LeakIX - Host 20.90.134.43

Host 20.90.134.43

United Kingdom

MICROSOFT-CORP-MSN-AS-BLOCK

Software information

Kestrel Kestrel

tcp/443 tcp/80

TornadoServer 6.5.2

tcp/443

gunicorn

tcp/443

nginx nginx

tcp/443 tcp/80

nginx nginx 1.28.0

tcp/443

nginx nginx 1.29.4

tcp/443 tcp/80

uvicorn

tcp/443 tcp/80

GraphQL introspection is enabled.

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 20.90.134.43
Domain: innovixx.co.uk
Port: 443
URL: https://innovixx.co.uk

First seen 2025-10-23 15:30
Last seen 2026-02-09 23:54
Open for 109 days
- Severity: medium
  Fingerprint: c2db3a1c40d490db2337d3d62337d3d62337d3d62337d3d62337d3d62337d3d6
```
GraphQL introspection enabled at /api/graphql
```
  Found on 2026-02-09 23:54
- Severity: medium
  Fingerprint: c2db3a1c40d490db2337d3d6b17138c15b2288c37b9fe0725377949b8a8ade33
```
GraphQL introspection enabled at /api/graphql
Types: 3607 (by kind: ENUM: 98, INPUT_OBJECT: 419, OBJECT: 3063, SCALAR: 8, UNION: 19)
Operations:
- Query: Query | fields: Article, Articles, countArticles, docAccessArticle, versionArticle
- Mutation: Mutation | fields: createArticle, deleteArticle, duplicateArticle, restoreVersionArticle, updateArticle
Directives: deprecated, include, oneOf, skip, specifiedBy (total: 5)
```
  Found on 2025-11-30 17:17
  
  2.2 MBytes
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.90.134.43
Domain: brokers-test.api.rgcore.com
Port: 443
URL: https://brokers-test.api.rgcore.com

First seen 2026-01-10 11:10
Last seen 2026-02-04 17:09
Open for 25 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1aad03549953bde9ec682ee593344001d666f6250476807f4
```
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/v1/Campaign/SourceNameOfCampaigns
GET /api/v1/Product/ProductType
GET /api/v1/Product/{productId}
GET /api/v1/Source/All
GET /api/v1/Source/Report
GET /api/v1/Source/TestConfiguration
POST /api/v1/Campaign/{CampaignId}/CreateApplication
POST /api/v1/Campaign/{CampaignId}/LeadBidResponse
POST /api/v1/Product/CreateProductType
POST /api/v1/Product/{ProductTypeId}/CreateProduct
POST /api/v1/Source/CreateSource
POST /api/v1/Source/{SourceId}/AddExcludedRef
POST /api/v1/Source/{SourceId}/CreateCampaign
PUT /api/v1/Product/{ProductId}/UpdateProduct
PUT /api/v1/Source/{CampaignId}/UpdateCampaign
PUT /api/v1/Source/{SourceId}/RemoveExcludedRef/{excludedRefId}
PUT /api/v1/Source/{SourceId}/UpdateSource
```
  Found on 2026-02-04 17:09
Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.90.134.43
Domain: loanbook-test.api.rgcore.com
Port: 443
URL: https://loanbook-test.api.rgcore.com

First seen 2026-01-12 13:11
Last seen 2026-02-03 03:34
Open for 21 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad035498102aa97f6e0f41cb31f7f5ddd5df299004e699c

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/v1/Loanbook/Allocation
GET /api/v1/Loanbook/AppVersionCheck
GET /api/v1/Loanbook/AppWhitelisted
GET /api/v1/Loanbook/ArrearsCaselist
GET /api/v1/Loanbook/Counts
GET /api/v1/Loanbook/CurrentCount/{id}
GET /api/v1/Loanbook/CurrentFlags
GET /api/v1/Loanbook/CustomFlagTypes
GET /api/v1/Loanbook/DataTypes
GET /api/v1/Loanbook/DeDupe
GET /api/v1/Loanbook/EventHistory
GET /api/v1/Loanbook/Events
GET /api/v1/Loanbook/ID
GET /api/v1/Loanbook/LastDebtCollectionSubmissionDate
GET /api/v1/Loanbook/LitigationAllocationList
GET /api/v1/Loanbook/LiveCaselist
GET /api/v1/Loanbook/Report
GET /api/v1/Loanbook/Search
GET /api/v1/Loanbook/WordList
GET /api/v1/Loanbook/{LoanbookID}
GET /api/v1/Loanbook/{LoanbookID}/CheckRegularDay
GET /api/v1/Loanbook/{LoanbookID}/CollectionAdvantageReport
GET /api/v1/Loanbook/{LoanbookID}/DefaultAndSettlementAmount
GET /api/v1/Loanbook/{LoanbookID}/OriginalPaymentPlan
GET /api/v1/Loanbook/{LoanbookID}/Statement
GET /api/v1/Loanbook/{loanbookId}/RenderedStatement
GET /api/v1/PushNotifications/Register/Handle/{handle}
GET /api/v1/PushNotifications/Register/Id/{id}
GET /api/v1/PushNotifications/Register/PushPlatforms
GET /api/v1/PushNotifications/Register/Tag/{tag}
POST /api/v1/Loanbook/AddBulkFlags
POST /api/v1/Loanbook/AddLoan
POST /api/v1/Loanbook/AppLoginSuccess
POST /api/v1/Loanbook/CreateCustomFlagType
POST /api/v1/Loanbook/FlagCaseList
POST /api/v1/Loanbook/MostRecentLoanHistory
POST /api/v1/Loanbook/NewWordList
POST /api/v1/Loanbook/{LoanbookID}/AddTransaction
POST /api/v1/Loanbook/{LoanbookID}/Allocation
POST /api/v1/Loanbook/{LoanbookID}/DebtCollectionCase
POST /api/v1/Loanbook/{LoanbookID}/Event
POST /api/v1/PushNotifications/Register
PUT /api/v1/Loanbook/AmendLender
PUT /api/v1/Loanbook/Deactivate
PUT /api/v1/Loanbook/EditCustomFlagType
PUT /api/v1/Loanbook/ReportGenerated
PUT /api/v1/Loanbook/Unsubscribe
PUT /api/v1/Loanbook/{LoanbookID}/Amend
PUT /api/v1/Loanbook/{LoanbookID}/ChangeRegularDay
PUT /api/v1/Loanbook/{LoanbookID}/Flag/{FlagId}
PUT /api/v1/Loanbook/{LoanbookID}/Scribble
PUT /api/v1/Loanbook/{loanbookId}/Payments

