LeakIX - Host 20.50.2.35

Host 20.50.2.35

The Netherlands

MICROSOFT-CORP-MSN-AS-BLOCK

Software information

Kestrel Kestrel

tcp/443 tcp/80

Microsoft-IIS 10.0

tcp/443 tcp/80

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.50.2.35
Domain: administratie-t.cito.nl
Port: 443
URL: https://administratie-t.cito.nl

First seen 2025-11-17 12:37
Last seen 2026-01-10 02:08
Open for 53 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad035493d41efacbbd5e19169276db4dcbbe03905bdbb61

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /leerkrachten/{leerkrachtKey}/klanten/{klantId}/scholen
GET /leerkrachten/{leerkrachtKey}/scholen
GET /leerlingen/groep/{groepId}
GET /leerlingen/school/{schoolTenantId}
GET /leerlingen/school/{schoolTenantId}/leerkracht/{userId}
GET /scholen
GET /scholen/bytenantid/{tenantId}
GET /scholen/{schoolId}
GET /scholen/{schoolId}/groepen
GET /scholen/{schoolId}/leerkrachten
GET /scholen/{schoolId}/leerkrachten/{leerkrachtKey}
GET /scholen/{schoolTenantId}/jaargroepen
GET /scholen/{schoolTenantId}/leerkrachten/{citoId}/jaargroepen
GET /school/{schoolTenantId}/groepen
GET /school/{schoolTenantId}/leerkrachten/{citoId}/groepen
GET /schooljaar
GET /v2/adminnodes/{adminNodeId}/details
GET /v2/organisaties
GET /v2/organisaties/{organisatieKey}/applicaties
GET /v2/organisaties/{organisatieKey}/applicaties/{applicatieKey}/adminnodes
GET /v2/organisaties/{organisatieKey}/applicaties/{applicatieKey}/adminnodes/paginated
GET /v2/organisaties/{organisatieKey}/applicaties/{applicatieKey}/adminnodes/{adminNodeId}
GET /v2/organisaties/{organisatieKey}/applicaties/{applicatieKey}/adminnodes/{adminNodeId}/personen
GET /v2/organisaties/{organisatieKey}/applicaties/{applicatieKey}/adminnodes/{adminNodeId}/personen/{persoonId}
GET /v2/organisaties/{organisatieKey}/applicaties/{applicatieKey}/adminnodes/{adminNodeId}/persoon
GET /v2/organisaties/{organisatieKey}/applicaties/{applicatieKey}/adminnodes/{scopingAdminNodeId}/bymetadata
GET /v2/organisaties/{organisatieKey}/applicaties/{applicatieKey}/sleutel/{sleutelType}/value/{sleutelValue}
GET /v2/sleutel/{citoId}
POST /edexml
POST /edexml/{klantId}
POST /v2/organisaties/{organisatieKey}/applicaties/{applicatieKey}/sleutel/{sleutelScope}/byvalue
POST /v2/sleutel
POST /v2/sleutel/list
POST /v2/sleutel/{sleutelScope}/byvalue
PUT /edexml/las
PUT /leerkrachten/{leerkrachtKey}
PUT /v2/organisaties/{organisatieKey}/applicaties/{applicatieKey}/adminnodes/{adminNodeId}/personen/{persoonId}/metadata
PUT /v2/organisaties/{organisatieKey}/applicaties/{applicatieKey}/adminnodes/{adminNodeId}/personen/{persoonId}/userid/{userId}

Found on 2026-01-10 02:08

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.50.2.35
Domain: decursor.net
Port: 443
URL: https://decursor.net

First seen 2025-12-02 05:57
Last seen 2026-01-09 21:25
Open for 38 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1aad0354938cdd7d0015367a70a35940dd180ece991668f74
```
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /MicrosoftIdentity/Account/Challenge/{scheme}
GET /MicrosoftIdentity/Account/EditProfile/{scheme}
GET /MicrosoftIdentity/Account/ResetPassword/{scheme}
GET /MicrosoftIdentity/Account/SignIn/{scheme}
GET /MicrosoftIdentity/Account/SignOut/{scheme}
GET /api/Dienst
GET /api/Dienst/{id}
GET /api/Gebruiker
GET /api/Gebruiker/{id}
GET /api/GebruikerFunctie
GET /api/GebruikerFunctie/{id}
GET /api/Project
GET /api/Project/{id}
POST /api/Dienst/ByGebruikerEmailadres
```
  Found on 2026-01-09 21:25
Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.50.2.35
Domain: switzerland-utilityapi.apcoaparkway.com
Port: 443
URL: https://switzerland-utilityapi.apcoaparkway.com

