================================================================================
BURKINA FASO - BANKING / TELECOM / ENTERPRISE PROBE RESULTS
Date: 2026-03-04
Methodology: curl -s --connect-timeout 10 --max-time 20 -L
Tests: Headers, WP-JSON, API paths, robots.txt, Joomla, admin panels, config leaks
================================================================================


########################################################################
#                    BANKING / FINANCE TARGETS                         #
########################################################################

================================================================================
TARGET: BICIA-B Bank (bicia.bf)
DOMAIN: bicia.bf
Probed: 2026-03-04 01:59:38
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://bicia.bf/
  [No response from https://bicia.bf]
  Trying: http://bicia.bf/
  [No response from http://bicia.bf]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

================================================================================
TARGET: BICIA-B Bank (biciab.bf)
DOMAIN: biciab.bf
Probed: 2026-03-04 01:59:38
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://biciab.bf/
  [No response from https://biciab.bf]
  Trying: http://biciab.bf/
  [No response from http://biciab.bf]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

================================================================================
TARGET: Coris Bank (coris-bank.com)
DOMAIN: coris-bank.com
Probed: 2026-03-04 01:59:39
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://coris-bank.com/
  [No response from https://coris-bank.com]
  Trying: http://coris-bank.com/
  [No response from http://coris-bank.com]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

================================================================================
TARGET: Coris Bank (corisbank.bf)
DOMAIN: corisbank.bf
Probed: 2026-03-04 01:59:40
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://corisbank.bf/
  [No response from https://corisbank.bf]
  Trying: http://corisbank.bf/
  [No response from http://corisbank.bf]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

================================================================================
TARGET: Ecobank (ecobank.com)
DOMAIN: ecobank.com
Probed: 2026-03-04 01:59:41
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://ecobank.com/
HTTP/1.1 302 Found
Cache-Control: private
Content-Length: 134
Content-Type: text/html; charset=utf-8
Expires: Thu, 04 Mar 2027 06:58:42 GMT
Location: /personal-banking
content-security-policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://unpkg.com https://www.gstatic.com *.googleapis.com *.cloudflare.com https://cdn-eu.dynamicyield.com https://maxcdn.bootstrapcdn.com *.dynamicyield.com; font-src 'self' *.gstatic.com data: https://cdn-eu.dynamicyield.com  *.dynamicyield.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net/npm/alpinejs@3.x.x/dist/cdn.min.js https://embed.proto.cx *.googleadservices.com https://app.proto.cx https://www.googletagmanager.com https://unpkg.com https://ecobank-prod.custhelp.com https://az416426.vo.msecnd.net https://googleads.g.doubleclick.net https://static.site24x7rum.com *.google.com *.googletagmanager.com *.google-analytics.com *.google.ru https://static.hotjar.com https://script.hotjar.com https://bid.g.doubleclick.net https://googleads.g.doubleclick.net https://az416426.vo.msecnd.net *.googleapis.com *.googleadservices.com *.gstatic.com *.cloudflare.com http://*.matchingnotes.com http://matchingnotes.com *.facebook.net *.twitter.com http://st-eu.dynamicyield.com/st http://cdn-eu.dynamicyield.com http://async-px-eu.dynamicyield.com http://r.rrzb.ru http://p.2ad.wtf/ad/base.js *.dynamicyield.com; connect-src 'self' https://v3-api.proto.cx https://fonts.gstatic.com https://secure.ecobank.com/ContentHandler.ashx https://api.proto.cx *.visualstudio.com https://www.googletagmanager.com https://insights.hotjar.com *.google-analytics.com *.googleapis.com https://stats.g.doubleclick.net https://analytics.google.com http://async-px-eu.dynamicyield.com https://adm.dynamicyield.eu http://st-eu.dynamicyield.com *.dynamicyield.com *.analytics.google.com; img-src 'self' *.cdninstagram.com *.fbcdn.net *.tile.osm.org *.gstatic.com *.googleapis.com *.google.ie *.google.com *.google.ru *.google-analytics.com https://googleads.g.doubleclick.net https://stats.g.doubleclick.net https://www.googletagmanager.com *.facebook.com *.twitter.com *.openstreetmap.org data: http://dmg.digitaltarget.ru  *.dynamicyield.com *.google.de; frame-src 'self' data: https://frame.proto.cx https://simple-website-rv2.eu-de.mybluemix.net/ https://app.proto.cx/ https://rafikiv5.eu-gb.mybluemix.net/ https://rafikiv2.eu-gb.mybluemix.net/ https://ice.ecobank.com/ https://digitalonline.ecobank.com/ https://player.vimeo.com/ https://bid.g.doubleclick.net/ https://www.executiveinterviews.com/ https://ecobank-prod.custhelp.com https://vars.hotjar.com https://youtu.be/ *.google.com *.youtube.com *.facebook.com *.twitter.com;
x-permitted-cross-domain-policies: master-only
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Origin: https://edctradingportal.ecobank.com
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=18144000; includeSubDomains
X-Content-Type-Options: nosniff
Access-Control-Allow-Methods: POST, GET, OPTIONS
Request-Context: appId=cid-v1:a90fd4a1-70b1-4001-b6ed-6ec8e120f82a
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg=';pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec=';pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg=';includeSubdomains; max-age=2592000
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
SERVER: 
Date: Wed, 04 Mar 2026 06:58:42 GMT