Found on 2026-02-03 03:34

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.90.134.43
Domain: api.stakeholdermaps.com
Port: 443
URL: https://api.stakeholdermaps.com

First seen 2026-01-07 04:17
Last seen 2026-02-02 06:11
Open for 26 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1bf890109bf890109bf890109bf890109bf890109bf890109
```
Public Swagger UI/API detected at path: /api-docs/swagger.json
```
  Found on 2026-02-02 06:11
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.90.134.43
Domain: apiv2.dev-cai.internal.transferroom.com
Port: 443
URL: https://apiv2.dev-cai.internal.transferroom.com

First seen 2025-11-19 13:47
Last seen 2026-02-02 04:46
Open for 74 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-02-02 04:46
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.90.134.43
Domain: metrics-production.double11.com
Port: 443
URL: https://metrics-production.double11.com

First seen 2025-12-21 14:04
Last seen 2026-02-02 02:06
Open for 42 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1aad035499d0efe8d80035735b59aea1bdfe83e3cc1e619ae
```
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/Health
GET /api/LogLevel/{gameId}
POST /api/Import/game/{gameId}
POST /api/Import/server/{gameId}
POST /api/LogLevel
```
  Found on 2026-02-02 02:06
Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.90.134.43
Domain: test.tglns.com
Port: 443
URL: https://test.tglns.com

First seen 2025-11-14 11:39
Last seen 2026-01-23 13:16
Open for 70 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549785b71db7b050e09572328fe16d697dc766e7221

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /s/Parse/{key}
GET /s/{key}
GET /v1/Accounts
GET /v1/BlockCustomer
GET /v1/Communications/CallerId
GET /v1/Communications/Campaign/{campaignName}
GET /v1/Communications/CaselistMissedCalls
GET /v1/Communications/Counts/IVR
GET /v1/Communications/Counts/MF
GET /v1/Communications/Counts/RR
GET /v1/Communications/Customer
GET /v1/Communications/CustomerHistory
GET /v1/Communications/Report
GET /v1/Communications/UnreadsSproc
GET /v1/Communications/VvcSnapshots/{aRef}/{gtRef}
GET /v1/Sms/GetSmsProviders
GET /v1/Sms/OutStatus
GET /v1/Sms/ParentSlots
GET /v1/TwilioVideo/geolocation/{aref}/{gtref}
GET /v1/TwilioVideo/geolocation/{aref}/{gtref}/last
GET /v1/Verify/ValidateSMS
GET /v1/Verify/VerifySMS
POST /v1/Communications/LastContact
POST /v1/Email/Send
POST /v1/Email/Status
POST /v1/Letter/Send
POST /v1/Notifications/Message
POST /v1/Sms/VonageInbound
POST /v1/Sms/VonageStatus
POST /v1/TwilioCall/Dial
POST /v1/TwilioCall/recording
POST /v1/TwilioVideo
POST /v1/TwilioVideo/geolocation
PUT /v1/Communications/Amend
PUT /v1/Communications/MarkCasesCommsAsRead

Found on 2026-01-23 13:16

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.90.134.43
Domain: test.tglns.com
Port: 80
URL: http://test.tglns.com

First seen 2025-11-14 11:39
Last seen 2026-01-22 22:47
Open for 69 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549785b71db7b050e09572328fe16d697dc766e7221

