LeakIX - Host 40.76.5.137

Host 40.76.5.137

United States

MICROSOFT-CORP-MSN-AS-BLOCK

Software information

Microsoft-IIS 10.0

tcp/443 tcp/80

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 40.76.5.137
Domain: demo-everifyapi.onblick.com
Port: 443
URL: https://demo-everifyapi.onblick.com

First seen 2025-12-27 13:05
Last seen 2026-02-02 08:08
Open for 36 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-02-02 08:08
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 40.76.5.137
Domain: demoapi.onblick.com
Port: 443
URL: https://demoapi.onblick.com

First seen 2025-12-27 12:42
Last seen 2026-02-02 06:09
Open for 36 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-02-02 06:09
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 40.76.5.137
Domain: demomail.onblick.com
Port: 443
URL: https://demomail.onblick.com

First seen 2025-12-27 12:46
Last seen 2026-02-02 06:09
Open for 36 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-02-02 06:09
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 40.76.5.137
Domain: demoesign.onblick.com
Port: 443
URL: https://demoesign.onblick.com

First seen 2025-12-27 12:45
Last seen 2026-02-02 01:57
Open for 36 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
```
Public Swagger UI/API detected at path: /swagger/index.html
```
  Found on 2026-02-02 01:57
Create report
Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 40.76.5.137
Domain: qa-pwdirbacusersync.bentley.com
Port: 443
URL: https://qa-pwdirbacusersync.bentley.com

First seen 2026-01-04 00:05
Last seen 2026-01-24 06:44
Open for 20 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1f5e22fb44a78b7e2bfe1c62a8663b3cb631c15827c589a98
```
Public Swagger UI/API detected at path: /api/swagger.json - sample paths:
GET /v1/fetch-snapshot/{projectId}/history/{historyId}
GET /v1/project/{projectId}/history
GET /v1/project/{projectId}/history/{syncId}
GET /v1/project/{projectId}/sync
GET /v1/project/{projectId}/sync/{syncId}
GET /v1/settings/syncconfig
GET /v1/status/{date}/failures
GET /v1/status/{date}/report
GET /v1/status/{date}/success
GET /v1/user-delta/{projectId}
POST /v1/project/{projectId}/sync/{connectionId}
POST /v1/project/{projectId}/sync/{syncId}/disable
POST /v1/project/{projectId}/sync/{syncId}/enable
POST /v1/project/{projectId}/sync/{syncId}/start
POST /v1/project/{projectId}/sync/{syncId}/take-ownership
```
  Found on 2026-01-24 06:44
Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 40.76.5.137
Domain: stg-admin-analytics.tymetrix360.com
Port: 443
URL: https://stg-admin-analytics.tymetrix360.com

First seen 2025-12-25 06:08
Last seen 2026-01-23 02:29
Open for 28 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad0354961bf092eed178b3f551ca9ab4d647e0f862799b3

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
DELETE /groups/{groupId}
DELETE /tenant/{tenantId}/unassign
DELETE /tenants/{tenantId}/pbiUsers/{userIdentifier}
DELETE /users/assets/{assetId}/users/{userId}
DELETE /users/{userId}/roles/revoke
GET /branding
GET /capacities
GET /capacities/skus
GET /configuration
GET /folders
GET /groups/{groupId}/assets
GET /groups/{groupId}/users
GET /resourceGroupCapacities/Embed
GET /resourceGroupCapacities/Fabric
GET /roles
GET /stagedUsers
GET /tenants
GET /tenants/onboard/available
GET /tenants/{tenantId}
GET /tenants/{tenantId}/assets
GET /tenants/{tenantId}/bind
GET /tenants/{tenantId}/groups
GET /tenants/{tenantId}/groups/{groupId}
GET /tenants/{tenantId}/onboard/name/{tenantName}/availability
GET /tenants/{tenantId}/onboard/users/details
GET /tenants/{tenantId}/pbiUsers
GET /tenants/{tenantId}/reports/{reportId}/bind
GET /tenants/{tenantId}/roles
GET /tenants/{tenantId}/update/name/{tenantName}/availability
GET /tenants/{tenantId}/users
GET /themes
GET /themes/{themeId}
GET /users
GET /users/{userId}
PATCH /capacities/updateCapacity
PATCH /tenants/{tenantId}/groups/{groupId}/assets/{assetId}
PATCH /tenants/{tenantId}/themes/default
POST /capacities/pauseCapacity
POST /capacities/startCapacity
POST /cleanup
POST /tenant/{tenantId}/assign/{capacityId}
POST /tenants/onboard
POST /tenants/refreshCapacities
POST /tenants/reports/{reportId}/reportTemplate
POST /tenants/{tenantId}/groups/{groupId}/assets
POST /tenants/{tenantId}/groups/{groupId}/users
POST /tenants/{tenantId}/refresh/{datasetId}
POST /tenants/{tenantId}/refreshAssets
POST /tenants/{tenantId}/refreshCapacity
POST /tenants/{tenantId}/themes/assign
POST /tenants/{tenantId}/themes/unassign
POST /tenants/{tenantId}/users/onboard
POST /tenants/{tenantId}/users/{userId}/roles
POST /themes/{themeId}/duplicate
POST /trace
POST /users/{userId}/roles/assign
PUT /reset
PUT /roles/{roleId}
PUT /stagedUsers/{userId}
PUT /users/assets/userId/{userId}