First seen 2025-12-11 07:16
Last seen 2026-01-09 15:51
Open for 29 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549a3ca5d8eab775d6d75a19a5bac200e049332201c

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/EntitlementInfoLookup
GET /api/EntitlementLookup
GET /api/data/entitlementsbyindex
GET /api/data/getcarparkentitlementlocationcodes
GET /api/data/getclientcarparkall
GET /api/data/getdailysummarybytime
GET /api/data/getentitlementsubtypelocationcodes
GET /api/data/getentitlementsubtypes
GET /api/data/getentitlementtypes
GET /api/data/getvisitdatabycarparkbytime
GET /api/data/getvisitdatabytime
GET /api/data/getvisitstatusall
GET /api/data/getvisitstatushistory
GET /api/data/getvisitstatussummarybytime
GET /api/data/kioskentitlementsbyindex
GET /api/health
GET /api/healthx
GET /api/test
GET /api/uk/passagecontrol/getalldevices
GET /api/uk/passagecontrol/getalldevicetypes
GET /api/uk/passagecontrol/getallreasonsfordevice
GET /api/uk/passagecontrol/getallstatusesfordevice
GET /api/uk/passagecontrol/getdevice
GET /api/uk/passagecontrol/getstatusfordevice
GET /api/util/getclientcarparkall
GET /api/util/getutilisation
POST /WSA/wsa/payment/amount
POST /WSA/wsa/payment/confirmation
POST /api/Enforcement/lookupbyvrn
POST /api/Entitlement
POST /api/Exemption
POST /api/ExemptionList
POST /api/Italy/flowbirdpulsar
POST /api/Poland/flowbirdsoap
POST /api/test2
POST /api/uk/passagecontrol/allowpassage
POST /api/uk/passagecontrol/checkdeviceposition
POST /api/uk/passagecontrol/denypassage
POST /api/uk/passagecontrol/resetdevice
POST /api/uk/passagecontrol/setdevicestatus
POST /kiosk/api/entitlement
POST /kiosk/api/heartbeat
POST /kiosk/api/kioskstatusupdate
POST /kiosk/api/lookup
POST /wsa

Found on 2026-01-09 15:51

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.50.2.35
Domain: austria-utilityapi.apcoaparkway.com
Port: 443
URL: https://austria-utilityapi.apcoaparkway.com

First seen 2025-12-11 07:16
Last seen 2026-01-09 13:38
Open for 29 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549a3ca5d8eab775d6d75a19a5bac200e049332201c

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/EntitlementInfoLookup
GET /api/EntitlementLookup
GET /api/data/entitlementsbyindex
GET /api/data/getcarparkentitlementlocationcodes
GET /api/data/getclientcarparkall
GET /api/data/getdailysummarybytime
GET /api/data/getentitlementsubtypelocationcodes
GET /api/data/getentitlementsubtypes
GET /api/data/getentitlementtypes
GET /api/data/getvisitdatabycarparkbytime
GET /api/data/getvisitdatabytime
GET /api/data/getvisitstatusall
GET /api/data/getvisitstatushistory
GET /api/data/getvisitstatussummarybytime
GET /api/data/kioskentitlementsbyindex
GET /api/health
GET /api/healthx
GET /api/test
GET /api/uk/passagecontrol/getalldevices
GET /api/uk/passagecontrol/getalldevicetypes
GET /api/uk/passagecontrol/getallreasonsfordevice
GET /api/uk/passagecontrol/getallstatusesfordevice
GET /api/uk/passagecontrol/getdevice
GET /api/uk/passagecontrol/getstatusfordevice
GET /api/util/getclientcarparkall
GET /api/util/getutilisation
POST /WSA/wsa/payment/amount
POST /WSA/wsa/payment/confirmation
POST /api/Enforcement/lookupbyvrn
POST /api/Entitlement
POST /api/Exemption
POST /api/ExemptionList
POST /api/Italy/flowbirdpulsar
POST /api/Poland/flowbirdsoap
POST /api/test2
POST /api/uk/passagecontrol/allowpassage
POST /api/uk/passagecontrol/checkdeviceposition
POST /api/uk/passagecontrol/denypassage
POST /api/uk/passagecontrol/resetdevice
POST /api/uk/passagecontrol/setdevicestatus
POST /kiosk/api/entitlement
POST /kiosk/api/heartbeat
POST /kiosk/api/kioskstatusupdate
POST /kiosk/api/lookup
POST /wsa

