LeakIX - Host 158.23.105.3

Host 158.23.105.3

Mexico

MICROSOFT-CORP-MSN-AS-BLOCK

Software information

Kestrel Kestrel

tcp/443

gunicorn

tcp/443

nginx nginx 1.28.1

tcp/443

nginx nginx 1.28.0

tcp/443 tcp/80

nginx nginx

tcp/443 tcp/80

uvicorn

tcp/443

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 158.23.105.3
Domain: sgd003.backend.webapi.mc.dev-soredigames.net
Port: 443
URL: https://sgd003.backend.webapi.mc.dev-soredigames.net

First seen 2025-12-06 18:56
Last seen 2026-02-09 17:13
Open for 64 days

Severity: info
Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
Found on 2026-02-09 17:13

Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549cece03e90a6c8937962dfd4ebe8a515e64bbb40d

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
DELETE /api/challenge/challengeLapRecording/delete
DELETE /api/challenge/management/delete
DELETE /api/configurationFile/management/delete
DELETE /api/currency/management/delete
DELETE /api/inventory/delete
DELETE /api/laprecording/delete
DELETE /api/ship/deleteAllUserShips
DELETE /api/ship/deleteShipByName
DELETE /api/ship/deleteShipBySlot
DELETE /api/wallet/delete
GET /api/challenge/challengeLapRecording/get/{challenge}
GET /api/challenge/get/{challengeName}
GET /api/challenge/getActiveChallengeList
GET /api/challenge/leaderboards/get
GET /api/challenge/management/get/{challengeName}
GET /api/challenge/management/getListPaginated
GET /api/challenge/management/getUserInfo
GET /api/challenge/management/userLapRecording/get
GET /api/challenge/similarLapTimes/get
GET /api/configurationFile/get
GET /api/configurationFile/management/get
GET /api/configurationFile/management/getList
GET /api/currency/checkCurrencyAmount
GET /api/currency/checkPurchase
GET /api/currency/get/{currencyName}
GET /api/currency/getList
GET /api/currency/management/get/{currencyName}
GET /api/currency/management/getList
GET /api/feedback/management/getFeedback
GET /api/inventory/get
GET /api/inventory/management/get
GET /api/laprecording/get
GET /api/laprecording/getLeaderBoards
GET /api/laprecording/getSimilarLapTimes
GET /api/laprecording/getUserLapRecording
GET /api/offer/get/{category}
GET /api/offer/getDailyOffers
GET /api/offer/management/get/{category}
GET /api/product/getPending
GET /api/ship/getAvailableGasSlots
GET /api/ship/getHangarSlotShip
GET /api/ship/getShipByName
GET /api/ship/getUserShips
GET /api/terms
GET /api/transaction/management/get/{transactionId}
GET /api/transaction/management/getTransactions
GET /api/user/gq
GET /api/user/management/gq/{userId}
GET /api/user/management/list
GET /api/user/management/{userId}
GET /api/utils/getServerDateTime
GET /api/wallet/get
GET /api/wallet/management/getList
GET /api/wallet/management/get{userId}
GET /api/welcomeMessage
POST /api/challenge/asignReward
POST /api/challenge/begin
POST /api/challenge/claimReward
POST /api/challenge/end
POST /api/challenge/management/create
POST /api/challenge/management/createFromFile
POST /api/configurationFile/management/create
POST /api/currency/management/create
POST /api/feedback/feedback
POST /api/inventory/create
POST /api/laprecording/create
POST /api/offer/createOffers
POST /api/postlogin/post-login
POST /api/product/consume
POST /api/product/createProducts
POST /api/product/redeem
POST /api/ship/create
POST /api/shop/epic_purchase
POST /api/shop/offer_purchase
POST /api/shop/ship_offer_purchase
POST /api/terms/management/update
POST /api/wallet/create
POST /api/welcomeMessage/management/update
PUT /api/challenge/management/enable
PUT /api/challenge/management/update
PUT /api/configurationFile/management/update
PUT /api/currency/management/update
PUT /api/inventory/update
PUT /api/laprecording/update
PUT /api/ship/addGasSlot
PUT /api/ship/refillAllGasSlots
PUT /api/ship/updateByHangarSlot
PUT /api/ship/updateByName
PUT /api/ship/useGasSlot
PUT /api/user/scrap
PUT /api/user/updateData
PUT /api/wallet/management/update
PUT /api/wallet/update

Found on 2026-01-23 11:36

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 158.23.105.3
Domain: app.alkasa.net
Port: 443
URL: https://app.alkasa.net

First seen 2025-10-20 19:25
Last seen 2026-02-09 15:20
Open for 111 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-02-09 15:20
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 158.23.105.3
Domain: sgd003.backend.backgroundservices.mc.dev-soredigames.net
Port: 443
URL: https://sgd003.backend.backgroundservices.mc.dev-soredigames.net

First seen 2025-11-19 13:39
Last seen 2026-01-16 13:24
Open for 57 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1aad03549530605979d30bae214eab9d95dce8f1d8ad4bc67
```
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
DELETE /api/BackgroundProcess/delete
GET /api/BackgroundProcess/get-history
GET /api/BackgroundProcess/get-list
GET /api/BackgroundProcess/get/{name}
GET /api/BackgroundProcess/names
GET /api/BackgroundProcess/status/{name}
POST /api/BackgroundProcess/create
POST /api/BackgroundProcess/start
POST /api/BackgroundProcess/stop
PUT /api/BackgroundProcess/enable
PUT /api/BackgroundProcess/update
```
  Found on 2026-01-16 13:24
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 158.23.105.3
Domain: ogaapi.test.einteligent.com
Port: 443
URL: https://ogaapi.test.einteligent.com

First seen 2025-12-29 23:22
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2025-12-29 23:22
Create report

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 158.23.105.3
Domain: atlas.deepxus.com
Port: 443
URL: https://atlas.deepxus.com

First seen 2025-11-05 23:21
Last seen 2025-11-23 03:56
Open for 17 days

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3f50e59e4eed0a7e856d7fc94326d9974326d9974

GraphQL introspection enabled at /graphql
Types: 19 (by kind: ENUM: 2, INPUT_OBJECT: 1, OBJECT: 13, SCALAR: 3)
Operations:
- Query: Query | fields: organization, person, searchOrganizations, searchPeople, statistics
Directives: deprecated, include, oneOf, skip, specifiedBy (total: 5)

Found on 2025-11-23 03:56

55.6 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa311f0728aa4402b3a6d6eddce428f593a428f593a

GraphQL introspection enabled at /graphql
Types: 18 (by kind: ENUM: 2, INPUT_OBJECT: 1, OBJECT: 12, SCALAR: 3)
Operations:
- Query: Query | fields: organization, person, searchOrganizations, searchPeople, statistics
Directives: deprecated, include, oneOf, skip, specifiedBy (total: 5)

Found on 2025-11-20 14:06

34.1 kBytes

Create report

Open service 158.23.105.3:443 · api.dev-arias.sikore.app

2026-01-26 21:08

HTTP/1.1 503 Service Unavailable
Connection: close
Date: Mon, 26 Jan 2026 21:08:24 GMT
Retry-After: 60
Transfer-Encoding: chunked


<div style="display: block; margin: auto;  width: 600px; height: 500px; text-align: center; font-family: 'Courier', cursive, sans-serif;"><h1 style="color: 747474">:( Application Error</h1><p style="color:#666">If you are the application administrator, you can access the <a style="color: grey"href="https://dev-arias-u6py8t-backend.scm.azurewebsites.net/detectors">diagnostic resources</a>.</div>

Found 2026-01-26 by HttpPlugin