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 1412066
Content-Type: text/html; charset=utf-8
Expires: -1
Set-Cookie: ASP.NET_SessionId=vflyuismhyje0u5uxtvt3m0g; path=/; secure; HttpOnly; SameSite=Lax
Set-Cookie: theme=default; expires=Thu, 04-Mar-2027 06:58:42 GMT; path=/; secure; HttpOnly
content-security-policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://unpkg.com https://www.gstatic.com *.googleapis.com *.cloudflare.com https://cdn-eu.dynamicyield.com https://maxcdn.bootstrapcdn.com *.dynamicyield.com; font-src 'self' *.gstatic.com data: https://cdn-eu.dynamicyield.com  *.dynamicyield.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net/npm/alpinejs@3.x.x/dist/cdn.min.js https://embed.proto.cx *.googleadservices.com https://app.proto.cx https://www.googletagmanager.com https://unpkg.com https://ecobank-prod.custhelp.com https://az416426.vo.msecnd.net https://googleads.g.doubleclick.net https://static.site24x7rum.com *.google.com *.googletagmanager.com *.google-analytics.com *.google.ru https://static.hotjar.com https://script.hotjar.com https://bid.g.doubleclick.net https://googleads.g.doubleclick.net https://az416426.vo.msecnd.net *.googleapis.com *.googleadservices.com *.gstatic.com *.cloudflare.com http://*.matchingnotes.com http://matchingnotes.com *.facebook.net *.twitter.com http://st-eu.dynamicyield.com/st http://cdn-eu.dynamicyield.com http://async-px-eu.dynamicyield.com http://r.rrzb.ru http://p.2ad.wtf/ad/base.js *.dynamicyield.com; connect-src 'self' https://v3-api.proto.cx https://fonts.gstatic.com https://secure.ecobank.com/ContentHandler.ashx https://api.proto.cx *.visualstudio.com https://www.googletagmanager.com https://insights.hotjar.com *.google-analytics.com *.googleapis.com https://stats.g.doubleclick.net https://analytics.google.com http://async-px-eu.dynamicyield.com https://adm.dynamicyield.eu http://st-eu.dynamicyield.com *.dynamicyield.com *.analytics.google.com; img-src 'self' *.cdninstagram.com *.fbcdn.net *.tile.osm.org *.gstatic.com *.googleapis.com *.google.ie *.google.com *.google.ru *.google-analytics.com https://googleads.g.doubleclick.net https://stats.g.doubleclick.net https://www.googletagmanager.com *.facebook.com *.twitter.com *.openstreetmap.org data: http://dmg.digitaltarget.ru  *.dynamicyield.com *.google.de; frame-src 'self' data: https://frame.proto.cx https://simple-website-rv2.eu-de.mybluemix.net/ https://app.proto.cx/ https://rafikiv5.eu-gb.mybluemix.net/ https://rafikiv2.eu-gb.mybluemix.net/ https://ice.ecobank.com/ https://digitalonline.ecobank.com/ https://player.vimeo.com/ https://bid.g.doubleclick.net/ https://www.executiveinterviews.com/ https://ecobank-prod.custhelp.com https://vars.hotjar.com https://youtu.be/ *.google.com *.youtube.com *.facebook.com *.twitter.com;
x-permitted-cross-domain-policies: master-only
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Origin: https://edctradingportal.ecobank.com
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=18144000; includeSubDomains
X-Content-Type-Options: nosniff
Access-Control-Allow-Methods: POST, GET, OPTIONS
Request-Context: appId=cid-v1:a90fd4a1-70b1-4001-b6ed-6ec8e120f82a
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg=';pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec=';pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg=';includeSubdomains; max-age=2592000
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
SERVER: 
Date: Wed, 04 Mar 2026 06:58:42 GMT
  >> SERVER: SERVER: 

