LeakIX - Host 2.16.206.152

Host 2.16.206.152

Germany

Akamai International B.V.

Ubuntu

Software information

APISIX 3.3.0

tcp/443

AkamaiGHost

tcp/443 tcp/80

AmazonS3

tcp/443

Apache Apache 2.4.62

tcp/443

Apache Apache

tcp/443 tcp/80

Apache Apache 2.4.52

tcp/443

Apache Apache 2.4.37

tcp/443

Framer a6f72bf

tcp/443

Microsoft-HTTPAPI 2.0

tcp/443

Microsoft-IIS 10.0

tcp/443

OpenSSL OpenSSL 3.5.1

tcp/443

Windows-Azure-Web 1.0

tcp/443

daiquiri 5

tcp/443 tcp/80

istio-envoy

tcp/443

nginx nginx

tcp/443 tcp/80

nginx nginx 1.27.5

tcp/443

nginx nginx 1.28.0

tcp/443

nginx nginx 1.16.1

tcp/443

nginx nginx 1.25.5

tcp/443 tcp/80

nginx nginx 1.26.0

tcp/443 tcp/80

openresty

tcp/443

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 2.16.206.152
Domain: agnes.toyota-ce.com
Port: 443
URL: https://agnes.toyota-ce.com

First seen 2025-11-10 04:01
Last seen 2026-01-12 04:01
Open for 63 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1aad03549040f375f2bc87467dc01cf3596b5cbec2d14d2a1
```
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/catalog/dealers
GET /api/catalog/models/jobtype/{jobType}
GET /api/catalog/singlejobs/dealer/{dealerCode}/modelVersion/{modelVersionCode}
GET /api/catalog/singlejobs/dealer/{dealerCode}/wmi/{wmi}/vds/{vds}
GET /api/catalog/singlejobs/dealer/{dealerId}/model/{modelId}
GET /api/catalog/singlejobs/jobType/{jobType}/dealer/{dealerCode}/modelVersion/{modelVersionCode}
GET /api/catalog/singlejobs/jobType/{jobType}/dealer/{dealerCode}/wmi/{wmi}/vds/{vds}
GET /api/catalog/singlejobs/jobType/{jobType}/dealer/{dealerId}/model/{modelId}
```
  Found on 2026-01-12 04:01
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 2.16.206.152
Domain: admin.drop-shop.co.nz
Port: 443
URL: https://admin.drop-shop.co.nz

First seen 2025-10-17 08:12
Last seen 2026-01-10 00:46
Open for 84 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-01-10 00:46
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 2.16.206.152
Domain: admin.heishop.pa
Port: 443
URL: https://admin.heishop.pa

First seen 2025-11-17 16:10
Last seen 2026-01-09 23:59
Open for 53 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-01-09 23:59
Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 2.16.206.152
Domain: hyresapi.hyvip.com.tw
Port: 443
URL: https://hyresapi.hyvip.com.tw

First seen 2025-10-16 11:19
Last seen 2026-01-09 21:40
Open for 85 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549d41aa1a6fabc2c63525e99a7cf5be683a2afe706