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /s/Parse/{key}
GET /s/{key}
GET /v1/Accounts
GET /v1/BlockCustomer
GET /v1/Communications/CallerId
GET /v1/Communications/Campaign/{campaignName}
GET /v1/Communications/CaselistMissedCalls
GET /v1/Communications/Counts/IVR
GET /v1/Communications/Counts/MF
GET /v1/Communications/Counts/RR
GET /v1/Communications/Customer
GET /v1/Communications/CustomerHistory
GET /v1/Communications/Report
GET /v1/Communications/UnreadsSproc
GET /v1/Communications/VvcSnapshots/{aRef}/{gtRef}
GET /v1/Sms/GetSmsProviders
GET /v1/Sms/OutStatus
GET /v1/Sms/ParentSlots
GET /v1/TwilioVideo/geolocation/{aref}/{gtref}
GET /v1/TwilioVideo/geolocation/{aref}/{gtref}/last
GET /v1/Verify/ValidateSMS
GET /v1/Verify/VerifySMS
POST /v1/Communications/LastContact
POST /v1/Email/Send
POST /v1/Email/Status
POST /v1/Letter/Send
POST /v1/Notifications/Message
POST /v1/Sms/VonageInbound
POST /v1/Sms/VonageStatus
POST /v1/TwilioCall/Dial
POST /v1/TwilioCall/recording
POST /v1/TwilioVideo
POST /v1/TwilioVideo/geolocation
PUT /v1/Communications/Amend
PUT /v1/Communications/MarkCasesCommsAsRead

Found on 2026-01-22 22:47

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.90.134.43
Domain: payments-test.api.rgcore.com
Port: 443
URL: https://payments-test.api.rgcore.com

First seen 2026-01-13 05:40
Last seen 2026-01-22 11:57
Open for 9 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549b6c8b80f24a29d9c0bbda5c6ccc4a9dba967ab4b

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
DELETE /api/v1/Payments/Delete
GET /api/v1/Payments
GET /api/v1/Payments/Accounts
GET /api/v1/Payments/DirectDebitDelays
GET /api/v1/Payments/EventHistory
GET /api/v1/Payments/Events/{eventId}
GET /api/v1/Payments/Summary
GET /api/v1/Payments/{aRef}/{gtRef}/AutoCollect
POST /api/v1/Payments/AddBankAccount
POST /api/v1/Payments/AddElectronicPayment
POST /api/v1/Payments/ExternalEvents
POST /api/v1/Payments/GetSessionToken
POST /api/v1/Payments/New
POST /api/v1/Payments/NewAccount
POST /api/v1/Payments/ProcessPayment
POST /api/v1/Payments/Refund
POST /api/v1/Payments/TakePayment/PaymentId
POST /api/v1/Payments/TestMe/{lenderId}/{paymentId}/{days}
POST /api/v1/Payments/TokeniseCard
POST /api/v1/Payments/Transaction/{paymentId}
POST /api/v1/Payments/UpdateDirectDebitDelays
POST /api/v1/Processor/worldpay/authenticate3ds
POST /api/v1/Processor/worldpay/devicedatainit/{paymentId}
POST /api/v1/Processor/worldpay/verifyandattemptpayment/{paymentId}
PUT /api/v1/Payments/ActiveAccounts
PUT /api/v1/Payments/Deactivate
PUT /api/v1/Payments/Payout

Found on 2026-01-22 11:57

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.90.134.43
Domain: communications-test.api.rgcore.com
Port: 80
URL: http://communications-test.api.rgcore.com

First seen 2026-01-12 23:25
Last seen 2026-01-22 11:55
Open for 9 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549785b71db7b050e09572328fe16d697dc766e7221

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /s/Parse/{key}
GET /s/{key}
GET /v1/Accounts
GET /v1/BlockCustomer
GET /v1/Communications/CallerId
GET /v1/Communications/Campaign/{campaignName}
GET /v1/Communications/CaselistMissedCalls
GET /v1/Communications/Counts/IVR
GET /v1/Communications/Counts/MF
GET /v1/Communications/Counts/RR
GET /v1/Communications/Customer
GET /v1/Communications/CustomerHistory
GET /v1/Communications/Report
GET /v1/Communications/UnreadsSproc
GET /v1/Communications/VvcSnapshots/{aRef}/{gtRef}
GET /v1/Sms/GetSmsProviders
GET /v1/Sms/OutStatus
GET /v1/Sms/ParentSlots
GET /v1/TwilioVideo/geolocation/{aref}/{gtref}
GET /v1/TwilioVideo/geolocation/{aref}/{gtref}/last
GET /v1/Verify/ValidateSMS
GET /v1/Verify/VerifySMS
POST /v1/Communications/LastContact
POST /v1/Email/Send
POST /v1/Email/Status
POST /v1/Letter/Send
POST /v1/Notifications/Message
POST /v1/Sms/VonageInbound
POST /v1/Sms/VonageStatus
POST /v1/TwilioCall/Dial
POST /v1/TwilioCall/recording
POST /v1/TwilioVideo
POST /v1/TwilioVideo/geolocation
PUT /v1/Communications/Amend
PUT /v1/Communications/MarkCasesCommsAsRead

Found on 2026-01-22 11:55

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.90.134.43
Domain: communications-test.api.rgcore.com
Port: 443
URL: https://communications-test.api.rgcore.com