--- [2] WORDPRESS API (wp-json) ---
  *** WORDPRESS API DETECTED ***


<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr">
<head><meta charset="utf-8" /><meta http-equiv="x-ua-compatible" content="ie=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" /><meta property="fb:app_id" content="1004553932967992" /><meta property="og:type" content="website" /><meta property="og:url" /><meta property="og:title" /><meta property="og:image" content="https://ecobank.com/img/eco/eco_logo_blue.jpg" /><meta content="A regional commercial bank operating in many African countries." name="description" /><meta property="og:description" content="A regional commercial bank operating in many African countries." /><meta name="twitter:card" content="summary" /><meta name="twitter:site

--- [3] COMMON API PATHS ---
  /api/ -> HTTP 200 Location: /api
  Body preview: 

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr">
<head><meta charset="utf-8" /><meta http-equiv="x-ua-compatible" content="ie=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" /><meta property="fb:app_id" content="1004553932967992" /><meta property="og:type" content="website" /><meta property="og:url" /><meta property="og:title" /><meta property="og:image" content="https://ecobank.com/img/eco/
  /api/v1/ -> HTTP 200 Location: /api/v1
  Body preview: 

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr">
<head><meta charset="utf-8" /><meta http-equiv="x-ua-compatible" content="ie=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" /><meta property="fb:app_id" content="1004553932967992" /><meta property="og:type" content="website" /><meta property="og:url" /><meta property="og:title" /><meta property="og:image" content="https://ecobank.com/img/eco/
  /api/v2/ -> HTTP 200 Location: /api/v2
  Body preview: 

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr">
<head><meta charset="utf-8" /><meta http-equiv="x-ua-compatible" content="ie=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" /><meta property="fb:app_id" content="1004553932967992" /><meta property="og:type" content="website" /><meta property="og:url" /><meta property="og:title" /><meta property="og:image" content="https://ecobank.com/img/eco/
  /graphql -> HTTP 200 Location: /
  Body preview: 

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr">
<head><meta charset="utf-8" /><meta http-equiv="x-ua-compatible" content="ie=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" /><meta property="fb:app_id" content="1004553932967992" /><meta property="og:type" content="website" /><meta property="og:url" /><meta property="og:title" /><meta property="og:image" content="https://ecobank.com/img/eco/
  /swagger -> HTTP 200 Location: /
  Body preview: 

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr">
<head><meta charset="utf-8" /><meta http-equiv="x-ua-compatible" content="ie=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" /><meta property="fb:app_id" content="1004553932967992" /><meta property="og:type" content="website" /><meta property="og:url" /><meta property="og:title" /><meta property="og:image" content="https://ecobank.com/img/eco/
  /swagger-ui/ -> HTTP 200 Location: /swagger-ui
  Body preview: 

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr">
<head><meta charset="utf-8" /><meta http-equiv="x-ua-compatible" content="ie=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" /><meta property="fb:app_id" content="1004553932967992" /><meta property="og:type" content="website" /><meta property="og:url" /><meta property="og:title" /><meta property="og:image" content="https://ecobank.com/img/eco/
  /api-docs -> HTTP 200 Location: /
  Body preview: 

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr">
<head><meta charset="utf-8" /><meta http-equiv="x-ua-compatible" content="ie=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" /><meta property="fb:app_id" content="1004553932967992" /><meta property="og:type" content="website" /><meta property="og:url" /><meta property="og:title" /><meta property="og:image" content="https://ecobank.com/img/eco/
  /v1/ -> HTTP 200 Location: /v1
  Body preview: 

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr">
<head><meta charset="utf-8" /><meta http-equiv="x-ua-compatible" content="ie=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" /><meta property="fb:app_id" content="1004553932967992" /><meta property="og:type" content="website" /><meta property="og:url" /><meta property="og:title" /><meta property="og:image" content="https://ecobank.com/img/eco/
  /v2/ -> HTTP 200 Location: /v2
  Body preview: 

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr">
<head><meta charset="utf-8" /><meta http-equiv="x-ua-compatible" content="ie=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" /><meta property="fb:app_id" content="1004553932967992" /><meta property="og:type" content="website" /><meta property="og:url" /><meta property="og:title" /><meta property="og:image" content="https://ecobank.com/img/eco/
  /rest/ -> HTTP 200 Location: /rest
  Body preview: 

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr">
<head><meta charset="utf-8" /><meta http-equiv="x-ua-compatible" content="ie=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" /><meta property="fb:app_id" content="1004553932967992" /><meta property="og:type" content="website" /><meta property="og:url" /><meta property="og:title" /><meta property="og:image" content="https://ecobank.com/img/eco/

