================================================================ ALBANIA — COMPLETE FINDINGS REPORT Campaign: Albanian AI / AKSHI / Parliament / Gov Recon Updated: 2026-02-25 Targets: AKSHI (e-Albania AI), Albanian Parliament, .gov.al Total Findings: 4 major exposures Total Data Dumped: ~251 MB (1309 files) ================================================================ ================================================================ FINDING 01: Albanian Parliament — API + Blob Storage ================================================================ Severity: HIGH Status: FULLY OPEN (no authentication required) 1a. Parliament API (kuvendiapi.azurewebsites.net) Platform: ASP.NET OData API on Azure Web App Base URL: https://kuvendiapi.azurewebsites.net/api Open Endpoints (no auth): /anetaret 236 MP records (names, emails, birthdays, parties, photos) /strukturat Parliamentary committees and structures /aktet Legislative acts, interpellations (3.1 MB) /lajmet Parliamentary news articles (19.8 MB) /mbledhjet Session/meeting records (2.2 MB) /dokumentet Document catalog with blob URLs (30.2 MB) /YouTube/search YouTube video search proxy Protected Endpoints: /abonimet 401 Unauthorized (subscription/mailing list) OData Support: $filter, $orderby supported on all endpoints Example: /anetaret?$filter=status eq 'Aktiv'&$orderby=emer MP Data Fields Exposed: - Full name (emer, atesi/father's name, mbiemer/surname) - Date of birth (ditlindje) - Place of birth (vendlindje) - Email (@parlament.al) - Electoral district (qarku) - Political party (partia) - Profile photo URL (fotoProfil) - Social media (fbProfileUrl, twitterProfileUrl, linkedInPrifileUrl) - Status (active/inactive) 1b. Azure Blob Storage (kuvendiwebfiles.blob.core.windows.net) Container: /webfiles/ Container listing: DISABLED (ResourceNotFound) Individual blob access: PUBLIC (no auth) Total unique document URLs found: 54,545 Document Types: PDF: 32,627 files JPEG: 9,831 files JPG: 8,458 files JFIF: 1,768 files DOCX: 885 files (709 downloaded) DOC: 397 files XLSX: 392 files (181 downloaded) PNG: 208 files XLS: 117 files GIF: 34 files Key XLSX Content (MP Salary & Benefits): - Monthly MP salary spreadsheets (PAGA DEPUTETE) 2018-2020 - Monthly MP benefits spreadsheets (PERFITIME DEPUTETE) 2018-2020 - Lobbyist registry (Regjistri elektronik i Lobisteve) - OSHC (Civil Society Organizations) registry - FOIA request/response logs 2018-2021 - Budget expenditure tables by government function - Reserve fund analytical tables Key PDF Content: - Albanian Constitution (kushtetuta.pdf) - Electoral Code (kodi zgjedhor.pdf) - Deputy Status Law - Parliamentary Rules of Procedure - Annual Reports 2013-2019 - Organizational Chart (organigrama.PNG) - Code of Conduct - Media Accreditation Rules - Whistleblower Forms - Labor Code 1c. Internal References Found in JS Bundle: Internal API: http://134.0.63.165:5000/public (unreachable) YouTube proxy: kuvendiapi.azurewebsites.net/api/YouTube/search ================================================================ FINDING 02: Diella AI Chatbot (AKSHI) ================================================================ Severity: LOW Status: LIVE (limited exposure) Platform: Vue.js/Quasar frontend on Azure Static Web App URL: https://proud-coast-026495803.4.azurestaticapps.net Organization: AKSHI (National Agency for Information Society) Exposures: - Frontend source (229 KB JS bundle) — clean, no API keys - Azure Static Web App auth endpoint: /.auth/me returns {"clientPrincipal": null} - Azure AD login: /.auth/login/aad returns 302 redirect - VUE_APP_ variables: only styling configs (colors, fonts) - API keys/endpoints NOT in frontend — injected at runtime via Azure backend e-Albania API Endpoints (from prior research): - diella-chatbot-api-prod.azurewebsites.net — requires auth - dc-hasura.akshi.gov.al — internal only (DOWN) - dc-keycloak.akshi.gov.al — internal only (DOWN) - dc-hapi.akshi.gov.al — internal only (DOWN) - dc-abb.akshi.gov.al — internal only (DOWN) ================================================================ FINDING 03: AKSHI Subdomain Expansion ================================================================ Severity: INFORMATIONAL Status: LIVE (infrastructure mapping) 