First seen 2026-01-12 23:25
Last seen 2026-01-16 14:10
Open for 3 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549785b71db7b050e09572328fe16d697dc766e7221

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /s/Parse/{key}
GET /s/{key}
GET /v1/Accounts
GET /v1/BlockCustomer
GET /v1/Communications/CallerId
GET /v1/Communications/Campaign/{campaignName}
GET /v1/Communications/CaselistMissedCalls
GET /v1/Communications/Counts/IVR
GET /v1/Communications/Counts/MF
GET /v1/Communications/Counts/RR
GET /v1/Communications/Customer
GET /v1/Communications/CustomerHistory
GET /v1/Communications/Report
GET /v1/Communications/UnreadsSproc
GET /v1/Communications/VvcSnapshots/{aRef}/{gtRef}
GET /v1/Sms/GetSmsProviders
GET /v1/Sms/OutStatus
GET /v1/Sms/ParentSlots
GET /v1/TwilioVideo/geolocation/{aref}/{gtref}
GET /v1/TwilioVideo/geolocation/{aref}/{gtref}/last
GET /v1/Verify/ValidateSMS
GET /v1/Verify/VerifySMS
POST /v1/Communications/LastContact
POST /v1/Email/Send
POST /v1/Email/Status
POST /v1/Letter/Send
POST /v1/Notifications/Message
POST /v1/Sms/VonageInbound
POST /v1/Sms/VonageStatus
POST /v1/TwilioCall/Dial
POST /v1/TwilioCall/recording
POST /v1/TwilioVideo
POST /v1/TwilioVideo/geolocation
PUT /v1/Communications/Amend
PUT /v1/Communications/MarkCasesCommsAsRead

Found on 2026-01-16 14:10

Create report

GraphQL introspection is enabled.

GraphQL introspection is enabled.

This could leak to data leak if not properly configured.

IP: 20.90.134.43
Domain: accessinsights.kintiga.com
Port: 443
URL: https://accessinsights.kintiga.com

First seen 2025-10-16 23:21
Last seen 2026-01-16 10:30
Open for 91 days
- Severity: medium
  Fingerprint: c2db3a1c40d490db1a0bbaa31a0bbaa31a0bbaa31a0bbaa31a0bbaa31a0bbaa3
```
GraphQL introspection enabled at /graphql
```
  Found on 2026-01-16 10:30
- Severity: medium
  Fingerprint: c2db3a1c40d490db1a0bbaa3c89afb7b1a4c8c793e598326f3e0b5a06bf737d2
```
GraphQL introspection enabled at /graphql
Types: 590 (by kind: ENUM: 48, INPUT_OBJECT: 107, INTERFACE: 103, OBJECT: 326, SCALAR: 5, UNION: 1)
Operations:
- Query: RootQuery | fields: allSettings, categories, category, comment, comments
- Mutation: RootMutation | fields: createCategory, createComment, createCountry, createGraphqlDocument, createGraphqlDocumentGroup
Directives: deprecated, include, oneOf, skip (total: 4)
```
  Found on 2025-11-30 19:35
  
  1.2 MBytes
Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 20.90.134.43
Domain: dev.api.airohealth.co.uk
Port: 443
URL: https://dev.api.airohealth.co.uk

First seen 2026-01-10 14:39

Severity: info
Fingerprint: 5733ddf49ff49cd1aad0354916059aaac652a3d76c58c2704f1e728029f3d91a