--- [4] ROBOTS.TXT ---
User-agent: *
Disallow: /js/
Disallow: /WebResource.axd
Disallow: /upload/
Disallow: /ScriptResource.axd
Allow: /upload/publication/unitlife/
Crawl-delay: 10
Host: www.ecobank.com

--- [5] JOOMLA API ---
  /api/index.php/v1 -> HTTP 500
  Response: <html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr" class=" supports csstransforms preserve3d csstransforms3d">
<head>
    <meta charset="utf-8">
    <meta http-equiv="x-ua-compatible" content="ie=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <meta property="fb:app_id" content="1004553932967992">
    <meta property="og:type" content="website">
    <meta property="og:url" content="https://ecobank.com/500">
    <meta property="og:title"

--- [6] ADMIN PANELS ---
  /admin -> HTTP 200 Location: /
  /admin/ -> HTTP 200 Location: /admin
  /administrator/ -> HTTP 200 Location: /administrator
  /wp-admin/ -> HTTP 200 Location: /wp-admin
  /login -> HTTP 200 
  /login/ -> HTTP 200 Location: /login
  /user/login -> HTTP 200 Location: /
  /panel/ -> HTTP 200 Location: /panel
  /dashboard/ -> HTTP 200 Location: /dashboard
  /cpanel -> HTTP 200 Location: /
  /webmail -> HTTP 200 Location: /
  /phpmyadmin/ -> HTTP 200 Location: /phpmyadmin
  /adminer/ -> HTTP 200 Location: /adminer
  /manager/ -> HTTP 200 Location: /manager

--- [7] CONFIG / SENSITIVE FILE LEAKS ---
  *** /server-status -> HTTP 200 (500 bytes) ***
  Preview: 

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr">
<head><meta charset="utf-8" /><meta http-equiv="x-ua-compatible" content="ie=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" /><meta property="fb:app_
  *** /server-info -> HTTP 200 (500 bytes) ***
  Preview: 

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr">
<head><meta charset="utf-8" /><meta http-equiv="x-ua-compatible" content="ie=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" /><meta property="fb:app_
  *** /debug -> HTTP 200 (500 bytes) ***
  Preview: 

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr">
<head><meta charset="utf-8" /><meta http-equiv="x-ua-compatible" content="ie=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" /><meta property="fb:app_
  *** /trace.axd -> HTTP 200 (500 bytes) ***
  Preview: 

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml" lang="en" dir="ltr">
<head><meta charset="utf-8" /><meta http-equiv="x-ua-compatible" content="ie=edge" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta property="fb:app_id" content="1004553932967992" /><met

--- SUMMARY for ecobank.com ---
  Base URL: https://ecobank.com
  Responded: YES
  SERVER: 
--------------------------------------------------------------------------------

================================================================================
TARGET: Societe Generale BF (sgbf.bf)
DOMAIN: sgbf.bf
Probed: 2026-03-04 02:01:21
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://sgbf.bf/
  [No response from https://sgbf.bf]
  Trying: http://sgbf.bf/
  [No response from http://sgbf.bf]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

================================================================================
TARGET: Societe Generale BF (societegenerale.bf)
DOMAIN: societegenerale.bf
Probed: 2026-03-04 02:01:21
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://societegenerale.bf/
HTTP/1.1 301 Moved Permanently
server: nginx
date: Wed, 04 Mar 2026 07:00:22 GMT
content-type: text/html; charset=UTF-8
x-redirect-by: TYPO3 Redirect 17
location: http://societegenerale.bf/fr/
x-from: slumberland-prod-front02
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
set-cookie: SERVERID=f1; path=/; Secure
cache-control: private
Set-Cookie: visid_incap_3119943=K/jzFDrATxO72AY60Nj5lYXYp2kAAAAAQUIPAAAAAABTpku+fOhutX2vFt0b2kqn; expires=Thu, 04 Mar 2027 06:17:54 GMT; HttpOnly; path=/; Domain=.societegenerale.bf; Secure; SameSite=None
Set-Cookie: incap_ses_197_3119943=E1UiVnPy9WOD+cVKjOK7AoXYp2kAAAAAYx5OmSJdIZYbIM3BG15BEg==; path=/; Domain=.societegenerale.bf; Secure; SameSite=None
X-CDN: Imperva
X-Iinfo: 52-158933858-158741733 pNNy RT(1772607622102 217) q(0 0 0 1) r(2 2) U6

