/admin/game/delete
DELETE /api/admin/post/del/{postId}
DELETE /api/admin/user/delete/{adminId}
GET /api/admin/game/inf/list
GET /api/admin/game/list
GET /api/admin/game/rate
GET /api/admin/game/view
GET /api/admin/inf/detail
GET /api/admin/inf/detail/exchange/{gameId}/{influencerId}
GET /api/admin/inf/detail/game/{influencerId}
GET /api/admin/inf/detail/saved/lk/list
GET /api/admin/inf/detail/sponsor/list
GET /api/admin/inf/list
GET /api/admin/inf/total
GET /api/admin/point/exchange/list
GET /api/admin/point/exchange/total
GET /api/admin/point/lk/list
GET /api/admin/point/lk/total
GET /api/admin/point/payment/detail
GET /api/admin/point/payment/list
GET /api/admin/point/payment/total
GET /api/admin/post/detail/{postId}
GET /api/admin/post/list
GET /api/admin/post/priority
GET /api/admin/sns/platform/list
GET /api/admin/user/company/list
GET /api/admin/user/dashboard
GET /api/admin/user/detail/{adminId}
GET /api/admin/user/duplicate
GET /api/admin/user/info
GET /api/admin/user/list
GET /api/client/game/contract/url/{gameId}
GET /api/client/game/detail
GET /api/client/game/list
GET /api/client/game/statistics
GET /api/client/inf/company/list
GET /api/client/inf/duplicate/inf_name/{infName}
GET /api/client/inf/duplicate/sponsor_code/{sponsorCode}
GET /api/client/inf/exchange/current/request/info
GET /api/client/inf/exchange/info/{gameId}
GET /api/client/inf/exchange/request/info
GET /api/client/inf/list
GET /api/client/inf/ranking
GET /api/client/inf/sponsor/statistics
GET /api/client/inf/subscriber/{snsPlatform}
GET /api/client/user/google/login
GET /api/client/user/info
GET /api/client/user/post/detail/{postId}
GET /api/client/user/post/list
GET /api/client/user/tmp/login
POST /api/admin/game/add/rate
POST /api/admin/game/create
POST /api/admin/point/collect/point
POST /api/admin/point/give/point
POST /api/admin/post/cre
POST /api/admin/user/create/company_info
POST /api/admin/user/login
POST /api/admin/user/sign_up
POST /api/client/game/join
POST /api/client/inf/contract/create
POST /api/client/inf/contract/status
POST /api/client/inf/create
POST /api/client/inf/create/exchange/info
POST /api/client/inf/create/exchange/request
POST /api/client/inf/create/platform
POST /api/client/inf/game/exist/inf
POST /api/client/inf/mobillians/auth
POST /api/signup/email
POST /api/upload
POST /api/upload/post/editor
PUT /api/admin/game/update
PUT /api/admin/game/update/inf
PUT /api/admin/inf/exchange_info/approval
PUT /api/admin/point/exchange/update
PUT /api/admin/point/refund/point
PUT /api/admin/post/upd
PUT /api/admin/sns/platform/update
PUT /api/admin/sns/platform/update/priority
PUT /api/admin/user/update
PUT /api/client/inf/update/exchange/info
PUT /api/client/inf/update/introduction
PUT /api/client/inf/update/profile/image
PUT /api/client/inf/update/sns/info

Found on 2026-01-11 09:02

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 138.199.24.219
Domain: api-crew.spolive.com
Port: 443
URL: https://api-crew.spolive.com

First seen 2025-10-15 07:12
Last seen 2026-01-11 09:02
Open for 88 days

Severity: info
Fingerprint: 5733ddf49ff49cd1a8bcc6e57e66e560407df7b7c241da3a5f7d6b1385fd22c7