Found on 2026-01-09 13:38

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.50.2.35
Domain: api.mobexo.de
Port: 443
URL: https://api.mobexo.de

First seen 2025-12-12 03:45
Last seen 2026-01-09 08:29
Open for 28 days

Severity: info
Fingerprint: 5733ddf49ff49cd1f3d88d6088d4b35fd462d0c430726bf6beea2903a4d31a2d

Public Swagger UI/API detected at path: /swagger/v1/swagger.json - sample paths:
GET /CarHistory/{apiKey}
GET /CarHistory/{apiKey}/All
GET /CarHistory/{apiKey}/{pageNumber}/{countOnPage}
GET /CarServices/{apiKey}
GET /CarServices/{apiKey}/All
GET /CarServices/{apiKey}/{pageNumber}/{countOnPage}
GET /Cars/{apiKey}
GET /Cars/{apiKey}/All
GET /Cars/{apiKey}/{pageNumber}/{countOnPage}
GET /CostCenterHistory/{apiKey}
GET /CostCenterHistory/{apiKey}/All
GET /CostCenterHistory/{apiKey}/{pageNumber}/{countOnPage}
GET /Drivers/{apiKey}
GET /Drivers/{apiKey}/All
GET /Drivers/{apiKey}/{pageNumber}/{countOnPage}
GET /Incidents/{apiKey}
GET /Incidents/{apiKey}/{pageNumber}/{countOnPage}
GET /MileageHistory/{apiKey}
GET /MileageHistory/{apiKey}/All
GET /MileageHistory/{apiKey}/{pageNumber}/{countOnPage}
POST /CarHistory/{apiKey}/Search/{pageNumber}/{countOnPage}
POST /CarServices/{apiKey}/Search/{pageNumber}/{countOnPage}
POST /Cars/{apiKey}/Search/{pageNumber}/{countOnPage}
POST /CostCenterHistory/{apiKey}/Search/{pageNumber}/{countOnPage}
POST /Drivers/{apiKey}/Search/{pageNumber}/{countOnPage}
POST /MileageHistory/{apiKey}/Search/{pageNumber}/{countOnPage}

Found on 2026-01-09 08:29

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.50.2.35
Domain: housing.woonz.nl
Port: 443
URL: https://housing.woonz.nl

First seen 2025-10-29 21:12
Last seen 2025-11-08 12:19
Open for 9 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1b885ff43c95b18050a7bb51f5cdbce638674f258b29d0126
```
Public Swagger UI/API detected at path: /swagger.json - sample paths:
GET /api/ads
GET /api/alliances
GET /api/alliances/{identifier}
GET /api/banners/random
GET /api/banners/{id}/redirect
GET /api/care
GET /api/cities
GET /api/housetypes
GET /api/housetypes/filters
GET /api/housetypes/suggestions/{query}
GET /api/housetypes/{id}
GET /api/housingcomplexes
GET /api/housingcomplexes/mostviewed/{count}
GET /api/housingcomplexes/{identifier}
GET /api/housingcomplexes/{id}/nearby
GET /api/location/{urlName}
GET /api/locations/{query}
GET /api/organisations
GET /api/organisations/{identifier}
GET /api/thirdparties/{key}/colors
POST /api/housetypes/search
POST /api/housingcomplexes/search
```
  Found on 2025-11-08 12:19
Create report

Open service 20.50.2.35:443 · preview.go.stark.group

2026-01-13 00:24

HTTP/1.1 302 Found
Content-Length: 0
Connection: close
Date: Tue, 13 Jan 2026 00:25:02 GMT
Location: https://starkgroup.dk/
Request-Context: appId=cid-v1:f6fb8af8-2be2-4997-868f-c68c783f8a89

Found 2 days ago by HttpPlugin