HTTP/1.1 200 OK
server: nginx
date: Wed, 04 Mar 2026 07:00:22 GMT
content-type: text/html; charset=utf-8
content-length: 74945
vary: Accept-Encoding
set-cookie: CDNDisableCache=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; Secure
content-language: fr
cache-control: private, no-store
content-security-policy: default-src 'self' https://ubishaker.com https://pagead2.googlesyndication.com https://privatebanking.kleinworthambros.com https://immo.societegenerale.dz https://prezi.com https://px4.ads.linkedin.com https://logws1320.ati-host.net https://static.xx.fbcdn.net https://api.privacy-center.org https://chatbox.botnation.ai https://fonts.googleapis.com https://fonts.google.com https://image.ausha.co https://player.ausha.co https://googleapis.com https://www.googleapis.com https://maps.googleapis.com https://ad.360yield.com https://eb2.3lift.com https://dn.adnxs-simple.com https://ib.adnxs.com https://e1.emxdgt.com https://contextual.media.net https://exchange.mediavine.com https://criteo-sync.teads.tv https://criteo-partners.tremorhub.com https://ad.yieldlab.net https://fbdzczf.pa-cd.com https://jadserve.postrelease.com https://maps.gstatic.com https://match.sharethrough.com https://matching.ivitrack.com https://pixel.rubiconproject.com https://px.ads.linkedin.com https://r.casalemedia.com https://raygun.com https://raygun.io https://rtb-csync.smartadserver.com https://simage2.pubmatic.com https://sync-criteo.ads.yieldmo.com https://sync-t1.taboola.com https://sync.1rx.io https://sync.outbrain.com https://sync.targeting.unrulymedia.com https://visitor.omnitagjs.com https://www.omnycontent.com https://x.bidswitch.net https://yt3.ggpht.com https://cbassets.botnation.ai https://fonts.gstatic.com https://connect.facebook.net https://cdn.mouseflow.com https://logws1307.ati-host.net https://logws1309.ati-host.net https://logws1310.ati-host.net https://logws1316.ati-host.net https://logws1318.ati-host.net https://logws1322.ati-host.net https://logws1330.ati-host.net https://logws1336.ati-host.net https://logws1337.ati-host.net https://logws1347.ati-host.net https://logws1361.ati-host.net https://aticdn.net https://ati-host.net https://tag.aticdn.net https://app-static.turtl.co https://xiti.com https://logs1409.xiti.com https://logs1412.xiti.com https://omny.fm https://sdk.privacy-center.org https://t-log.sgmarkets.com https://www.facebook.com https://www.google-analytics.com https://www.google.fr https://www.googleadservices.com https://www.googletagmanager.com https://www.youtube.com https://www.gstatic.com https://maps.google.com https://google.com https://www.google.com https://analytics.qumucloud.com https://cdn.qumucloud.com https://socgen.qumucloud.com https://client.containers.piwik.pro https://sgss.piwik.pro https://bid.g.doubleclick.net https://googleads.g.doubleclick.net https://td.doubleclick.net https://static.doubleclick.net https://cm.g.doubleclick.net https://gum.criteo.com https://dis.criteo.com https://sslwidget.criteo.com https://dynamic.criteo.com https://ajax.googleapis.com https://assets.turtl.co https://cdn.botnation.ai https://cdn.jsdelivr.net https://d36ygvu01nuobw.cloudfront.net https://dpm.demdex.net https://i.ytimg.com https://id5-sync.com https://snap.licdn.com; script-src 'self' 'nonce-YR3xAKYHuTdOtKP/1zjPrw==' 'strict-dynamic' https://prezi.com https://px4.ads.linkedin.com https://logws1320.ati-host.net https://static.xx.fbcdn.net https://api.privacy-center.org https://chatbox.botnation.ai https://fonts.googleapis.com https://fonts.google.com https://image.ausha.co https://player.ausha.co https://googleapis.com https://www.googleapis.com https://maps.googleapis.com https://ad.360yield.com https://eb2.3lift.com https://dn.adnxs-simple.com https://ib.adnxs.com https://e1.emxdgt.com https://contextual.media.net https://exchange.mediavine.com https://criteo-sync.teads.tv https://criteo-partners.tremorhub.com https://ad.yieldlab.net https://fbdzczf.pa-cd.com https://jadserve.postrelease.com https://maps.gstatic.com https://match.sharethrough.com https://matching.ivitrack.com https://pixel.rubiconproject.com https://px.ads.linkedin.com https://r.casalemedia.com https://raygun.com