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /backend/Test/TestConnection
GET /backend/Test/TesthyvipApi_Delete
GET /backend/Test/TesthyvipApi_Get
GET /backend/Test/TesthyvipApi_Post
GET /backend/Test/TesthyvipApi_Put
GET /frontend/Reserve/GetReserveNo
GET /frontend/Test/TestConnection
POST /backend/Account/AddAccount
POST /backend/Account/DeleteAccount
POST /backend/Account/EditAccount
POST /backend/Account/GetAccount
POST /backend/Account/GetAccountList
POST /backend/Auth/GetBackendPermission
POST /backend/Auth/Login
POST /backend/Global/ExportI18NFile
POST /backend/Global/InportI18NFile
POST /backend/Global/SendMail
POST /backend/Global/UpdateData
POST /backend/Member/GetMember
POST /backend/Member/GetMemberList
POST /backend/News/AddNews
POST /backend/News/DeleteNews
POST /backend/News/EditNews
POST /backend/News/GetNews
POST /backend/News/GetNewsList
POST /backend/Reserve/GetMealOptions
POST /backend/Reserve/GetNationOptions
POST /backend/Reserve/GetPickUpLocations
POST /backend/Reserve/GetReserve
POST /backend/Reserve/GetReserveList
POST /backend/Reserve/GetSurveys
POST /backend/Role/AddBackendRole
POST /backend/Role/AddFrontendRole
POST /backend/Role/DeleteBackendRole
POST /backend/Role/DeleteFrontendRole
POST /backend/Role/EditBackendRole
POST /backend/Role/EditFrontendRole
POST /backend/Role/GetBackendPermissionList
POST /backend/Role/GetBackendRole
POST /backend/Role/GetBackendRoleList
POST /backend/Role/GetBackendRoleOptions
POST /backend/Role/GetFrontendPermissionList
POST /backend/Role/GetFrontendRole
POST /backend/Role/GetFrontendRoleList
POST /backend/Role/GetFrontendRoleOptions
POST /backend/User/EditUser
POST /backend/User/GetUserList
POST /frontend/Auth/Auth2FA
POST /frontend/Auth/ChangePassword
POST /frontend/Auth/CheckResetCode
POST /frontend/Auth/DeleteToken
POST /frontend/Auth/GenerateResetCode
POST /frontend/Auth/Login
POST /frontend/Auth/RefreshToken
POST /frontend/Auth/ResetPassword
POST /frontend/Global/GetGlobalSetting
POST /frontend/Global/GetI18nFile
POST /frontend/Global/GetOCRResult
POST /frontend/Global/GetWaterMakerResult
POST /frontend/Global/Getkey
POST /frontend/Member/AddMemberPerson
POST /frontend/Member/CheckMemberPerson
POST /frontend/Member/CreditCardOptions
POST /frontend/Member/DeleteMemberPerson
POST /frontend/Member/EditMemberPerson
POST /frontend/Member/GetContract
POST /frontend/Member/GetMemberInfo
POST /frontend/Member/GetMemberPerson
POST /frontend/Member/GetMemberPersonList
POST /frontend/Member/GetMemberPersonOptions
POST /frontend/Member/GetMemberUserList
POST /frontend/Member/GetNationOptions
POST /frontend/Member/GetUserData
POST /frontend/News/GetNews
POST /frontend/News/GetNewsList
POST /frontend/Reserve/AddReserve
POST /frontend/Reserve/CheckDate
POST /frontend/Reserve/DeleteReserve
POST /frontend/Reserve/EditReserve
POST /frontend/Reserve/GetFlight
POST /frontend/Reserve/GetMealOptions
POST /frontend/Reserve/GetMealTypes
POST /frontend/Reserve/GetNationalOptions
POST /frontend/Reserve/GetPickUpLocations
POST /frontend/Reserve/GetPlaceOptions
POST /frontend/Reserve/GetReservableTime
POST /frontend/Reserve/GetReserve
POST /frontend/Reserve/GetReserveList
POST /frontend/Reserve/GetSurveys
POST /frontend/Reserve/InportExcel

Found on 2026-01-09 21:40

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 2.16.206.152
Domain: transactionexternal.centrivo-tst.com
Port: 443
URL: https://transactionexternal.centrivo-tst.com

First seen 2025-11-12 21:57
Last seen 2026-01-09 20:31
Open for 57 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-01-09 20:31
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 2.16.206.152
Domain: meg.disco.wowtv.de
Port: 443
URL: https://meg.disco.wowtv.de

First seen 2025-11-12 14:46
Last seen 2026-01-09 18:54
Open for 58 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd151e75e4bd0966466b7b4c33d6b5946596b5946596b594659
```
Public Swagger UI/API detected at path: /v3/api-docs - sample paths:
GET /abservice/features
GET /abservice/v2/experiments
GET /abservice/v2/features
```
  Found on 2026-01-09 18:54
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 2.16.206.152
Domain: acc-admin.heishop.lc
Port: 443
URL: https://acc-admin.heishop.lc

First seen 2025-10-17 08:12
Last seen 2026-01-09 18:44
Open for 84 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-01-09 18:44
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 2.16.206.152
Domain: car-api.toyota-ce.com
Port: 443
URL: https://car-api.toyota-ce.com

First seen 2025-10-20 03:01
Last seen 2026-01-09 17:39
Open for 81 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1aad03549cf9ae63eacc8de5cb03bca0f6e494d30fed0fb3e
```
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/car-info/many
GET /api/car-info/many/history
GET /api/car-info/many/history/{vins}
GET /api/car-info/many/recalls-open
GET /api/car-info/many/recalls-open/{vins}
GET /api/car-info/many/{vins}
GET /api/car-info/{vin}
GET /api/car-info/{vin}/contract
GET /api/car-info/{vin}/cws-recalls
GET /api/car-info/{vin}/history
GET /api/car-info/{vin}/recalls-open
```
  Found on 2026-01-09 17:39
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 2.16.206.152
Domain: external.centrivo-tst.com
Port: 443
URL: https://external.centrivo-tst.com