Public Swagger UI/API detected at path: /webjars/swagger-ui/index.html - sample paths:
DELETE /api/admin/game/delete
DELETE /api/admin/post/del/{postId}
DELETE /api/admin/user/delete/{adminId}
GET /api/admin/game/inf/list
GET /api/admin/game/list
GET /api/admin/game/rate
GET /api/admin/game/view
GET /api/admin/inf/detail
GET /api/admin/inf/detail/exchange/{gameId}/{influencerId}
GET /api/admin/inf/detail/game/{influencerId}
GET /api/admin/inf/detail/saved/lk/list
GET /api/admin/inf/detail/sponsor/list
GET /api/admin/inf/list
GET /api/admin/inf/total
GET /api/admin/point/exchange/list
GET /api/admin/point/exchange/total
GET /api/admin/point/lk/list
GET /api/admin/point/lk/total
GET /api/admin/point/payment/detail
GET /api/admin/point/payment/list
GET /api/admin/point/payment/total
GET /api/admin/post/detail/{postId}
GET /api/admin/post/list
GET /api/admin/post/priority
GET /api/admin/sns/platform/list
GET /api/admin/user/company/list
GET /api/admin/user/dashboard
GET /api/admin/user/detail/{adminId}
GET /api/admin/user/duplicate
GET /api/admin/user/info
GET /api/admin/user/list
GET /api/client/game/contract/url/{gameId}
GET /api/client/game/detail
GET /api/client/game/list
GET /api/client/game/statistics
GET /api/client/inf/company/list
GET /api/client/inf/duplicate/inf_name/{infName}
GET /api/client/inf/duplicate/sponsor_code/{sponsorCode}
GET /api/client/inf/exchange/current/request/info
GET /api/client/inf/exchange/info/{gameId}
GET /api/client/inf/exchange/request/info
GET /api/client/inf/list
GET /api/client/inf/ranking
GET /api/client/inf/sponsor/statistics
GET /api/client/inf/subscriber/{snsPlatform}
GET /api/client/user/google/login
GET /api/client/user/info
GET /api/client/user/post/detail/{postId}
GET /api/client/user/post/list
GET /api/client/user/tmp/login
POST /api/admin/game/add/rate
POST /api/admin/game/create
POST /api/admin/point/collect/point
POST /api/admin/point/give/point
POST /api/admin/post/cre
POST /api/admin/user/create/company_info
POST /api/admin/user/login
POST /api/admin/user/sign_up
POST /api/client/game/join
POST /api/client/inf/contract/create
POST /api/client/inf/contract/status
POST /api/client/inf/create
POST /api/client/inf/create/exchange/info
POST /api/client/inf/create/exchange/request
POST /api/client/inf/create/platform
POST /api/client/inf/game/exist/inf
POST /api/client/inf/mobillians/auth
POST /api/signup/email
POST /api/upload
POST /api/upload/post/editor
PUT /api/admin/game/update
PUT /api/admin/game/update/inf
PUT /api/admin/inf/exchange_info/approval
PUT /api/admin/point/exchange/update
PUT /api/admin/point/refund/point
PUT /api/admin/post/upd
PUT /api/admin/sns/platform/update
PUT /api/admin/sns/platform/update/priority
PUT /api/admin/user/update
PUT /api/client/inf/update/exchange/info
PUT /api/client/inf/update/introduction
PUT /api/client/inf/update/profile/image
PUT /api/client/inf/update/sns/info

Found on 2026-01-11 09:02

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 138.199.24.219
Domain: mw-crew.spolive.com
Port: 443
URL: https://mw-crew.spolive.com

First seen 2025-10-15 07:11
Last seen 2026-01-11 09:02
Open for 88 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd151e75e4bd7913d96cbda11738cd162f32320145a2b221425
```
Public Swagger UI/API detected at path: /v3/api-docs - sample paths:
GET /
GET /influencer/{gameUid}/count
GET /influencer/{gameUid}/newinfo
GET /sponsor/{gameUid}/newinfo/{gameAccount}
POST /game/exist/inf
POST /influencer/updateGameAccount
POST /payment
POST /sponsor/start
POST /sponsor/stop
```
  Found on 2026-01-11 09:02
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 138.199.24.219
Domain: mw-crew.spolive.com
Port: 80
URL: http://mw-crew.spolive.com

First seen 2025-10-15 07:11
Last seen 2026-01-11 09:02
Open for 88 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd151e75e4bd7913d96cbda11738cd162f32320145a2b221425
```
Public Swagger UI/API detected at path: /v3/api-docs - sample paths:
GET /
GET /influencer/{gameUid}/count
GET /influencer/{gameUid}/newinfo
GET /sponsor/{gameUid}/newinfo/{gameAccount}
POST /game/exist/inf
POST /influencer/updateGameAccount
POST /payment
POST /sponsor/start
POST /sponsor/stop
```
  Found on 2026-01-11 09:02
Create report
SSH is potenitally vulnerable

WARNING: This plugin will generate false positive and is purely informative:

regreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems (CVE-2024-6387)

IP: 138.199.24.219
Port: 22

First seen 2025-04-12 04:36
Last seen 2026-01-08 13:23
Open for 271 days
- Severity: info
  Fingerprint: 3f43e0ebb5dce37ab8b59eb54bc890163f1caf2f3f1caf2f3f1caf2f3f1caf2f
```
Found potentially vulnerable SSH version:
SSH-2.0-OpenSSH_9.6p1
WARNING, RISK IS ESTIMATED FALSE POSITIVE ARE LIKELY
```
  Found on 2026-01-08 13:23
Create report