https://raygun.io https://rtb-csync.smartadserver.com https://simage2.pubmatic.com https://sync-criteo.ads.yieldmo.com https://sync-t1.taboola.com https://sync.1rx.io https://sync.outbrain.com https://sync.targeting.unrulymedia.com https://visitor.omnitagjs.com https://www.omnycontent.com https://x.bidswitch.net https://yt3.ggpht.com https://cbassets.botnation.ai https://fonts.gstatic.com https://connect.facebook.net https://cdn.mouseflow.com https://logws1307.ati-host.net https://logws1309.ati-host.net https://logws1310.ati-host.net https://logws1316.ati-host.net https://logws1318.ati-host.net https://logws1322.ati-host.net https://logws1330.ati-host.net https://logws1336.ati-host.net https://logws1337.ati-host.net https://logws1347.ati-host.net https://logws1361.ati-host.net https://aticdn.net https://ati-host.net https://tag.aticdn.net https://app-static.turtl.co https://xiti.com https://logs1409.xiti.com https://logs1412.xiti.com https://omny.fm https://sdk.privacy-center.org https://t-log.sgmarkets.com https://www.facebook.com https://www.google-analytics.com https://www.google.fr https://www.googleadservices.com https://www.googletagmanager.com https://www.youtube.com https://www.gstatic.com https://maps.google.com https://google.com https://www.google.com https://analytics.qumucloud.com https://cdn.qumucloud.com https://socgen.qumucloud.com https://client.containers.piwik.pro https://sgss.piwik.pro https://bid.g.doubleclick.net https://googleads.g.doubleclick.net https://td.doubleclick.net https://static.doubleclick.net https://cm.g.doubleclick.net https://gum.criteo.com https://dis.criteo.com https://sslwidget.criteo.com https://dynamic.criteo.com https://ajax.googleapis.com https://assets.turtl.co https://cdn.botnation.ai https://cdn.jsdelivr.net https://d36ygvu01nuobw.cloudfront.net https://dpm.demdex.net https://i.ytimg.com https://id5-sync.com https://snap.licdn.com; img-src 'self' https://prezi.com https://px4.ads.linkedin.com https://logws1320.ati-host.net https://static.xx.fbcdn.net https://api.privacy-center.org https://chatbox.botnation.ai https://fonts.googleapis.com https://fonts.gstatic.com https://fonts.google.com https://image.ausha.co https://player.ausha.co https://googleapis.com https://www.googleapis.com https://maps.googleapis.com https://ad.360yield.com https://eb2.3lift.com https://dn.adnxs-simple.com https://ib.adnxs.com https://e1.emxdgt.com https://contextual.media.net https://exchange.mediavine.com https://criteo-sync.teads.tv https://criteo-partners.tremorhub.com https://ad.yieldlab.net https://fbdzczf.pa-cd.com https://jadserve.postrelease.com https://maps.gstatic.com https://match.sharethrough.com https://matching.ivitrack.com https://pixel.rubiconproject.com https://px.ads.linkedin.com https://r.casalemedia.com https://raygun.com https://raygun.io https://rtb-csync.smartadserver.com https://simage2.pubmatic.com https://sync-criteo.ads.yieldmo.com https://sync-t1.taboola.com https://sync.1rx.io https://sync.outbrain.com https://sync.targeting.unrulymedia.com https://visitor.omnitagjs.com https://www.omnycontent.com https://x.bidswitch.net https://yt3.ggpht.com https://cbassets.botnation.ai https://connect.facebook.net https://cdn.mouseflow.com https://logws1307.ati-host.net https://logws1309.ati-host.net https://logws1310.ati-host.net https://logws1316.ati-host.net https://logws1318.ati-host.net https://logws1322.ati-host.net https://logws1330.ati-host.net https://logws1336.ati-host.net https://logws1337.ati-host.net https://logws1347.ati-host.net https://logws1361.ati-host.net https://aticdn.net https://ati-host.net https://tag.aticdn.net https://app-static.turtl.co https://xiti.com https://logs1409.xiti.com https://logs1412.xiti.com https://omny.fm https://sdk.privacy-center.org https://t-log.sgmarkets.com https://www.facebook.com https://www.google-analytics.com https://www.google.fr https://www.googleadservices.com https://www.googletagmanager.com https://www.youtube.com https://www.gstatic.com https://maps.google.com https://google.com https://www.google.com https://analytics.qumucloud.com https://cdn.qumucloud.com https://socgen.qumucloud.com https://client.containers.piwik.pro