First seen 2025-11-12 22:09
Last seen 2026-01-09 15:23
Open for 57 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-01-09 15:23
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 2.16.206.152
Domain: acc-admin.heishop.pa
Port: 443
URL: https://acc-admin.heishop.pa

First seen 2025-11-17 16:10
Last seen 2026-01-09 12:11
Open for 52 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-01-09 12:11
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 2.16.206.152
Domain: api.centrivo-tst.com
Port: 443
URL: https://api.centrivo-tst.com

First seen 2025-11-12 22:02
Last seen 2026-01-09 10:26
Open for 57 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-01-09 10:26
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 2.16.206.152
Domain: payment.centrivo-tst.com
Port: 443
URL: https://payment.centrivo-tst.com

First seen 2025-11-12 22:18
Last seen 2026-01-09 09:25
Open for 57 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-01-09 09:25
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 2.16.206.152
Domain: api.centrivo-dev.com
Port: 443
URL: https://api.centrivo-dev.com

First seen 2025-11-12 22:06
Last seen 2026-01-09 05:29
Open for 57 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-01-09 05:29
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 2.16.206.152
Domain: reportingexternal.centrivo-tst.com
Port: 443
URL: https://reportingexternal.centrivo-tst.com

First seen 2025-11-12 22:03
Last seen 2026-01-09 02:21
Open for 57 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-01-09 02:21
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 2.16.206.152
Domain: playerexternal.centrivo-tst.com
Port: 443
URL: https://playerexternal.centrivo-tst.com

First seen 2025-11-12 22:19
Last seen 2026-01-08 22:24
Open for 57 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-01-08 22:24
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 2.16.206.152
Domain: siteapi.centrivo-dev.com
Port: 443
URL: https://siteapi.centrivo-dev.com

First seen 2025-11-12 22:20
Last seen 2026-01-08 19:37
Open for 56 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-01-08 19:37
Create report

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 2.16.206.152
Domain: www.klong.se
Port: 443
URL: https://www.klong.se

First seen 2025-11-07 23:43
Last seen 2026-01-02 21:49
Open for 55 days

Severity: medium
Fingerprint: c2db3a1c40d490dbaf340e11d5499ec0c183c904cf51702ce80e41c7ec9d0de2

GraphQL introspection enabled at /api/gql
Types: 222 (by kind: ENUM: 10, INPUT_OBJECT: 39, INTERFACE: 4, OBJECT: 156, SCALAR: 8, UNION: 5)
Operations:
- Query: Query | fields: search, searchAutoComplete, startPage, store, stores
- Mutation: Mutation | fields: addToCustomerProductList, createCustomerProductList, deleteCustomerProductList, subscribeToNewsletter, subscribeToStockNotifications
Directives: deprecated, include, skip (total: 3)

Detected: Magento

Found on 2026-01-02 21:49

238.0 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490dbaf340e11d5499ec0c183c904cf51702ce80e41c7bae1e177

GraphQL introspection enabled at /api/gql
Types: 222 (by kind: ENUM: 10, INPUT_OBJECT: 39, INTERFACE: 4, OBJECT: 156, SCALAR: 8, UNION: 5)
Operations:
- Query: Query | fields: search, searchAutoComplete, startPage, store, stores
- Mutation: Mutation | fields: addToCustomerProductList, createCustomerProductList, deleteCustomerProductList, subscribeToNewsletter, subscribeToStockNotifications
Directives: deprecated, include, skip (total: 3)

Found on 2025-12-11 14:25

238.0 kBytes

Create report

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 2.16.206.152
Domain: admin.heishop.pa
Port: 443
URL: https://admin.heishop.pa

First seen 2025-11-17 16:10
Last seen 2026-01-02 21:19
Open for 46 days

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa35996898f245c069dc46ce45a6584402f555ec7de

GraphQL introspection enabled at /graphql
Types: 273 (by kind: ENUM: 7, INPUT_OBJECT: 104, INTERFACE: 1, OBJECT: 147, SCALAR: 14)
Operations:
- Query: Query | fields: categories, category, product, properties, property
- Mutation: Mutations | fields: addGiftItems, addItem, changeComment, clearCart, rejectGiftItems
- Subscription: Subscriptions | fields: ping
Directives: deprecated, include, skip (total: 3)

Found on 2026-01-02 21:19

485.8 kBytes

Create report

GraphQL introspection is enabled.