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/AgeCheck/image
GET /api/AuditHistory/GetAuditHistory
GET /api/Chat/GetChatbyId
GET /api/Chat/GetChatbyUserId
GET /api/Chat/GetChatsForConsultation
GET /api/Consultation/GetConsultationCounts
GET /api/Consultation/GetConsultationDetail
GET /api/Consultation/GetConsultationStatusCounts
GET /api/Consultation/GetConsultationsByFilters
GET /api/Consultation/GetConsultationsById
GET /api/Consultation/GetConsultationsByPatientId
GET /api/Consultation/GetConsultationsByUser
GET /api/Consultation/GetPatientClinicianMapping
GET /api/Consultation/UserOrders
GET /api/ConsultationQuestionResponse/GetQuestionnaire
GET /api/ConsultationTypes/GetConsultationTypes
GET /api/CountryCountyCity/GetCitiesByCountyId
GET /api/CountryCountyCity/GetCountry
GET /api/CountryCountyCity/GetCountyByCountryId
GET /api/DiscountCoupons/GetCoupons
GET /api/DiscountCoupons/Validate
GET /api/Dosage/GetDosageById
GET /api/Dosage/GetDosageByProdutId
GET /api/Dropdown/FetchOptionsByMasterId
GET /api/HeightType/GetHeightType
GET /api/HomePage/HomePageJSON
GET /api/HomePage/TreatmentPageJSON
GET /api/MediaLibrary/GetAllFiles
GET /api/MediaLibrary/GetUserImages
GET /api/MedicalRecord/GetMedicalRecordHistoryByPatientId
GET /api/MedicalRecord/GetMedicalRecordsByPatient
GET /api/Notes/GetNotesByPatientId
GET /api/Order/GetOrderByConsultationId
GET /api/Order/GetOrderById
GET /api/PatientInfo/GetAllPatients
GET /api/PatientInfo/GetPatientById
GET /api/Plan/GetAllPlan
GET /api/Plan/GetPlanById
GET /api/PlanSequence/GetAllPlanSequence
GET /api/Prescription/GetPrescriptions
GET /api/Product/GetAllProduct
GET /api/Product/GetProductById
GET /api/ProgressOverview/GetProgressOverview
GET /api/ProgressOverview/ProgressOverviewAsofNow
GET /api/QuestionOption/GetQuestionOptions
GET /api/Questions/GetFirstQuestion
GET /api/Questions/GetQuestionById
GET /api/ResponsiblePharmacist/GetActiveResponsiblePharmacist
GET /api/ResponsiblePharmacist/GetResponsiblePharmacistList
GET /api/StaticContent/GetStaticContent
GET /api/StripePayment/Success
GET /api/TreatmentType/GetTreatmentTypeByTreatmentId
GET /api/TreatmentType/GetTreatmentTypes
GET /api/User
GET /api/User/count
GET /api/User/count-for-admin
GET /api/User/get-allusers-for-admin
GET /api/User/users
GET /api/WeightType/GetWeightType
POST /api/Admin/authenticate
POST /api/Admin/changeUserPassword
POST /api/Admin/forgotPassword
POST /api/Admin/refresh-token
POST /api/Admin/resetPassword
POST /api/Admin/revoke-token
POST /api/AgeCheck/DocVerify
POST /api/AgeCheck/Verify
POST /api/AgeCheck/callback
POST /api/Allergies/AddUpdateSingleAllergy
POST /api/Allergies/DeleteSingleAllergies
POST /api/Chat/AddChat
POST /api/Conditions/AddUpdateSingleConditions
POST /api/Conditions/DeleteSingleConditions
POST /api/Consultation/AddConsultation
POST /api/Consultation/AssignClinician
POST /api/Consultation/CreateConsultation
POST /api/Consultation/CreateOtherConsultation
POST /api/Consultation/GeneratePrescriptionByConsultationsId
POST /api/Consultation/GetConsultations
POST /api/Consultation/ProcessOtherConsultationPayment
POST /api/Consultation/UnAssignClinician
POST /api/ConsultationQuestionResponse/AddConsultationQuestionResponse
POST /api/ConsultationQuestionResponse/SaveAllQuestionAnswer
POST /api/Dropdown/AddDropdownMaster
POST /api/Dropdown/AddDropdownOptions
POST /api/Dropdown/GetDropdownOptionsByName
POST /api/GPDetail/AddUpdateGpDetail
POST /api/HomePage/AddUpdateSection
POST /api/HomePage/AddUpdateSectionOption
POST /api/LabelPrinting/PrintLabel
POST /api/MediaLibrary/DeleteImageFile
POST /api/MediaLibrary/UploadPatientFiles
POST /api/MedicalRecord/EditMedicalRecord
POST /api/Medications/AddUpdateSingleMedication
POST /api/Medications/DeleteSingleMedication
POST /api/Notes/AddNotes
POST /api/Notes/DeleteNote
POST /api/Order/AddOrderWithOrderDetail
POST /api/PatientInfo/AddPatientInfo
POST /api/PatientInfo/AddUpdatePatientInfo
POST /api/PatientInfo/ChangePassword
POST /api/PatientInfo/Register
POST /api/PatientInfo/authenticate
POST /api/PatientInfo/forgotPassword
POST /api/Plan/AddPlan
POST /api/PlanSequence/AddPlanSequence
POST /api/Prescription/AddUpdatePrescription
POST /api/Prescription/CancelPrescription
POST /api/Product/AddProduct
POST /api/Product/GetMedicinesBasedOnQuestions
POST /api/ProgressOverview/AddProgressOverview
POST /api/QuestionOption/AddQuestionOption
POST /api/Questions/AddQuestion
POST /api/ResponsiblePharmacist/SetActivePharmacist
POST /api/StripePayment/CheckoutProcess
POST /api/StripePayment/payment
POST /api/StripePayment/stripe-webhook
POST /api/User/DeleteUser
POST /api/User/disable-enable-user
POST /api/User/review-profile
PUT /api/Consultation/ChangeConsultationStatus
PUT /api/Consultation/DeclineTreatment
PUT /api/Consultation/UpdateConsultation
PUT /api/ConsultationQuestionResponse/UpdateConsultationQuestionResponse
PUT /api/Notes/UpdateNotes
PUT /api/Order/ChangeOrderStatus
PUT /api/Order/UpdateOrder
PUT /api/Order/UpdateOrderDetail
PUT /api/Order/UpdateOrderDetails
PUT /api/PatientInfo/UpdatePatientBasicInfo
PUT /api/Plan/UpdatePlan
PUT /api/PlanSequence/UpdatePlanSequence
PUT /api/Product/UpdateProduct
PUT /api/ProgressOverview/UpdateProgressOverview
PUT /api/QuestionOption/UpdateQuestionOption
PUT /api/Questions/UpdateQuestion
PUT /api/User/UpdateDigitalSignature

Found on 2026-01-10 14:39

Create report

MacOS file listing through .DS_Store file

.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS).