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 138.199.46.65
Domain: cdn-media.nxtby.com
Port: 443
URL: https://cdn-media.nxtby.com

First seen 2025-11-27 13:10
Last seen 2026-01-03 21:17
Open for 37 days

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3165045e309d6dc21814da33f1bd5825fbb6bb592

GraphQL introspection enabled at /graphql
Types: 484 (by kind: ENUM: 47, INPUT_OBJECT: 103, INTERFACE: 26, OBJECT: 303, SCALAR: 5)
Operations:
- Query: Query | fields: allCartRules, allCatalogRules, allCustomerGroups, attributesForm, attributesList
- Mutation: Mutation | fields: addBundleProductsToCart, addCommentToPost, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart
Directives: deprecated, include, oneOf, skip (total: 4)

Detected: Magento

Found on 2026-01-03 21:17

851.7 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490dbf8cbe7e21a3b713e889e52ee8a34406ebe87b7b4d6ba94e5

GraphQL introspection enabled at /graphql/api
Types: 484 (by kind: ENUM: 47, INPUT_OBJECT: 103, INTERFACE: 26, OBJECT: 303, SCALAR: 5)
Operations:
- Query: Query | fields: allCartRules, allCatalogRules, allCustomerGroups, attributesForm, attributesList
- Mutation: Mutation | fields: addBundleProductsToCart, addCommentToPost, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart
Directives: deprecated, include, oneOf, skip (total: 4)

Detected: Magento

Found on 2025-12-27 04:33

851.7 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490dbf8cbe7e21a3b713e889e52ee8a34406ebe87b7b46c9c2f56

GraphQL introspection enabled at /graphql/api
Types: 484 (by kind: ENUM: 47, INPUT_OBJECT: 103, INTERFACE: 26, OBJECT: 303, SCALAR: 5)
Operations:
- Query: Query | fields: allCartRules, allCatalogRules, allCustomerGroups, attributesForm, attributesList
- Mutation: Mutation | fields: addBundleProductsToCart, addCommentToPost, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart
Directives: deprecated, include, oneOf, skip (total: 4)

Found on 2025-12-12 14:36

851.7 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3165045e309d6dc21814da33f1bd5825f972c2987

GraphQL introspection enabled at /graphql
Types: 484 (by kind: ENUM: 47, INPUT_OBJECT: 103, INTERFACE: 26, OBJECT: 303, SCALAR: 5)
Operations:
- Query: Query | fields: allCartRules, allCatalogRules, allCustomerGroups, attributesForm, attributesList
- Mutation: Mutation | fields: addBundleProductsToCart, addCommentToPost, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart
Directives: deprecated, include, oneOf, skip (total: 4)

Found on 2025-12-08 06:35

851.7 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa31a0bbaa31a0bbaa31a0bbaa31a0bbaa31a0bbaa3
```
GraphQL introspection enabled at /graphql
```
Found on 2025-12-01 14:29

Create report

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 138.199.24.219
Domain: cdn-b-static.shopunicore.com
Port: 443
URL: https://cdn-b-static.shopunicore.com

First seen 2025-11-15 11:08
Last seen 2026-01-03 11:10
Open for 49 days

Severity: medium
Fingerprint: c2db3a1c40d490dbf8cbe7e2b5d31cb851acb75c5df62061be438ab97024b264

GraphQL introspection enabled at /graphql/api
Types: 459 (by kind: ENUM: 43, INPUT_OBJECT: 99, INTERFACE: 25, OBJECT: 287, SCALAR: 5)
Operations:
- Query: Query | fields: attributesForm, attributesList, availableStores, cart, categories
- Mutation: Mutation | fields: addBundleProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart, addProductsToCompareList
Directives: deprecated, include, oneOf, skip (total: 4)

Detected: Magento

Found on 2026-01-03 11:10

768.3 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa34f0e6bc387d64c418690f02ca72de632f4261123

GraphQL introspection enabled at /graphql
Types: 459 (by kind: ENUM: 43, INPUT_OBJECT: 99, INTERFACE: 25, OBJECT: 287, SCALAR: 5)
Operations:
- Query: Query | fields: attributesForm, attributesList, availableStores, cart, categories
- Mutation: Mutation | fields: addBundleProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart, addProductsToCompareList
Directives: deprecated, include, oneOf, skip (total: 4)

Detected: Magento

Found on 2026-01-03 00:04

768.3 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa374c2942e74c2942e74c2942e74c2942e74c2942e
```
GraphQL introspection enabled at /graphql
Detected: Magento
```
Found on 2025-12-19 06:58
Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa31a0bbaa31a0bbaa31a0bbaa31a0bbaa31a0bbaa3
```
GraphQL introspection enabled at /graphql
```
Found on 2025-12-01 07:47