https://sgss.piwik.pro https://bid.g.doubleclick.net https://googleads.g.doubleclick.net https://td.doubleclick.net https://static.doubleclick.net https://cm.g.doubleclick.net https://gum.criteo.com https://dis.criteo.com https://sslwidget.criteo.com https://dynamic.criteo.com https://ajax.googleapis.com https://assets.turtl.co https://cdn.botnation.ai https://cdn.jsdelivr.net https://d36ygvu01nuobw.cloudfront.net https://dpm.demdex.net https://i.ytimg.com https://id5-sync.com https://snap.licdn.com; style-src 'self' 'unsafe-inline' https://prezi.com https://px4.ads.linkedin.com https://logws1320.ati-host.net https://static.xx.fbcdn.net https://api.privacy-center.org https://chatbox.botnation.ai https://fonts.googleapis.com https://fonts.gstatic.com https://fonts.google.com https://image.ausha.co https://player.ausha.co https://googleapis.com https://www.googleapis.com https://maps.googleapis.com https://ad.360yield.com https://eb2.3lift.com https://dn.adnxs-simple.com https://ib.adnxs.com https://e1.emxdgt.com https://contextual.media.net https://exchange.mediavine.com https://criteo-sync.teads.tv https://criteo-partners.tremorhub.com https://ad.yieldlab.net https://fbdzczf.pa-cd.com https://jadserve.postrelease.com https://maps.gstatic.com https://match.sharethrough.com https://matching.ivitrack.com https://pixel.rubiconproject.com https://px.ads.linkedin.com https://r.casalemedia.com https://raygun.com https://raygun.io https://rtb-csync.smartadserver.com https://simage2.pubmatic.com https://sync-criteo.ads.yieldmo.com https://sync-t1.taboola.com https://sync.1rx.io https://sync.outbrain.com https://sync.targeting.unrulymedia.com https://visitor.omnitagjs.com https://www.omnycontent.com https://x.bidswitch.net https://yt3.ggpht.com https://cbassets.botnation.ai https://connect.facebook.net https://cdn.mouseflow.com https://logws1307.ati-host.net https://logws1309.ati-host.net https://logws1310.ati-host.net https://logws1316.ati-host.net https://logws1318.ati-host.net https://logws1322.ati-host.net https://logws1330.ati-host.net https://logws1336.ati-host.net https://logws1337.ati-host.net https://logws1347.ati-host.net https://logws1361.ati-host.net https://aticdn.net https://ati-host.net https://tag.aticdn.net https://app-static.turtl.co https://xiti.com https://logs1409.xiti.com https://logs1412.xiti.com https://omny.fm https://sdk.privacy-center.org https://t-log.sgmarkets.com https://www.facebook.com https://www.google-analytics.com https://www.google.fr https://www.googleadservices.com https://www.googletagmanager.com https://www.youtube.com https://www.gstatic.com https://maps.google.com https://google.com https://www.google.com https://analytics.qumucloud.com https://cdn.qumucloud.com https://socgen.qumucloud.com https://client.containers.piwik.pro https://sgss.piwik.pro https://bid.g.doubleclick.net https://googleads.g.doubleclick.net https://td.doubleclick.net https://static.doubleclick.net https://cm.g.doubleclick.net https://gum.criteo.com https://dis.criteo.com https://sslwidget.criteo.com https://dynamic.criteo.com https://ajax.googleapis.com https://assets.turtl.co https://cdn.botnation.ai https://cdn.jsdelivr.net https://d36ygvu01nuobw.cloudfront.net https://dpm.demdex.net https://i.ytimg.com https://id5-sync.com https://snap.licdn.com; object-src 'none'; font-src 'self' https://cbassets.botnation.ai https://d36ygvu01nuobw.cloudfront.net https://fonts.gstatic.com https://omny.fm; base-uri 'self'; form-action 'self'; report-to blank; upgrade-insecure-requests;
etag: W/"86fe83d5c08140703ac698ff00201794"
x-from: slumberland-prod-front01
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
set-cookie: SERVERID=f0; path=/; Secure
Set-Cookie: visid_incap_3119943=oxxx+UjhT52JRktLQKnSIIXYp2kAAAAAQUIPAAAAAACGXbPhYD48HIs4M6PETNpQ; expires=Thu, 04 Mar 2027 06:17:54 GMT; HttpOnly; path=/; Domain=.societegenerale.bf; Secure; SameSite=None
Set-Cookie: incap_ses_197_3119943=HwQbMJh6CHTY+8VKjOK7AoXYp2kAAAAAGX8zOKmikzCphO9GQrzwyQ==; path=/; Domain=.societegenerale.bf; Secure; SameSite=None
X-CDN: Imperva
X-Iinfo: 52-158933858-158741733 sNNy RT(1772607622102 510) q(0 0 0 -1) r(3 3) U6
  >> SERVER: server: nginx