Found on 2026-01-23 02:29

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 40.76.5.137
Domain: stg-user-analytics.tymetrix360.com
Port: 443
URL: https://stg-user-analytics.tymetrix360.com

First seen 2025-12-25 06:24
Last seen 2026-01-23 00:21
Open for 28 days

Severity: info
Fingerprint: 5733ddf49ff49cd1aad035496d7a13db3dd750fd48ec12df08facf1f2b829600

Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
DELETE /reports/{reportId}/bookmarks/removeSpecificUsers
DELETE /reports/{reportId}/unshare
GET /assets
GET /branding
GET /configuration
GET /dashboards
GET /dashboards/{dashboardId}
GET /datasets
GET /datasets/{datasetId}
GET /exportHistory
GET /reports
GET /reports/shared
GET /reports/{reportId}
GET /reports/{reportId}/bookmarks
GET /reports/{reportId}/bookmarks/{bookmarkId}
GET /reports/{reportId}/bookmarks/{reportBookmarkId}/getSpecificUsers
GET /reports/{reportId}/shared-with
GET /reports/{reportId}/subscriptions
GET /stagedUsers/all
GET /stagedUsers/by-email
GET /tenants/{tenantId}/themes
GET /tenants/{tenantId}/themes/{themeId}
GET /userDetail
GET /userSubscriptions
GET /workspace/{workspaceId}/dataset/{datasetId}/datasetSchema
GET /workspace/{workspaceId}/dataset/{datasetId}/permissions
PATCH /users/me/preferences
POST /assetsWithEmbedToken
POST /dashboards/generateEmbedToken
POST /datasets/generateEmbedTokenForCreate
POST /downloadFile
POST /downloadFile/{fileName}
POST /export
POST /exportStatus
POST /reports/generateEmbedToken
POST /reports/{reportId}/bookmarks/shareWithSpecificUsers
POST /reports/{reportId}/parameters
POST /reports/{reportId}/save
POST /reports/{reportId}/share
POST /sendemail/{reportSubscriptionId}
POST /visualExport
POST /workspace/{workspaceId}/dataset/{datasetId}/column
POST /workspace/{workspaceId}/dataset/{datasetId}/columns/generateDax
POST /workspace/{workspaceId}/dataset/{datasetId}/executeDax
POST /workspace/{workspaceId}/dataset/{datasetId}/measure
POST /workspace/{workspaceId}/dataset/{datasetId}/measures/generateDax
POST /workspace/{workspaceId}/dataset/{datasetId}/relationship
POST /workspace/{workspaceId}/dataset/{datasetId}/table
POST /workspace/{workspaceId}/dataset/{datasetId}/table/generateDax
PUT /assets/assetDescription
PUT /reports/{reportId}/subscriptions/{reportSubscriptionId}

Found on 2026-01-23 00:21

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 40.76.5.137
Domain: dev-towersightbff-eus-staging.bentley.com
Port: 443
URL: https://dev-towersightbff-eus-staging.bentley.com

First seen 2025-11-14 11:59
Last seen 2026-01-05 08:27
Open for 51 days
- Severity: info
  Fingerprint: 5733ddf49ff49cd1aad03549d4866420d4866420d4866420d4866420d4866420
```
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /graphql/HealthCheck
```
  Found on 2026-01-05 08:27
Create report

Open service 40.76.5.137:80 · www.presentedbynexus.com

2026-02-04 07:26

HTTP/1.1 301 Moved Permanently
Content-Length: 0
Connection: close
Date: Wed, 04 Feb 2026 07:26:48 GMT
Location: https://www.presentedbynexus.com/

Found 2026-02-04 by HttpPlugin