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa34f0e6bc387d64c418690f02ca72de632b952311c

GraphQL introspection enabled at /graphql
Types: 459 (by kind: ENUM: 43, INPUT_OBJECT: 99, INTERFACE: 25, OBJECT: 287, SCALAR: 5)
Operations:
- Query: Query | fields: attributesForm, attributesList, availableStores, cart, categories
- Mutation: Mutation | fields: addBundleProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart, addProductsToCompareList
Directives: deprecated, include, oneOf, skip (total: 4)

Found on 2025-11-29 09:48

768.3 kBytes

Create report

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 138.199.24.219
Domain: cdn-b-static.shopunicore.com
Port: 80
URL: http://cdn-b-static.shopunicore.com

First seen 2025-11-15 11:08
Last seen 2026-01-03 11:10
Open for 49 days

Severity: medium
Fingerprint: c2db3a1c40d490dbf8cbe7e2b5d31cb851acb75c5df62061be438ab97024b264

GraphQL introspection enabled at /graphql/api
Types: 459 (by kind: ENUM: 43, INPUT_OBJECT: 99, INTERFACE: 25, OBJECT: 287, SCALAR: 5)
Operations:
- Query: Query | fields: attributesForm, attributesList, availableStores, cart, categories
- Mutation: Mutation | fields: addBundleProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart, addProductsToCompareList
Directives: deprecated, include, oneOf, skip (total: 4)

Detected: Magento

Found on 2026-01-03 11:10

768.3 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa34f0e6bc387d64c418690f02ca72de632f4261123

GraphQL introspection enabled at /graphql
Types: 459 (by kind: ENUM: 43, INPUT_OBJECT: 99, INTERFACE: 25, OBJECT: 287, SCALAR: 5)
Operations:
- Query: Query | fields: attributesForm, attributesList, availableStores, cart, categories
- Mutation: Mutation | fields: addBundleProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart, addProductsToCompareList
Directives: deprecated, include, oneOf, skip (total: 4)

Detected: Magento

Found on 2026-01-03 00:04

768.3 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa34f0e6bc387d64c418690f02ca72de632b952311c

GraphQL introspection enabled at /graphql
Types: 459 (by kind: ENUM: 43, INPUT_OBJECT: 99, INTERFACE: 25, OBJECT: 287, SCALAR: 5)
Operations:
- Query: Query | fields: attributesForm, attributesList, availableStores, cart, categories
- Mutation: Mutation | fields: addBundleProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart, addProductsToCompareList
Directives: deprecated, include, oneOf, skip (total: 4)

Found on 2025-12-01 07:47

768.3 kBytes

Create report

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 169.150.247.36
Domain: img.innovapharmacy.com
Port: 443
URL: https://img.innovapharmacy.com

First seen 2025-11-15 08:30
Last seen 2026-01-03 06:46
Open for 48 days

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa374c2942e74c2942e74c2942e74c2942e74c2942e
```
GraphQL introspection enabled at /graphql
Detected: Magento
```
Found on 2026-01-03 06:46

Severity: medium
Fingerprint: c2db3a1c40d490dbf8cbe7e2d8404bc32006ec4150cf405f43843ec7cd7954e2

GraphQL introspection enabled at /graphql/api
Types: 474 (by kind: ENUM: 47, INPUT_OBJECT: 99, INTERFACE: 26, OBJECT: 297, SCALAR: 5)
Operations:
- Query: Query | fields: allCartRules, allCatalogRules, allCustomerGroups, attributesForm, attributesList
- Mutation: Mutation | fields: addBundleProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart, addProductsToCompareList
Directives: deprecated, include, skip (total: 3)

Detected: Magento

Found on 2026-01-02 01:23

832.3 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa34c451accfa70aa904ead6ec032af0d6e0f9d7cdd

GraphQL introspection enabled at /graphql
Types: 474 (by kind: ENUM: 47, INPUT_OBJECT: 99, INTERFACE: 26, OBJECT: 297, SCALAR: 5)
Operations:
- Query: Query | fields: allCartRules, allCatalogRules, allCustomerGroups, attributesForm, attributesList
- Mutation: Mutation | fields: addBundleProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart, addProductsToCompareList
Directives: deprecated, include, skip (total: 3)

Detected: Magento

Found on 2025-12-26 22:03

832.3 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3bc1fa73b72deccb93cc3ed7701a2595f50a6d7da