They store information about the files within a folder, including display options of folders, such as icon positions and view settings.

It may happen that .DS_Store files inadvertently leak filenames such as database backups or private administration panels.

IP: 20.90.134.43
Domain: opsmanager.uk
Port: 443
URL: https://opsmanager.uk

First seen 2025-05-25 20:47
Last seen 2025-12-19 07:00
Open for 207 days

Severity: medium
Fingerprint: 5f32cf5d6962f09c70ba7b5770ba7b571026a2d9fab08ebb1131ada66f90394e

Found 54 files trough .DS_Store spidering:

/assets
/assets/demo
/assets/fonts
/assets/img
/assets/pins
/core
/css
/dashboard.php
/delete_poi.php
/DigiCertGlobalRootCA.crt.pem
/do-scripts.php
/event-incident-blob-upload.php
/event-incident-details-missing-person.php
/event-incident-details.php
/event-incident-epr-blob-upload.php
/event-incident-epr.php
/event-incidents-active-my.php
/event-incidents-active.php
/event-incidents-all.php
/event-lessons-learnt.php
/event-log.php
/event-lost-property-all.php
/event-lost-property-blob-upload.php
/event-lost-property.php
/event-mapping.php
/event-radios-issue-log.php
/event-radios-issued.php
/event-resources-active.php
/event-resources-all.php
/event-task-blob-upload.php
/event-task-details.php
/event-tasks-active-my.php
/event-tasks-active.php
/event-tasks-all.php
/form.php
/index.php
/ini
/js
/login.php
/logout.php
/save_poi.php
/scripts
/site.webmanifest
/system-active-events.php
/system-dashboard.php
/system-events.php
/system-teams.php
/system-users.php
/team-assets.php
/team-events.php
/team-users.php
/update-incident-location.php
/user-password.php
/user-settings.php

Found on 2025-12-19 07:00

Severity: medium
Fingerprint: 5f32cf5d6962f09cfdf2c773fdf2c77368591245bbfb86c56d025efd5200c182

Found 50 files trough .DS_Store spidering:

/assets
/core
/css
/dashboard.php
/delete_poi.php
/DigiCertGlobalRootCA.crt.pem
/do-scripts.php
/event-incident-blob-upload.php
/event-incident-details-missing-person.php
/event-incident-details.php
/event-incident-epr-blob-upload.php
/event-incident-epr.php
/event-incidents-active-my.php
/event-incidents-active.php
/event-incidents-all.php
/event-lessons-learnt.php
/event-log.php
/event-lost-property-all.php
/event-lost-property-blob-upload.php
/event-lost-property.php
/event-mapping.php
/event-radios-issue-log.php
/event-radios-issued.php
/event-resources-active.php
/event-resources-all.php
/event-task-blob-upload.php
/event-task-details.php
/event-tasks-active-my.php
/event-tasks-active.php
/event-tasks-all.php
/form.php
/index.php
/ini
/js
/login.php
/logout.php
/save_poi.php
/scripts
/site.webmanifest
/system-active-events.php
/system-dashboard.php
/system-events.php
/system-teams.php
/system-users.php
/team-assets.php
/team-events.php
/team-users.php
/update-incident-location.php
/user-password.php
/user-settings.php

Found on 2025-11-08 09:11

Severity: medium
Fingerprint: 5f32cf5d6962f09c3b95ca2b3b95ca2b69c981fd3ccc9b2fabf661a266b1b5d2

Found 58 files trough .DS_Store spidering:

/assets
/assets/demo
/assets/fonts
/assets/img
/assets/pins
/blob-upload.php
/core
/core/cert.pem
/core/DigiCertGlobalRootCA.crt.pem
/core/footer.php
/core/header.php
/core/modals.php
/core/sidebar.php
/core/version.php
/css
/dashboard.php
/delete_poi.php
/DELETEME-pagetemplate.php
/DigiCertGlobalRootCA.crt.pem
/do-scripts.php
/event-incident-details-missing-person.php
/event-incident-details-other.php
/event-incident-details.php
/event-incidents-active-my.php
/event-incidents-active.php
/event-incidents-all.php
/event-lessons-learnt.php
/event-log.php
/event-radios-issue-log.php
/event-radios-issued.php
/event-resources-active.php
/event-resources-all.php
/event-task-details.php
/event-tasks-active.php
/event-tasks-all.php
/event-tracking.php
/form.php
/index.php
/ini
/js
/login.php
/logout.php
/phpinfo.php
/save_poi.php
/site.webmanifest
/system-active-events.php
/system-dashboard.php
/system-event-details.php
/system-events.php
/system-team-details.php
/system-teams.php
/system-users-details.php
/system-users-password.php
/system-users.php
/team-users.php
/update-incident-location.php
/user-password.php
/user-settings.php

Found on 2025-07-02 07:38

Severity: medium
Fingerprint: 5f32cf5d6962f09c93a25c3a93a25c3ae64a7656606673803a9eedeb49eb5885

Found 46 files trough .DS_Store spidering:

/assets
/assets/demo
/assets/fonts
/assets/img
/assets/pins
/blob-upload.php
/core
/css
/dashboard.php
/delete_poi.php
/DigiCertGlobalRootCA.crt.pem
/do-scripts.php
/event-incident-details.php
/event-incidents-active.php
/event-incidents-all.php
/event-lessons-learnt.php
/event-log.php
/event-radios-issue-log.php
/event-radios-issued.php
/event-resources-active.php
/event-resources-all.php
/event-task-details.php
/event-tasks-active.php
/event-tasks-all.php
/event-tracking.php
/form.php
/index.php
/ini
/js
/login.php
/logout.php
/save_poi.php
/site.webmanifest
/system-active-events.php
/system-dashboard.php
/system-event-details.php
/system-events.php
/system-team-details.php
/system-teams.php
/system-users-details.php
/system-users-password.php
/system-users.php
/team-users.php
/update-incident-location.php
/user-password.php
/user-settings.php

Found on 2025-06-20 10:05

Create report

MacOS file listing through .DS_Store file

.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS).

They store information about the files within a folder, including display options of folders, such as icon positions and view settings.

It may happen that .DS_Store files inadvertently leak filenames such as database backups or private administration panels.

IP: 20.90.134.43
Domain: dev.opsmanager.uk
Port: 443
URL: https://dev.opsmanager.uk

First seen 2025-08-10 02:17
Last seen 2025-12-18 22:09
Open for 130 days
- Severity: low
  Fingerprint: 5f32cf5d6962f09c026392ab026392ab34360f5d275c3b90850c4d046b7665c2
```
Found 7 files trough .DS_Store spidering:

/DELETE-event-incident-details-other.php
/DELETE-phpinfo.php
/DELETE-system-event-details.php
/DELETE-system-team-details.php
/DELETE-system-users-details.php
/DELETE-system-users-password.php
/DELETEME-pagetemplate.php
```
  Found on 2025-12-18 22:09
Create report

Git configuration and history exposed

The following URL (usually /.git/config) is publicly accessible and is leaking source code and repository configuration.

IP: 20.90.134.43
Domain: website-test.adrosonic.com
Port: 443
URL: https://website-test.adrosonic.com

First seen 2025-05-28 13:50
Last seen 2025-07-03 04:23
Open for 35 days

Severity: high
Fingerprint: 2580fa947178c88602b1737db148c044baa2727ab8135b5bbc521bbb8ac8fabb

[core]
	repositoryformatversion = 0
	filemode = false
	bare = false
	logallrefupdates = true
	ignorecase = true
	autocrlf = false
	preloadindex = true
[user]
	name = unknown
	email = unknown
[filter "lfs"]
	clean = git-lfs clean %f
	smudge = git-lfs smudge %f
	required = true
[receive]
	denyCurrentBranch = ignore
[credential]
	helper = !'/home/site/repository/.git/hooks/git-credential-invalid.sh'
[remote "origin"]
	url = https://tDlaLELz5yT4VJ95Dw3XGn0aooCP2k5CDICzEUjQHz9AiJLthNrlJQQJ99BGACAAAAAqYAyAAAASAZDO2Gr7:@dev.azure.com/adrosonic1/Adrosonic%20Website%20Revamp/_git/New%20Adrosonic%20Website%20Revamp
	fetch = +refs/heads/develop:refs/remotes/origin/develop

Found on 2025-07-03 04:23

670 Bytes

Severity: high
Fingerprint: 2580fa947178c88602b1737db148c044baa2727ab8135b5bbc521bbbfdd07467

[core]
	repositoryformatversion = 0
	filemode = false
	bare = false
	logallrefupdates = true
	ignorecase = true
	autocrlf = false
	preloadindex = true
[user]
	name = unknown
	email = unknown
[filter "lfs"]
	clean = git-lfs clean %f
	smudge = git-lfs smudge %f
	required = true
[receive]
	denyCurrentBranch = ignore
[credential]
	helper = !'/home/site/repository/.git/hooks/git-credential-invalid.sh'
[remote "origin"]
	url = https://1Bjx7U0eUKlW9cHy3aXrROnxlHG0ZvvB8WZCuzSrwAeK5i9hp38fJQQJ99BFACAAAAAqYAyAAAASAZDO25o1:@dev.azure.com/adrosonic1/Adrosonic%20Website%20Revamp/_git/New%20Adrosonic%20Website%20Revamp
	fetch = +refs/heads/develop:refs/remotes/origin/develop

Found on 2025-07-01 05:42

670 Bytes

Severity: high
Fingerprint: 2580fa947178c88602b1737db148c044baa2727ab8135b5bbc521bbb6480e7fe