110 subdomains enumerated via crt.sh (up from 50 in January 2026) New subdomains found (not in prior research): - jira.akshi.gov.al (internal — DOWN) - rancher.akshi.gov.al (internal — DOWN) - wiki.akshi.gov.al (internal — DOWN) - internal.akshi.gov.al (DOWN) - test.akshi.gov.al (DOWN) - test2.akshi.gov.al (DOWN) - stats.akshi.gov.al (DOWN) Live subdomains checked: - esign.akshi.gov.al — Incapsula WAF (403) - eform.akshi.gov.al — Default IIS page - ams.akshi.gov.al — 403 Forbidden Most new subdomains are internal-only (no public DNS resolution). ================================================================ FINDING 04: Open Data Portal (opendata.gov.al) — NEW ================================================================ Severity: MEDIUM Status: FULLY OPEN (public API by design) Platform: Angular SPA with ASP.NET backend URL: https://opendata.gov.al API Spec: https://opendata.gov.al/api/specification.json (200 KB OpenAPI spec) API Endpoints (59 total, all unauthenticated): /api/Dataset/filter POST — search/filter all datasets /api/Dataset/get/{slug} GET — dataset details with download URLs /api/Institution GET — government institution directory /api/DcatCategory GET — dataset categories /api/Treasure/{date}/csv GET — daily treasury data /api/PublicInvestments/{month}/csv GET — monthly public investment data /api/OpenDataDocument GET — portal documents /api/Questionnaire GET — survey data + 50 more endpoints Datasets Available (10 published): 1. National Debt Registry 2024 (4 quarterly XLSX — hosted on financa.gov.al) 2. Treasury Data (900 daily distributions, XML/CSV, 2025) 3. Health Centers List (400 centers, CSV/JSON) 4. Pharmacies/Medicines List (2,289 records, CSV/JSON) 5. Business Registry by Legal Form 2025-2026 (JSON/CSV) 6. Business Registry by Ownership 2025-2026 (JSON/CSV) 7. Business Registry by Region 2025-2026 (JSON/CSV) 8. Public Investments (monthly, 12 distributions) 9. e-Albania Portal Statistics 2023 (14 monthly reports) 10. e-Albania User Registration Stats 2013-2024 11. Airport Mail Flow TIA 2025 Government Institutions in Directory: - AKSHI (info@akshi.gov.al) - Ministria e Financave (info@financa.gov.al) - Ministria e Arsimit (education) - Qendra Kombetare e Biznesit (National Business Center) - Autoriteti i Aviacionit Civil (Civil Aviation) ================================================================ ADDITIONAL INTELLIGENCE ================================================================ Albanian Parliament Infrastructure: - parlament.al — React SPA (catch-all router, returns HTML for all paths) - kuvendiapi.azurewebsites.net — Backend API (Azure) - kuvendiwebfiles.blob.core.windows.net — Document storage (Azure) - YouTube channel: Kuvendi i Shqiperise (videos accessible via API proxy) Albanian Government Domains Scanned (17 domains): instat.gov.al — 404 (clean) dpshtrr.gov.al — 415 Unsupported Media Type pp.gov.al — DOWN (prosecution) klsh.org.al — 401 on WP users (hardened WordPress) bankofalbania.org — 403 (locked down) arsimi.gov.al — Incapsula WAF drejtesia.gov.al — Incapsula WAF financat.gov.al — DOWN mbrojtja.gov.al — DOWN (defense) policia.al — DOWN president.al — 403 (locked down) kryeministria.al — Incapsula WAF dogana.gov.al — DOWN (customs) tatime.gov.al — DOWN (tax) ere.gov.al — 301 redirect akep.al — 403/404 (telecom regulator) qbz.gov.al — Angular SPA catch-all (false positive) GIS Portals Found (via crt.sh, 832 .gov.al domains): - geoportal.asig.gov.al — HTTP 200 (ASIG geoportal) - instatgis.gov.al — LIVE (INSTAT WebGIS, ExperienceBuilder) - webgis.arrsh.gov.al — LIVE (Road Authority, requires login) - webgis.atp.gov.al — LIVE (ATP Territorial Planning) - admin.drshdurres.gov.al — DOWN - admin.qnk.gov.al — DOWN Key People Identified: - 236 Albanian Members of Parliament (full PII in anetaret.json) - All with @parlament.al email addresses - Political party affiliations, birth dates, electoral districts - Profile photos on Azure Blob Storage ================================================================ DATA INVENTORY ================================================================ /Albanian AI/DUMP/ 251 MB total (1309 files) ALBANIA-COMPLETE-FINDINGS.txt This file WRITEUP-Parliament-API-Exposure.md