AkamaiGHost
tcp/80
Apache
tcp/443 tcp/80
Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd151e75e4b60fee5cf8d9eff4c93b7cadc80274264e6e1d65e
Public Swagger UI/API detected at path: /v3/api-docs - sample paths:
GET /authorize
GET /oauth/entitlement-check
GET /sessions
GET /spotify/init
GET /spotify/link
GET /user-access
GET /user/auth
GET /user/sessions
GET /user/setCookie
POST /session/{sessionId}
POST /user/login
POST /user/loginExternal
POST /user/logout
POST /user/logoutExternal
POST /user/register
POST /user/resendValidationMail
POST /user/restorePassword
POST /user/session
POST /user/session/{sessionId}
Severity: info
Fingerprint: 5733ddf49ff49cd151e75e4b60fee5cf8d9eff4c93b7cadc6bfaced94f7a3e54
Public Swagger UI/API detected at path: /v3/api-docs - sample paths:
GET /authorize
GET /oauth/entitlement-check
GET /sessions
GET /user-access
GET /user/auth
GET /user/sessions
GET /user/setCookie
POST /session/{sessionId}
POST /user/login
POST /user/loginExternal
POST /user/logout
POST /user/logoutExternal
POST /user/register
POST /user/resendValidationMail
POST /user/restorePassword
POST /user/session
POST /user/session/{sessionId}
Open service 2.18.64.220:80
2026-01-26 15:02
HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 312 Expires: Mon, 26 Jan 2026 15:03:03 GMT Date: Mon, 26 Jan 2026 15:03:03 GMT Connection: close Page title: Invalid URL <HTML><HEAD> <TITLE>Invalid URL</TITLE> </HEAD><BODY> <H1>Invalid URL</H1> The requested URL "[no URL]", is invalid.<p> Reference #9.9cd53b17.1769439783.13bacc92 <P>https://errors.edgesuite.net/9.9cd53b17.1769439783.13bacc92</P> </BODY></HTML>
Open service 2.18.64.220:443 · img.g006.enterprise.ipost.com
2026-01-25 18:24
HTTP/1.1 403 Forbidden Content-Type: text/html; charset=iso-8859-1 Content-Length: 215 Server: Apache Date: Sun, 25 Jan 2026 18:24:16 GMT Connection: close Page title: 403 Forbidden <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /.noindex.html on this server.</p> </body></html>
Open service 2.18.64.220:80 · img.g006.enterprise.ipost.com
2026-01-25 18:24
HTTP/1.1 403 Forbidden Content-Type: text/html; charset=iso-8859-1 Content-Length: 215 Server: Apache Date: Sun, 25 Jan 2026 18:24:33 GMT Connection: close Page title: 403 Forbidden <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /.noindex.html on this server.</p> </body></html>
Open service 2.18.64.220:443 · staging.enterprise.ipost.com
2026-01-25 18:04
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 1494
Server: Apache
Last-Modified: Fri, 23 Jan 2026 08:55:54 GMT
X-Frame-Options: SAMEORIGIN
Referrer-Policy: no-referrer-when-downgrade
Strict-Transport-Security: max-age=31536000
Permissions-Policy: geolocation=(), microphone=()
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self' https:; script-src 'self' https: 'unsafe-eval' 'unsafe-inline'; style-src 'self' https: 'unsafe-inline'; img-src 'self' https: data:; font-src 'self' https:; connect-src 'self' https:; frame-src 'self' https:; frame-ancestors 'none'
Date: Sun, 25 Jan 2026 18:04:39 GMT
Connection: close
<!doctype html>
<html>
<head>
<meta http-equiv="X-UA-Compatible" content="IE=edge"/>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1, user-scalable=no"/>
<link href="//fonts.googleapis.com/css?family=Roboto:400,300italic,300,400italic,700,700italic,500,900&subset=latin,latin-ext" rel="stylesheet" type="text/css">
<link href="//fonts.googleapis.com/css?family=Lato:300,400,400italic,600,700|Raleway:300,400,500,600,700|Crete+Round:400italic" rel="stylesheet" type="text/css">