GraphQL introspection enabled at /graphql
Types: 500 (by kind: ENUM: 48, INPUT_OBJECT: 116, INTERFACE: 26, OBJECT: 305, SCALAR: 5)
Operations:
- Query: Query | fields: allCartRules, allCatalogRules, allCustomerGroups, attributesForm, attributesList
- Mutation: Mutation | fields: addBundleProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart, addProductsToCompareList
Directives: deprecated, include, skip (total: 3)

Detected: Magento

Found on 2025-12-20 17:48

880.7 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490dbf8cbe7e27d035c62613dbc32c56dae4af3223cc0a2f123cf

GraphQL introspection enabled at /graphql/api
Types: 500 (by kind: ENUM: 48, INPUT_OBJECT: 116, INTERFACE: 26, OBJECT: 305, SCALAR: 5)
Operations:
- Query: Query | fields: allCartRules, allCatalogRules, allCustomerGroups, attributesForm, attributesList
- Mutation: Mutation | fields: addBundleProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart, addProductsToCompareList
Directives: deprecated, include, skip (total: 3)

Detected: Magento

Found on 2025-12-17 01:01

880.7 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490dbf8cbe7e2df9b2641df9b2641df9b2641df9b2641df9b2641
```
GraphQL introspection enabled at /graphql/api
Detected: Magento
```
Found on 2025-12-13 08:48

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3bc1fa73b72deccb93cc3ed7701a2595f2b19667f

GraphQL introspection enabled at /graphql
Types: 500 (by kind: ENUM: 48, INPUT_OBJECT: 116, INTERFACE: 26, OBJECT: 305, SCALAR: 5)
Operations:
- Query: Query | fields: allCartRules, allCatalogRules, allCustomerGroups, attributesForm, attributesList
- Mutation: Mutation | fields: addBundleProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart, addProductsToCompareList
Directives: deprecated, include, skip (total: 3)

Found on 2025-12-06 06:01

877.8 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490dbf8cbe7e2f8cbe7e2f8cbe7e2f8cbe7e2f8cbe7e2f8cbe7e2
```
GraphQL introspection enabled at /graphql/api
```
Found on 2025-11-30 21:05

Severity: medium
Fingerprint: c2db3a1c40d490dbf8cbe7e27d035c62613dbc32c56dae4af3223cc01eab4298

GraphQL introspection enabled at /graphql/api
Types: 500 (by kind: ENUM: 48, INPUT_OBJECT: 116, INTERFACE: 26, OBJECT: 305, SCALAR: 5)
Operations:
- Query: Query | fields: allCartRules, allCatalogRules, allCustomerGroups, attributesForm, attributesList
- Mutation: Mutation | fields: addBundleProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart, addProductsToCompareList
Directives: deprecated, include, skip (total: 3)

Found on 2025-11-23 03:50

881.1 kBytes

Create report

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 138.199.24.219
Domain: img-test.innovaksa.net
Port: 443
URL: https://img-test.innovaksa.net

First seen 2025-11-26 05:09
Last seen 2026-01-02 21:10
Open for 37 days

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3bc1fa73b72deccb93cc3ed7701a2595f50a6d7da

GraphQL introspection enabled at /graphql
Types: 500 (by kind: ENUM: 48, INPUT_OBJECT: 116, INTERFACE: 26, OBJECT: 305, SCALAR: 5)
Operations:
- Query: Query | fields: allCartRules, allCatalogRules, allCustomerGroups, attributesForm, attributesList
- Mutation: Mutation | fields: addBundleProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart, addProductsToCompareList
Directives: deprecated, include, skip (total: 3)

Detected: Magento

Found on 2026-01-02 21:10

880.7 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3bc1fa73b72deccb93cc3ed7701a2595f2b19667f

GraphQL introspection enabled at /graphql
Types: 500 (by kind: ENUM: 48, INPUT_OBJECT: 116, INTERFACE: 26, OBJECT: 305, SCALAR: 5)
Operations:
- Query: Query | fields: allCartRules, allCatalogRules, allCustomerGroups, attributesForm, attributesList
- Mutation: Mutation | fields: addBundleProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart, addProductsToCompareList
Directives: deprecated, include, skip (total: 3)

Found on 2025-12-10 19:23

880.7 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490dbf8cbe7e2f8cbe7e2f8cbe7e2f8cbe7e2f8cbe7e2f8cbe7e2
```
GraphQL introspection enabled at /graphql/api
```
Found on 2025-11-30 14:34

Severity: medium
Fingerprint: c2db3a1c40d490dbf8cbe7e27d035c62613dbc32c56dae4af3223cc01eab4298

GraphQL introspection enabled at /graphql/api
Types: 500 (by kind: ENUM: 48, INPUT_OBJECT: 116, INTERFACE: 26, OBJECT: 305, SCALAR: 5)
Operations:
- Query: Query | fields: allCartRules, allCatalogRules, allCustomerGroups, attributesForm, attributesList
- Mutation: Mutation | fields: addBundleProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart, addProductsToCompareList
Directives: deprecated, include, skip (total: 3)

Found on 2025-11-28 08:17

880.7 kBytes

Create report

Git configuration and history exposed

The following URL (usually /.git/config) is publicly accessible and is leaking source code and repository configuration.