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 2.16.206.152
Domain: acc-admin.heishop.pa
Port: 443
URL: https://acc-admin.heishop.pa

First seen 2025-11-17 16:10
Last seen 2026-01-02 15:41
Open for 45 days
- Severity: medium
  Fingerprint: c2db3a1c40d490db1a0bbaa35996898f245c069dc46ce45a6584402f555ec7de
```
GraphQL introspection enabled at /graphql
Types: 273 (by kind: ENUM: 7, INPUT_OBJECT: 104, INTERFACE: 1, OBJECT: 147, SCALAR: 14)
Operations:
- Query: Query | fields: categories, category, product, properties, property
- Mutation: Mutations | fields: addGiftItems, addItem, changeComment, clearCart, rejectGiftItems
- Subscription: Subscriptions | fields: ping
Directives: deprecated, include, skip (total: 3)
```
  Found on 2026-01-02 15:41
  
  485.8 kBytes
- Severity: medium
  Fingerprint: c2db3a1c40d490db1a0bbaa31a0bbaa31a0bbaa31a0bbaa31a0bbaa31a0bbaa3
```
GraphQL introspection enabled at /graphql
```
  Found on 2025-12-16 14:13
Create report

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 2.16.183.201
Domain: store.panasonic.co.uk
Port: 443
URL: https://store.panasonic.co.uk

First seen 2025-10-20 00:59
Last seen 2026-01-02 02:48
Open for 74 days

Severity: medium
Fingerprint: c2db3a1c40d490dbf8cbe7e26a54fa83ab0de981d26cc46cc14d70723bde1963

GraphQL introspection enabled at /graphql/api
Types: 475 (by kind: ENUM: 44, INPUT_OBJECT: 114, INTERFACE: 25, OBJECT: 287, SCALAR: 5)
Operations:
- Query: Query | fields: attributesForm, attributesList, availableStores, cart, categories
- Mutation: Mutation | fields: addBundleProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart, addProductsToCompareList
Directives: deprecated, include, oneOf, skip (total: 4)

Detected: Magento

Found on 2026-01-02 02:48

870.4 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa374c2942e74c2942e74c2942e74c2942e74c2942e
```
GraphQL introspection enabled at /graphql
Detected: Magento
```
Found on 2025-12-27 14:26

Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3ed95013a3cc4536a5db1be9ba75e34eb2afc967e

GraphQL introspection enabled at /graphql
Types: 475 (by kind: ENUM: 44, INPUT_OBJECT: 114, INTERFACE: 25, OBJECT: 287, SCALAR: 5)
Operations:
- Query: Query | fields: attributesForm, attributesList, availableStores, cart, categories
- Mutation: Mutation | fields: addBundleProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart, addProductsToCompareList
Directives: deprecated, include, oneOf, skip (total: 4)

Detected: Magento

Found on 2025-12-27 14:26

870.4 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490dbf8cbe7e2df9b2641df9b2641df9b2641df9b2641df9b2641
```
GraphQL introspection enabled at /graphql/api
Detected: Magento
```
Found on 2025-12-25 00:42

Severity: medium
Fingerprint: c2db3a1c40d490dbf8cbe7e26a54fa83ab0de981d26cc46cc14d707222b7d65c

GraphQL introspection enabled at /graphql/api
Types: 475 (by kind: ENUM: 44, INPUT_OBJECT: 114, INTERFACE: 25, OBJECT: 287, SCALAR: 5)
Operations:
- Query: Query | fields: attributesForm, attributesList, availableStores, cart, categories
- Mutation: Mutation | fields: addBundleProductsToCart, addConfigurableProductsToCart, addDownloadableProductsToCart, addProductsToCart, addProductsToCompareList
Directives: deprecated, include, oneOf, skip (total: 4)

Found on 2025-12-10 20:14

872.6 kBytes

Severity: medium
Fingerprint: c2db3a1c40d490dbf8cbe7e2f8cbe7e2f8cbe7e2f8cbe7e2f8cbe7e2f8cbe7e2
```
GraphQL introspection enabled at /graphql/api
```
Found on 2025-11-30 09:32
Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa31a0bbaa31a0bbaa31a0bbaa31a0bbaa31a0bbaa3
```
GraphQL introspection enabled at /graphql
```
Found on 2025-10-20 00:59

Create report

GraphQL introspection is enabled.