Discovery writeup article aibot-frontend.html Diella AI frontend HTML source aibot-bundle.js 229 KB Vue.js/Quasar frontend bundle parlament-main.js 355 KB Parliament React main bundle parlament-vendor.js 1015 KB Parliament React vendor bundle blob-docx-urls.txt 141 KB 885 DOCX blob URLs blob-xlsx-urls.txt 47 KB 392 XLSX blob URLs parlament-api/ 103 MB Parliament API dumps (14 files) anetaret.json 138 KB 236 MP records (full PII) anetaret_active.json 81 KB Active MPs only strukturat.json 274 KB Parliamentary committees strukturat_active.json 158 KB Active structures only aktet.json 3.0 MB Legislative acts aktet_active.json 2.3 KB Active acts only lajmet.json 19 MB Parliamentary news lajmet_active.json 19 MB Active news only mbledhjet.json 2.1 MB Meeting/session records mbledhjet_active.json 2.1 MB Active meetings only dokumentet.json 29 MB Document catalog (54,545 URLs) dokumentet_active.json 29 MB Active documents only youtube-search.json 8.0 KB YouTube search results mp-email-list.txt 24 KB Extracted MP email directory parlament-docs/ 20 MB 25 priority PDF/DOC/PNG documents Albanian Constitution, Electoral Code, Deputy Status Law, Organizational Chart, Annual Reports 2013-2019, Code of Conduct, Labor Code, Media Rules + more parlament-xlsx/ 44 MB 372 spreadsheets MP salary sheets (PAGA DEPUTETE) monthly 2018-2020 MP benefits sheets (PERFITIME DEPUTETE) monthly 2018-2020 Lobbyist registry, OSHC registry FOIA request/response logs 2018-2021 Budget expenditure tables, Reserve fund tables parlament-docx/ 73 MB 837 Word documents Parliamentary legislation, committee reports, session transcripts, and official correspondence opendata-gov/ 5.2 MB Open Data Portal (52 files) specification.json 200 KB Full OpenAPI spec (59 endpoints) institutions.json 6.4 KB Government institution directory all-datasets.json 80 KB Complete dataset catalog debt-registry-2024.json Dataset metadata (files on financa.gov.al — blocked) treasury.json Dataset metadata (900 distributions) health-centers.json Dataset metadata downloads/ Downloaded data files health-centers.json 103 KB 400 health centers health-centers.csv 26 KB Same in CSV pharmacies.json 539 KB 2,289 pharmaceutical records pharmacies.csv 353 KB Same in CSV business-*.json Business registry 2025-2026 (6 files) public-investments-*.csv Monthly public investment data treasury/ Daily treasury CSVs (8 dates) e-albania-users-2013-2024.* User registration statistics e-albania-stats-2023.* Portal usage statistics e-albania-report-*-2023.xlsx 12 monthly e-Albania reports airport-mail-flow-2025.* TIA airport mail statistics ================================================================ STATS ================================================================ Parliament API endpoints open: 7 Parliament API endpoints auth: 1 MP records with full PII: 236 MP email addresses: 236 Azure Blob document URLs: 54,545 Blob storage PDFs: 32,627 Blob storage images: 20,299 Blob storage XLSX downloaded: 372 of 392 Blob storage DOCX downloaded: 837 of 885 Parliament docs downloaded: 25 priority PDFs Open Data Portal API endpoints: 59 Open Data Portal datasets: 10+ Health centers: 400 Pharmaceutical records: 2,289 Treasury data distributions: 900 e-Albania monthly reports: 12 AKSHI subdomains enumerated: 110 Albanian .gov.al domains in crt.sh: 832 GIS portals found: 4 (ASIG, INSTAT, ARRSH, ATP) Gov domains scanned: 17 YouTube videos accessible: Yes (via API proxy) Total data dumped: ~251 MB Total files: 1309 ================================================================ PRIOR RESEARCH (January 2026) ================================================================ From FINDINGS/OSINT_REPORT.md and infrastructure.txt: - Diella AI system architecture mapped - AKSHI infrastructure: Keycloak, Hasura, HAPI (all internal) - e-Albania portal integration documented - Azure tenant: akshial.onmicrosoft.com - dc-* subdomains enumerated (all internal-only) - No credentials or API keys recovered from frontend ================================================================ Generated 2026-02-25 All data recovered from publicly accessible API endpoints and unauthenticated Azure Blob Storage URLs. ================================================================