IP: 138.199.24.219
Domain: www.horastub.com
Port: 443
URL: https://www.horastub.com

First seen 2025-06-30 02:01
Last seen 2026-01-02 16:44
Open for 186 days

Severity: high
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a6522363045cc

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[remote "origin"]
	url = https://adminapi2wl@github.com/adminapi2wl/wl2-user-app-prod.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "main"]
	remote = origin
	merge = refs/heads/main

Found on 2026-01-02 16:44

285 Bytes

Severity: high
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a652231918c30

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[remote "origin"]
	url = https://vishalmotehkb@github.com/vishalmotehkb/user-app.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "main"]
	remote = origin
	merge = refs/heads/main

Found on 2025-08-13 02:12

280 Bytes

Create report

Git configuration and history exposed

The following URL (usually /.git/config) is publicly accessible and is leaking source code and repository configuration.

IP: 138.199.24.219
Domain: www.horashoki04.com
Port: 443
URL: https://www.horashoki04.com

First seen 2025-05-07 12:03
Last seen 2026-01-02 08:25
Open for 239 days

Severity: high
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a6522363045cc

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[remote "origin"]
	url = https://adminapi2wl@github.com/adminapi2wl/wl2-user-app-prod.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "main"]
	remote = origin
	merge = refs/heads/main

Found on 2026-01-02 08:25

285 Bytes

Severity: high
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a652231918c30

[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[remote "origin"]
	url = https://vishalmotehkb@github.com/vishalmotehkb/user-app.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "main"]
	remote = origin
	merge = refs/heads/main

Found on 2025-08-12 22:22

280 Bytes

Create report

MacOS file listing through .DS_Store file

.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS).

They store information about the files within a folder, including display options of folders, such as icon positions and view settings.

It may happen that .DS_Store files inadvertently leak filenames such as database backups or private administration panels.

IP: 138.199.24.219
Domain: wvvw.17871939.com
Port: 443
URL: https://wvvw.17871939.com

First seen 2025-11-13 04:44
Last seen 2026-01-02 07:51
Open for 50 days

Severity: medium
Fingerprint: 5f32cf5d6962f09cd4047824d404782497fed55f1b31d50441d0246f6d373c95

Found 35 files trough .DS_Store spidering:

/Audio
/Audio/aduioHe.mp3
/Audio/aduioHeXD.mp3
/Audio/aduioHeZD.mp3
/Audio/aduioHeZXD.mp3
/Audio/aduioXian.mp3
/Audio/aduioXianXD.mp3
/Audio/aduioXianZD.mp3
/Audio/aduioXianZXD.mp3
/Audio/aduioZhuang.mp3
/Audio/aduioZhuangXD.mp3
/Audio/aduioZhuangZD.mp3
/Audio/aduioZhuangZXD.mp3
/Audio/click.mp3
/Audio/ding.mp3
/Audio/Last10miao.mp3
/Audio/start.mp3
/Audio/startsendcards.mp3
/Audio/Win.mp3
/DesktopImage
/DesktopImage/610.mp4
/dist
/dist/images
/dist/libffmpeg.js
/dist/libffmpeg.wasm
/dist/spriteJSON
/dist/ui
/dist/ui/Game
/dist/ui/Game/win_icons
/dist/ui/spritesheet
/dist/video
/dist/video/loading_screen.mp4
/dist/video.min.js
/Html
/socket.io

Found on 2026-01-02 07:51

Severity: medium
Fingerprint: 5f32cf5d6962f09c2acf29aa2acf29aabf0d8bf50fae7642f344d19d81337f4c

Found 33 files trough .DS_Store spidering:

/Audio
/Audio/aduioHe.mp3
/Audio/aduioHeXD.mp3
/Audio/aduioHeZD.mp3
/Audio/aduioHeZXD.mp3
/Audio/aduioXian.mp3
/Audio/aduioXianXD.mp3
/Audio/aduioXianZD.mp3
/Audio/aduioXianZXD.mp3
/Audio/aduioZhuang.mp3
/Audio/aduioZhuangXD.mp3
/Audio/aduioZhuangZD.mp3
/Audio/aduioZhuangZXD.mp3
/Audio/click.mp3
/Audio/ding.mp3
/Audio/Last10miao.mp3
/Audio/start.mp3
/Audio/startsendcards.mp3
/Audio/Win.mp3
/DesktopImage
/DesktopImage/610.mp4
/dist
/dist/images
/dist/libffmpeg.js
/dist/libffmpeg.wasm
/dist/spriteJSON
/dist/ui
/dist/ui/Game
/dist/ui/spritesheet
/dist/video
/dist/video.min.js
/Html
/socket.io