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 2.16.206.153
Domain: gitlab.gfk-e.com
Port: 443
URL: https://gitlab.gfk-e.com

First seen 2025-10-19 14:10
Last seen 2025-12-27 00:19
Open for 68 days
- Severity: medium
  Fingerprint: c2db3a1c40d490db2337d3d603073f8703073f8703073f8703073f8703073f87
```
GraphQL introspection enabled at /api/graphql
Detected: GitLab
```
  Found on 2025-12-27 00:19
- Severity: medium
  Fingerprint: c2db3a1c40d490db2337d3d62337d3d62337d3d62337d3d62337d3d62337d3d6
```
GraphQL introspection enabled at /api/graphql
```
  Found on 2025-12-11 14:03
Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 2.16.206.152
Domain: appotemposervico.otempo.com.br
Port: 443
URL: https://appotemposervico.otempo.com.br

First seen 2025-10-14 19:05
Last seen 2025-12-16 14:18
Open for 62 days

Severity: info
Fingerprint: 5733ddf49ff49cd18553ecf7337de5d6ac55ea36b2383be9164db4081b5f8e3e

Public Swagger UI/API detected at path: /swagger-ui.html - sample paths:
DELETE /otempo/delete-popup/{id}
DELETE /otempo/horoscopo/apagar-preferencia-horoscopo
GET /healthcheck
GET /otempo/active-popup
GET /otempo/all-popup
GET /otempo/canal-o-tempo/podcast/{playlist}
GET /otempo/canal-o-tempo/podcasts
GET /otempo/canal-o-tempo/programas
GET /otempo/carnaval
GET /otempo/carnaval-events
GET /otempo/cinema/betim/destaques
GET /otempo/cinema/betim/embreve
GET /otempo/cinema/betim/emcartaz
GET /otempo/cinema/bh/destaques
GET /otempo/cinema/bh/emalta/sessions
GET /otempo/cinema/bh/embreve
GET /otempo/cinema/bh/emcartaz
GET /otempo/cinema/bh/sessions
GET /otempo/climate/forecast
GET /otempo/climate/search
GET /otempo/feedback/all
GET /otempo/horoscopo/dados/signo
GET /otempo/horoscopo/image/signo/nao-selecionado/{signo}
GET /otempo/horoscopo/image/signo/selecionado/{signo}
GET /otempo/horoscopo/page
GET /otempo/horoscopo/preferencia-horoscopo
GET /otempo/horoscopo/todos-os-signos
GET /otempo/image/svg/public-image/grandes/{signo}
GET /otempo/image/svg/public-image/pequenas/{signo}
GET /otempo/image/svg/public-image/{imagens}
GET /otempo/loterias/sorteios-do-dia
GET /otempo/mais-lidas/links
GET /otempo/preferencia
GET /otempo/preferencia/allEditoria
GET /otempo/preferencia/clima
GET /otempo/preferencia/editoria
GET /otempo/promotion/app
GET /otempo/promotion/coupon/available
GET /otempo/promotion/gifts
GET /otempo/promotion/participant/participated
GET /otempo/promotion/participant/participating
GET /otempo/promotion/program
GET /otempo/promotion/ticket/coupon
GET /otempo/promotion/{id}
GET /otempo/purchase/texts/{paymentType}
GET /otempo/transito/bh
GET /otempo/transito/bh/{latitude}/{longitude}/{raioemmetros}
POST /authenticate/login
POST /otempo/feedback
POST /otempo/horoscopo/cadastrar-preferencia-horoscopo
POST /otempo/notification/event
POST /otempo/notification/subscribeTopic
POST /otempo/notification/unSubscribeTopic
POST /otempo/notification/update
POST /otempo/popup
POST /otempo/preferencia/remover
POST /otempo/promotion/apply
POST /otempo/promotion/ticket/get-push-tokens
POST /otempo/purchase/confirmPurchase
POST /otempo/purchase/webhook
PUT /otempo/update-popup

Found on 2025-12-16 14:18

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 2.16.206.152
Domain: appotemposervicohml.otempo.com.br
Port: 443
URL: https://appotemposervicohml.otempo.com.br

First seen 2025-10-14 19:05
Last seen 2025-12-16 05:35
Open for 62 days

Severity: info
Fingerprint: 5733ddf49ff49cd151e75e4b94d641025e933a2a51feba6d57e439cc356fea62

