LeakIX - Host 188.92.242.62

Host 188.92.242.62

Russia

JSC Avantel

Ubuntu

Software information

MongoDB MongoDB 8.0.6

tcp/8002

nginx nginx 1.24.0

tcp/443 tcp/80

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 188.92.242.62
Domain: staging-rrm-api.oqtacore.com
Port: 443
URL: https://staging-rrm-api.oqtacore.com

First seen 2025-12-05 07:42
Last seen 2026-02-03 20:50
Open for 60 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549460937748fbf7912e96f1427ff5b761230862dc3

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
DELETE /api/CandidateFiles/Delete/{fileName}
GET /api/Auth/IsAuthenticated
GET /api/Calendars
GET /api/CandidateFiles/Download/{fileName}
GET /api/Candidates
GET /api/Candidates/Events/{eventId}
GET /api/Candidates/GetCandidateEventByZoomLink
GET /api/Candidates/{id}
GET /api/Clients
GET /api/Clients/Contacts/{clientId}
GET /api/Clients/StateSummary
GET /api/Clients/{id}
GET /api/Recruiters
GET /api/Recruiters/Current
GET /api/Search
GET /api/Settings
GET /api/Vacancies
GET /api/Vacancies/ByCandidate
GET /api/Vacancies/States
GET /api/Vacancies/StatusList
GET /api/Vacancies/{id}
POST /api/Auth/CreateUser
POST /api/Auth/login
POST /api/CandidateFiles/upload
POST /api/Candidates/AddVacancyComment/{id}
POST /api/Candidates/ChangeVacancyStatus
POST /api/Candidates/Events
POST /api/ClientContacts
POST /api/Recruiters/Statistics
PUT /api/Candidates/AddToFavorite/{id}
PUT /api/ClientContacts/{id}

Found on 2026-02-03 20:50

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 188.92.242.62
Domain: rrm-msk.oqtacore.com
Port: 443
URL: https://rrm-msk.oqtacore.com

First seen 2025-10-18 22:41
Last seen 2026-01-23 09:38
Open for 96 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549460937748fbf7912e96f1427ff5b761230862dc3

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
DELETE /api/CandidateFiles/Delete/{fileName}
GET /api/Auth/IsAuthenticated
GET /api/Calendars
GET /api/CandidateFiles/Download/{fileName}
GET /api/Candidates
GET /api/Candidates/Events/{eventId}
GET /api/Candidates/GetCandidateEventByZoomLink
GET /api/Candidates/{id}
GET /api/Clients
GET /api/Clients/Contacts/{clientId}
GET /api/Clients/StateSummary
GET /api/Clients/{id}
GET /api/Recruiters
GET /api/Recruiters/Current
GET /api/Search
GET /api/Settings
GET /api/Vacancies
GET /api/Vacancies/ByCandidate
GET /api/Vacancies/States
GET /api/Vacancies/StatusList
GET /api/Vacancies/{id}
POST /api/Auth/CreateUser
POST /api/Auth/login
POST /api/CandidateFiles/upload
POST /api/Candidates/AddVacancyComment/{id}
POST /api/Candidates/ChangeVacancyStatus
POST /api/Candidates/Events
POST /api/ClientContacts
POST /api/Recruiters/Statistics
PUT /api/Candidates/AddToFavorite/{id}
PUT /api/ClientContacts/{id}

Found on 2026-01-23 09:38

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 188.92.242.62
Domain: gpu-api.oqtacore.com
Port: 443
URL: https://gpu-api.oqtacore.com

First seen 2025-11-19 08:38
Last seen 2026-01-23 08:01
Open for 64 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-01-23 08:01
Create report
GraphQL introspection is enabled.

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 188.92.242.62
Domain: content.oqtacore.com
Port: 443
URL: https://content.oqtacore.com

First seen 2025-12-05 00:14
Last seen 2025-12-05 14:24
- Severity: medium
  Fingerprint: c2db3a1c40d490db2337d3d62337d3d62337d3d62337d3d62337d3d62337d3d6
```
GraphQL introspection enabled at /api/graphql
```
  Found on 2025-12-05 14:24
Create report

Open service 188.92.242.62:443 · content.oqtacore.com

2026-01-25 21:14

HTTP/1.1 200 OK
Server: nginx/1.24.0 (Ubuntu)
Date: Sun, 25 Jan 2026 21:14:49 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
Accept-CH: Sec-CH-Prefers-Color-Scheme
Vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding
Critical-CH: Sec-CH-Prefers-Color-Scheme
X-Powered-By: Next.js, Payload
Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate

Page title: Payload Blank Template

<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="stylesheet" href="/_next/static/css/79dff0a37f218e0d.css" data-precedence="next"/><link rel="preload" as="script" fetchPriority="low" href="/_next/static/chunks/webpack-6a5950a3575f529f.js"/><script src="/_next/static/chunks/8bf6b5b9-f8b73cf95ddfbde2.js" async=""></script><script src="/_next/static/chunks/3735-f40adbacaee7f1e0.js" async=""></script><script src="/_next/static/chunks/main-app-3fe851e38bd3e34d.js" async=""></script><script src="/_next/static/chunks/6358-1f75163232872653.js" async=""></script><script src="/_next/static/chunks/app/(frontend)/page-ebc20bbc913d0855.js" async=""></script><script src="/_next/static/chunks/polyfills-42372ed130431b0a.js" noModule=""></script></head><body><div hidden=""><!--$?--><template id="B:0"></template><!--/$--></div><main><div class="home"><div class="content"><picture><source srcSet="https://raw.githubusercontent.com/payloadcms/payload/main/packages/ui/src/assets/payload-favicon.svg"/><img alt="Payload Logo" loading="lazy" width="65" height="65" decoding="async" data-nimg="1" style="color:transparent" src="https://raw.githubusercontent.com/payloadcms/payload/main/packages/ui/src/assets/payload-favicon.svg"/></picture><h1>Welcome to Content CMS</h1><div class="links"><a class="admin" href="/admin" rel="noopener noreferrer" target="_blank">Go to admin panel</a><a class="docs" href="https://payloadcms.com/docs" rel="noopener noreferrer" target="_blank">Documentation</a></div></div><div class="footer"><a href="https://oqtacore.com"><p>oqtacore.com</p></a></div></div><!--$?--><template id="B:1"></template><!--/$--></main><script>requestAnimationFrame(function(){$RT=performance.now()});</script><script src="/_next/static/chunks/webpack-6a5950a3575f529f.js" id="_R_" async=""></script><title>Payload Blank Template</title><meta name="description" content="A blank template using Payload in a Next.js app."/><div hidden id="S:1"></div><script>$RB=[];$RV=function(a){$RT=performance.now();for(var b=0;b<a.length;b+=2){var c=a[b],e=a[b+1];null!==e.parentNode&&e.parentNode.removeChild(e);var f=c.parentNode;if(f){var g=c.previousSibling,h=0;do{if(c&&8===c.nodeType){var d=c.data;if("/$"===d||"/&"===d)if(0===h)break;else h--;else"$"!==d&&"$?"!==d&&"$~"!==d&&"$!"!==d&&"&"!==d||h++}d=c.nextSibling;f.removeChild(c);c=d}while(c);for(;e.firstChild;)f.insertBefore(e.firstChild,c);g.data="$";g._reactRetry&&requestAnimationFrame(g._reactRetry)}}a.length=0};
$RC=function(a,b){if(b=document.getElementById(b))(a=document.getElementById(a))?(a.previousSibling.data="$~",$RB.push(a,b),2===$RB.length&&("number"!==typeof $RT?requestAnimationFrame($RV.bind(null,$RB)):(a=performance.now(),setTimeout($RV.bind(null,$RB),2300>a&&2E3<a?2300-a:$RT+300-a)))):b.parentNode.removeChild(b)};$RC("B:1","S:1")</script><div hidden id="S:0"></div><script>$RC("B:0","S:0")</script><script>(self.__next_f=self.__next_f||[]).push([0])</script><script>self.__next_f.push([1,"1:\"$Sreact.fragment\"\n2:I[71928,[],\"\"]\n3:I[86030,[],\"\"]\n6:I[41237,[],\"OutletBoundary\"]\n8:I[50112,[],\"AsyncMetadataOutlet\"]\na:I[41237,[],\"ViewportBoundary\"]\nc:I[41237,[],\"MetadataBoundary\"]\nd:\"$Sreact.suspense\"\nf:I[99252,[],\"\"]\n10:I[66358,[\"6358\",\"static/chunks/6358-1f75163232872653.js\",\"6676\",\"static/chunks/app/(frontend)/page-ebc20bbc913d0855.js\"],\"Image\"]\n:HL[\"/_next/static/css/79dff0a37f218e0d.css\",\"style\"]\n"])</script><script>self.__next_f.push([1,"0:{\"P\":null,\"b\":\"_DKztBckdZ7ZlvZvivar4\",\"p\":\"\",\"c\":[\"\",\"\"],\"i\":false,\"f\":[[[\"\",{\"children\":[\"(frontend)\",{\"children\":[\"__PAGE__\",{}]},\"$undefined\",\"$undefined\",true]}],[\"\",[\"$\",\"$1\",\"c\",{\"children\":[null,[\"$\",\"$L2\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L3\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":[[[\"$\",\"title\",null,{\"chil

Found 2026-01-25 by HttpPlugin

Host 188.92.242.62

Russia

Software information

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

GraphQL introspection is enabled.

content.oqtacore.com

rrm-msk.oqtacore.com

gpu-api.oqtacore.com

staging-rrm-api.oqtacore.com

b2b-sonar.oqtacore.com

gpu-console.oqtacore.com

local-defi-app.oqtacore.com

local-defi-api.oqtacore.com

gpu-api.oqtacore.com

asm.oqtacore.com

gpu-provide.oqtacore.com

passwork.oqtacore.com

gpu-manage.oqtacore.com

Domain summary