Found on 2025-12-01 07:45

Severity: medium
Fingerprint: 5f32cf5d6962f09ca629b8b1a629b8b1ce92b4eaa510fb413f6f9ce2210465e0

Found 34 files trough .DS_Store spidering:

/Audio
/Audio/aduioHe.mp3
/Audio/aduioHeXD.mp3
/Audio/aduioHeZD.mp3
/Audio/aduioHeZXD.mp3
/Audio/aduioXian.mp3
/Audio/aduioXianXD.mp3
/Audio/aduioXianZD.mp3
/Audio/aduioXianZXD.mp3
/Audio/aduioZhuang.mp3
/Audio/aduioZhuangXD.mp3
/Audio/aduioZhuangZD.mp3
/Audio/aduioZhuangZXD.mp3
/Audio/click.mp3
/Audio/ding.mp3
/Audio/Last10miao.mp3
/Audio/start.mp3
/Audio/startsendcards.mp3
/Audio/Win.mp3
/DesktopImage
/DesktopImage/610.mp4
/dist
/dist/images
/dist/libffmpeg.js
/dist/libffmpeg.wasm
/dist/spriteJSON
/dist/ui
/dist/ui/Game
/dist/ui/Game/win_icons
/dist/ui/spritesheet
/dist/video
/dist/video.min.js
/Html
/socket.io

Found on 2025-11-28 16:48

Create report

MacOS file listing through .DS_Store file

.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS).

They store information about the files within a folder, including display options of folders, such as icon positions and view settings.

It may happen that .DS_Store files inadvertently leak filenames such as database backups or private administration panels.

IP: 138.199.24.219
Domain: cdn.softindir.tr
Port: 443
URL: https://cdn.softindir.tr

First seen 2025-05-14 21:17
Last seen 2025-10-07 06:26
Open for 145 days
- Severity: low
  Fingerprint: 5f32cf5d6962f09c4239b3d84239b3d8e0a304c3a8dea5d2021b4687b302ff9a
```
Found 8 files trough .DS_Store spidering:

/indir-android.php
/indir-ios.php
/indir-macos.php
/indir-winphone.php
/indir.php
/indir2.php
/indir3.php
/indir4.php
```
  Found on 2025-10-07 06:26
Create report
Git configuration and history exposed

The following URL (usually /.git/config) is publicly accessible and is leaking source code and repository configuration.

IP: 138.199.24.219
Domain: cdn.ariyainfotech.com
Port: 443
URL: https://cdn.ariyainfotech.com

First seen 2025-06-05 10:22
Last seen 2025-09-30 16:46
Open for 117 days
- Severity: medium
  Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a65222b4f9a69
```
[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[remote "origin"]
	url = https://gitlab.com/yuvrajmagentoexpert/ariya-infotech.git
	fetch = +refs/heads/*:refs/remotes/origin/*
```
  Found on 2025-09-30 16:46
  
  220 Bytes
Create report
Git configuration and history exposed

The following URL (usually /.git/config) is publicly accessible and is leaking source code and repository configuration.

IP: 138.199.24.219
Domain: cdn.ariyainfotech.com
Port: 80
URL: http://cdn.ariyainfotech.com

First seen 2025-06-05 10:22
Last seen 2025-09-30 13:16
Open for 117 days
- Severity: medium
  Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a65222b4f9a69
```
[core]
	repositoryformatversion = 0
	filemode = true
	bare = false
	logallrefupdates = true
[remote "origin"]
	url = https://gitlab.com/yuvrajmagentoexpert/ariya-infotech.git
	fetch = +refs/heads/*:refs/remotes/origin/*
```
  Found on 2025-09-30 13:16
  
  220 Bytes
Create report
MacOS file listing through .DS_Store file

.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS).

They store information about the files within a folder, including display options of folders, such as icon positions and view settings.

It may happen that .DS_Store files inadvertently leak filenames such as database backups or private administration panels.

IP: 138.199.24.219
Domain: webcr.pt
Port: 443
URL: https://webcr.pt

First seen 2025-08-03 09:27
Last seen 2025-08-07 02:02
Open for 3 days
- Severity: low
  Fingerprint: 5f32cf5d6962f09c3c1fc5e93c1fc5e939fb670b768a1ae888ed4cf0a21c6ad0
```
Found 5 files trough .DS_Store spidering:

/.rw
/cache
/emacs
/models
/scr
```
  Found on 2025-08-07 02:02
Create report
MacOS file listing through .DS_Store file

.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS).