Public Swagger UI/API detected at path: /v3/api-docs - sample paths:
DELETE /otempo/delete-popup/{id}
DELETE /otempo/horoscopo/apagar-preferencia-horoscopo
GET /healthcheck
GET /otempo/active-popup
GET /otempo/all-popup
GET /otempo/canal-o-tempo/podcast/{playlist}
GET /otempo/canal-o-tempo/podcasts
GET /otempo/canal-o-tempo/programas
GET /otempo/carnaval
GET /otempo/carnaval-events
GET /otempo/cinema/betim/destaques
GET /otempo/cinema/betim/embreve
GET /otempo/cinema/betim/emcartaz
GET /otempo/cinema/bh/destaques
GET /otempo/cinema/bh/emalta/sessions
GET /otempo/cinema/bh/embreve
GET /otempo/cinema/bh/emcartaz
GET /otempo/cinema/bh/sessions
GET /otempo/climate/forecast
GET /otempo/climate/search
GET /otempo/feedback/all
GET /otempo/horoscopo/dados/signo
GET /otempo/horoscopo/image/signo/nao-selecionado/{signo}
GET /otempo/horoscopo/image/signo/selecionado/{signo}
GET /otempo/horoscopo/page
GET /otempo/horoscopo/preferencia-horoscopo
GET /otempo/horoscopo/todos-os-signos
GET /otempo/image/svg/public-image/grandes/{signo}
GET /otempo/image/svg/public-image/pequenas/{signo}
GET /otempo/image/svg/public-image/{imagens}
GET /otempo/loterias/sorteios-do-dia
GET /otempo/mais-lidas/links
GET /otempo/preferencia
GET /otempo/preferencia/allEditoria
GET /otempo/preferencia/clima
GET /otempo/preferencia/editoria
GET /otempo/promotion/app
GET /otempo/promotion/coupon/available
GET /otempo/promotion/gifts
GET /otempo/promotion/participant/participated
GET /otempo/promotion/participant/participating
GET /otempo/promotion/program
GET /otempo/promotion/ticket/coupon
GET /otempo/promotion/{id}
GET /otempo/purchase/texts/{paymentType}
GET /otempo/transito/bh
GET /otempo/transito/bh/{latitude}/{longitude}/{raioemmetros}
POST /authenticate/login
POST /otempo/feedback
POST /otempo/horoscopo/cadastrar-preferencia-horoscopo
POST /otempo/notification/event
POST /otempo/notification/subscribeTopic
POST /otempo/notification/unSubscribeTopic
POST /otempo/notification/update
POST /otempo/popup
POST /otempo/preferencia/remover
POST /otempo/promotion/apply
POST /otempo/promotion/ticket/get-push-tokens
POST /otempo/purchase/confirmPurchase
POST /otempo/purchase/webhook
PUT /otempo/update-popup

Found on 2025-12-16 05:35

Create report

Open service 2.16.206.152:443 · amp-api-search.apps.apple.com

2026-01-12 17:40

HTTP/1.1 404 Not Found
Server: daiquiri/5
Content-Type: text/html
Content-Length: 548
X-Apple-Jingle-Correlation-Key: SOOWPZ5PVRUEFC7BOACPZ6CQRE
x-daiquiri-instance: daiquiri:12282004:mr47p00it-qujn04120301:7987:25HOTFIX33:daiquiri-amp-store-l7shared-ext-001-mr
Expires: Mon, 12 Jan 2026 17:40:46 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 12 Jan 2026 17:40:46 GMT
Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600
X-Cache: TCP_MISS from a2-16-205-139.deploy.akamaitechnologies.com (AkamaiGHost/22.3.3.1-d99a9e98b7d52dde86bd4d85ef9e7108) (-)
Connection: close
X-Cache-Remote: TCP_MISS from a2-20-179-219.deploy.akamaitechnologies.com (AkamaiGHost/22.3.3.1-71e9d5dfbd3c1d9c60c216bbd0edd340) (-)



<!DOCTYPE html>
<html lang="en">
<head>
    <style>
        body {
            font-family: "Helvetica Neue", "HelveticaNeue", Helvetica, Arial, sans-serif;
            font-size: 15px;
            font-weight: 200;
            line-height: 20px;
            color: #4c4c4c;
            text-align: center;
        }

        .section {
            margin-top: 50px;
        }
    </style>
</head>
<body>
<div class="section">
    <h1>&#63743;</h1>

    <h3>Not Found</h3>
    <p>The requested page could not be found.</p>
</div>
</body>
</html>

Found one day ago by HttpPlugin