[core]
	repositoryformatversion = 0
	filemode = false
	bare = false
	logallrefupdates = true
	ignorecase = true
	autocrlf = false
	preloadindex = true
[user]
	name = unknown
	email = unknown
[filter "lfs"]
	clean = git-lfs clean %f
	smudge = git-lfs smudge %f
	required = true
[receive]
	denyCurrentBranch = ignore
[credential]
	helper = !'/home/site/repository/.git/hooks/git-credential-invalid.sh'
[remote "origin"]
	url = https://AqtM3zWbOP230755UFHElmCHPEOiWqLZB3swTKVU2XWjyRLJEL4QJQQJ99BFACAAAAAqYAyAAAASAZDOWmyE:@dev.azure.com/adrosonic1/Adrosonic%20Website%20Revamp/_git/New%20Adrosonic%20Website%20Revamp
	fetch = +refs/heads/develop:refs/remotes/origin/develop

Found on 2025-06-26 17:28

670 Bytes

Severity: high
Fingerprint: 2580fa947178c88602b1737db148c044baa2727ab8135b5bbc521bbb53bdcd93

[core]
	repositoryformatversion = 0
	filemode = false
	bare = false
	logallrefupdates = true
	ignorecase = true
	autocrlf = false
	preloadindex = true
[user]
	name = unknown
	email = unknown
[filter "lfs"]
	clean = git-lfs clean %f
	smudge = git-lfs smudge %f
	required = true
[receive]
	denyCurrentBranch = ignore
[credential]
	helper = !'/home/site/repository/.git/hooks/git-credential-invalid.sh'
[remote "origin"]
	url = https://D9JEwhMjMi9OunMl7dFAcCsqwknZhFG66BRmJkIkKqfkWqVA8loNJQQJ99BFACAAAAAqYAyAAAASAZDO20UD:@dev.azure.com/adrosonic1/Adrosonic%20Website%20Revamp/_git/New%20Adrosonic%20Website%20Revamp
	fetch = +refs/heads/develop:refs/remotes/origin/develop

Found on 2025-06-24 18:09

670 Bytes

Severity: high
Fingerprint: 2580fa947178c88602b1737db148c044baa2727ab8135b5bbc521bbbe44ee070

[core]
	repositoryformatversion = 0
	filemode = false
	bare = false
	logallrefupdates = true
	ignorecase = true
	autocrlf = false
	preloadindex = true
[user]
	name = unknown
	email = unknown
[filter "lfs"]
	clean = git-lfs clean %f
	smudge = git-lfs smudge %f
	required = true
[receive]
	denyCurrentBranch = ignore
[credential]
	helper = !'/home/site/repository/.git/hooks/git-credential-invalid.sh'
[remote "origin"]
	url = https://4CBIPsz9BdeFKSJl5LiPsi2U59b2oS81AVnttaPdrT5nSPtXkDXjJQQJ99BFACAAAAAqYAyAAAASAZDO1vOD:@dev.azure.com/adrosonic1/Adrosonic%20Website%20Revamp/_git/New%20Adrosonic%20Website%20Revamp
	fetch = +refs/heads/develop:refs/remotes/origin/develop

Found on 2025-06-22 16:22

670 Bytes

Severity: high
Fingerprint: 2580fa947178c88602b1737db148c044baa2727ab8135b5bbc521bbbcbf91ddc

[core]
	repositoryformatversion = 0
	filemode = false
	bare = false
	logallrefupdates = true
	ignorecase = true
	autocrlf = false
	preloadindex = true
[user]
	name = unknown
	email = unknown
[filter "lfs"]
	clean = git-lfs clean %f
	smudge = git-lfs smudge %f
	required = true
[receive]
	denyCurrentBranch = ignore
[credential]
	helper = !'/home/site/repository/.git/hooks/git-credential-invalid.sh'
[remote "origin"]
	url = https://58gZRZ2G1kWGXp5MzmlT2Q8ns3EKct9uWr6eLbnxZXzEotI8IGC7JQQJ99BFACAAAAAqYAyAAAASAZDO3eQR:@dev.azure.com/adrosonic1/Adrosonic%20Website%20Revamp/_git/New%20Adrosonic%20Website%20Revamp
	fetch = +refs/heads/develop:refs/remotes/origin/develop

Found on 2025-06-20 01:14

670 Bytes

Severity: high
Fingerprint: 2580fa947178c88602b1737db148c044baa2727ab8135b5bbc521bbb4d819954

[core]
	repositoryformatversion = 0
	filemode = false
	bare = false
	logallrefupdates = true
	ignorecase = true
[remote "origin"]
	url = https://adrosonic1@dev.azure.com/adrosonic1/Adrosonic%20Website%20Revamp/_git/New%20Adrosonic%20Website%20Revamp
	fetch = +refs/heads/*:refs/remotes/origin/*

Found on 2025-06-16 18:36

295 Bytes

Create report

Open service 20.90.134.43:80 · openlearn-lite.open.ac.uk

2026-02-11 03:42

HTTP/1.1 301 Moved Permanently
Content-Length: 0
Connection: close
Date: Wed, 11 Feb 2026 03:42:46 GMT
Location: https://openlearn-lite.open.ac.uk/

Found one day ago by HttpPlugin

Host 20.90.134.43

United Kingdom

Software information

GraphQL introspection is enabled.

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

Swagger API description is publicly available

GraphQL introspection is enabled.

Swagger API description is publicly available

MacOS file listing through .DS_Store file

MacOS file listing through .DS_Store file

Git configuration and history exposed