They store information about the files within a folder, including display options of folders, such as icon positions and view settings.

It may happen that .DS_Store files inadvertently leak filenames such as database backups or private administration panels.

IP: 138.199.24.219
Domain: travelliker.cfd
Port: 443
URL: https://travelliker.cfd

First seen 2025-07-24 21:02
- Severity: high
  Fingerprint: 5f32cf5d6962f09c8efce1938efce193a42d2486d9878d75c216dab75a635991
```
Found 36 files trough .DS_Store spidering:

/.htaccess
/11.txt
/123.png
/aa.png
/aa.txt
/backEnd.html
/css
/dist
/favicon.ico
/fonts
/index.html
/index.php
/install_nginx.sh
/js
/login.lua
/login.xxt
/nginx.conf
/proxy.conf
/robots.txt
/shoukuan.jpeg
/sms.txt
/static
/task.txt
/uploadFile
/uploadVpn.html
/uploadVpnTwo.html
/uploadWechatCheck.html
/uploadWechatData.html
/uploadWechatGuanzhu.html
/uploadWechatJiefeng.html
/uploadWechatMobile.html
/uploadWechatUser.html
/wch.xxt
/yueduPhp.zip
/yueduPhpz.zip
/批量下单格式.txt
```
  Found on 2025-07-24 21:02
Create report
MacOS file listing through .DS_Store file

.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS).

They store information about the files within a folder, including display options of folders, such as icon positions and view settings.

It may happen that .DS_Store files inadvertently leak filenames such as database backups or private administration panels.

IP: 138.199.24.219
Domain: metasteam.net
Port: 80
URL: http://metasteam.net

First seen 2025-07-06 23:52
- Severity: low
  Fingerprint: 5f32cf5d6962f09c2eda814e2eda814e2cd21beaa800c3644aa0b827fdd18d79
```
Found 6 files trough .DS_Store spidering:

/assets
/assets/js
/components
/models
/pages
/pages/index
```
  Found on 2025-07-06 23:52
Create report

Open service 138.199.24.219:443 · feedback.breweze.co

2026-01-12 01:02

HTTP/1.1 307 Temporary Redirect
Date: Mon, 12 Jan 2026 01:02:54 GMT
Content-Length: 0
Connection: close
Server: BunnyCDN-SG1-1272
CDN-PullZone: 4983277
CDN-RequestCountryCode: GB
Cache-Control: public, max-age=0
Location: /signin
Set-Cookie: user_session_id=yz6Dk9xacGjhDWA7PdZb8x68zDU5T5msbgym6MUo0tvZiZR4; Path=/; Expires=Tue, 12 Jan 2027 01:02:54 GMT; HttpOnly; Secure
Content-Security-Policy: base-uri 'self'; default-src 'self'; style-src 'self' 'unsafe-inline' https://*.paddle.com ; script-src 'self' 'nonce-ykO4D8WHU1RhVeL1EiLqYrXkDjTvjkk5' https://www.google-analytics.com https://*.paddle.com ; img-src 'self' https: data: ; font-src 'self' data: ; object-src 'none'; media-src 'none'; connect-src 'self' https://www.google-analytics.com ; frame-src 'self' https://*.paddle.com
Referrer-Policy: no-referrer-when-downgrade
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex, nofollow, noarchive, nosnippet, notranslate, noimageindex
X-XSS-Protection: 1; mode=block
X-Served-By: feedback.breweze.co
CDN-ProxyVer: 1.43
CDN-RequestPullSuccess: True
CDN-RequestPullCode: 307
CDN-CachedAt: 01/12/2026 01:02:54
CDN-EdgeStorageId: 1272
CDN-RequestId: ce12a8c2d488e441b838f543a2b9d7de
CDN-Cache: BYPASS
CDN-Status: 307
CDN-RequestTime: 0

Found 17 minutes ago by HttpPlugin

Host 138.199.24.219

Singapore

Software information

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

SSH is potenitally vulnerable

GraphQL introspection is enabled.

GraphQL introspection is enabled.

GraphQL introspection is enabled.

GraphQL introspection is enabled.

GraphQL introspection is enabled.

Git configuration and history exposed

Git configuration and history exposed

MacOS file listing through .DS_Store file

MacOS file listing through .DS_Store file

Git configuration and history exposed

Git configuration and history exposed

MacOS file listing through .DS_Store file

MacOS file listing through .DS_Store file

MacOS file listing through .DS_Store file