<link href='https://fonts.googleapis.com/css?family=Open+Sans:400,700,600,400italic' rel='stylesheet' type='text/css'>
<link href="/static/1.14.26/css/application.min.css" rel="stylesheet" type="text/css"/>
<link id='favicon' rel="shortcut icon" href="/webapi/whitelabel/favicon"/>
<link href="/webapi/whitelabel/custom-theme.css" rel="stylesheet" type="text/css"/>
</head>
<body>
<main id="root">
<div class="imm-activity-indicator-wrapper">
<div class="imm-activity-indicator medium">Initializing...</div>
</div>
</main>
<div id="layered-components"></div>
<script src="/static/1.14.26/js/ckeditor/ckeditor.js" defer></script>
<script src="/static/1.14.26/js/ckfinder/ckfinder.js" defer></script>
<script src="/static/1.14.26/js/download/download.js" defer></script>
<script src="/static/1.14.26/js/vendor.min.js"></script>
<script src="/static/1.14.26/js/application.min.js"></script>
</body>
</html>
Open service 2.18.64.220:80 · staging.enterprise.ipost.com
2026-01-25 18:04
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 1494
Server: Apache
Last-Modified: Fri, 23 Jan 2026 08:55:54 GMT
X-Frame-Options: SAMEORIGIN
Referrer-Policy: no-referrer-when-downgrade
Strict-Transport-Security: max-age=31536000
Permissions-Policy: geolocation=(), microphone=()
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self' https:; script-src 'self' https: 'unsafe-eval' 'unsafe-inline'; style-src 'self' https: 'unsafe-inline'; img-src 'self' https: data:; font-src 'self' https:; connect-src 'self' https:; frame-src 'self' https:; frame-ancestors 'none'
Date: Sun, 25 Jan 2026 18:04:59 GMT
Connection: close
<!doctype html>
<html>
<head>
<meta http-equiv="X-UA-Compatible" content="IE=edge"/>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1, user-scalable=no"/>
<link href="//fonts.googleapis.com/css?family=Roboto:400,300italic,300,400italic,700,700italic,500,900&subset=latin,latin-ext" rel="stylesheet" type="text/css">
<link href="//fonts.googleapis.com/css?family=Lato:300,400,400italic,600,700|Raleway:300,400,500,600,700|Crete+Round:400italic" rel="stylesheet" type="text/css">
<link href='https://fonts.googleapis.com/css?family=Open+Sans:400,700,600,400italic' rel='stylesheet' type='text/css'>
<link href="/static/1.14.26/css/application.min.css" rel="stylesheet" type="text/css"/>
<link id='favicon' rel="shortcut icon" href="/webapi/whitelabel/favicon"/>
<link href="/webapi/whitelabel/custom-theme.css" rel="stylesheet" type="text/css"/>
</head>
<body>
<main id="root">
<div class="imm-activity-indicator-wrapper">
<div class="imm-activity-indicator medium">Initializing...</div>
</div>
</main>
<div id="layered-components"></div>
<script src="/static/1.14.26/js/ckeditor/ckeditor.js" defer></script>
<script src="/static/1.14.26/js/ckfinder/ckfinder.js" defer></script>
<script src="/static/1.14.26/js/download/download.js" defer></script>
<script src="/static/1.14.26/js/vendor.min.js"></script>
<script src="/static/1.14.26/js/application.min.js"></script>
</body>
</html>
Open service 2.18.64.220:80 · user-access-dev-2b.testfaz.net
2026-01-23 07:36
HTTP/1.1 404 Not Found
Content-Type: application/json
X-Request-ID: d177345be356634e5a2279dbbc6be917
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Vary: origin
Vary: access-control-request-method
Vary: access-control-request-headers
Date: Fri, 23 Jan 2026 07:36:54 GMT
Content-Length: 122
Connection: close
X-Debug-A-Serial: 313-1669027486
X-Debug-A-Add-Debug-Headers: true
{"timestamp":"2026-01-23T07:36:54.253+00:00","status":404,"error":"Not Found","message":"No static resource .","path":"/"}