--- [2] WORDPRESS API (wp-json) ---
  *** WORDPRESS API DETECTED ***

<!DOCTYPE html>

<head>
    <meta charset="utf-8">
    <meta name="robots" content="noindex, follow">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>Page Not Found</title>
    <style>
        body {
            font-family: system-ui, -apple-system, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", "Liberation Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
            font-size: 1rem;
            font-weight: 400;
            line-height: 1.5;
            color: #212121;
            background-color: #fff;
            display: flex;
            margin: 0;
            padding: 2rem;
            align-items: center;
            justify-content: center;
            -webkit-text-size-adjust: 100%;
 

--- [3] COMMON API PATHS ---

--- [4] ROBOTS.TXT ---
User-agent: *
Disallow:
Crawl-delay: 10

User-agent: MJ12bot
Disallow: /

User-agent: BLP_bbot/0.1
Disallow: /

User-agent: BLP_bbot
Disallow: /

User-agent: Ezooms/1.0
Disallow: /

User-agent: *
Disallow: /typo3conf/ext/bi_sg_implantations/res/ultimate_flash_map_killer.js
Disallow: /typo3conf/ext/bi_sg_implantations/res/lib/polregi.lib

Disallow: *?familySource*$
		

--- [5] JOOMLA API ---
  [No Joomla API found]

--- [6] ADMIN PANELS ---
  /wp-admin/ -> HTTP 403 
  /wp-login.php -> HTTP 403 

--- [7] CONFIG / SENSITIVE FILE LEAKS ---
  /.env -> HTTP 403 (Forbidden - exists but protected)
  /web.config -> HTTP 403 (Forbidden - exists but protected)
  /config.yml -> HTTP 403 (Forbidden - exists but protected)
  /.git/HEAD -> HTTP 403 (Forbidden - exists but protected)
  /.git/config -> HTTP 403 (Forbidden - exists but protected)
  /composer.json -> HTTP 403 (Forbidden - exists but protected)
  /.htaccess -> HTTP 403 (Forbidden - exists but protected)
  /wp-config.php.bak -> HTTP 403 (Forbidden - exists but protected)
  *** /.well-known/security.txt -> HTTP 200 (274 bytes) ***
  Preview: Contact: cert.sg@socgen.com
Contact: tel:+33(0)1-5898-7200
Contact: https://vdp.societegenerale.com
Expires: 2030-12-30T23:00:00.000Z
Encryption: https://cert.societegenerale.com/CERT_SG_RFC2350.pdf.sig
Preferred-Languages: en, fr;
Canonical: https://vdp.societegenerale.com

--- SUMMARY for societegenerale.bf ---
  Base URL: https://societegenerale.bf
  Responded: YES
  server: nginx
--------------------------------------------------------------------------------

================================================================================
TARGET: BSIC Bank (bsic.bf)
DOMAIN: bsic.bf
Probed: 2026-03-04 02:02:00
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://bsic.bf/
  [No response from https://bsic.bf]
  Trying: http://bsic.bf/
  [No response from http://bsic.bf]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

================================================================================
TARGET: Banque Commerciale (bcb.bf)
DOMAIN: bcb.bf
Probed: 2026-03-04 02:02:20
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://bcb.bf/
  [No response from https://bcb.bf]
  Trying: http://bcb.bf/
  [No response from http://bcb.bf]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

================================================================================
TARGET: Wendkuni Bank (wendkuni-bank.bf)
DOMAIN: wendkuni-bank.bf
Probed: 2026-03-04 02:02:40
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://wendkuni-bank.bf/
  [No response from https://wendkuni-bank.bf]
  Trying: http://wendkuni-bank.bf/
  [No response from http://wendkuni-bank.bf]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

================================================================================
TARGET: BCEAO Central Bank (bceao.int)
DOMAIN: bceao.int
Probed: 2026-03-04 02:03:00
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://bceao.int/
  [No response from https://bceao.int]
  Trying: http://bceao.int/
  [No response from http://bceao.int]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

================================================================================
TARGET: BOAD Dev Bank (boad.org)
DOMAIN: boad.org
Probed: 2026-03-04 02:03:00
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://boad.org/
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Wed, 04 Mar 2026 07:02:01 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://www.boad.org/

HTTP/1.1 302 Found
Server: nginx
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Cache-Control: no-cache, private
Date: Wed, 04 Mar 2026 07:02:02 GMT
Location: https://www.boad.org/fr
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff

HTTP/1.1 200 OK
Server: nginx
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: no-cache, private
Date: Wed, 04 Mar 2026 07:02:02 GMT
Link: <https://www.boad.org/build/assets/aos-73168167.css>; rel="preload"; as="style", <https://www.boad.org/build/assets/app-f5200e1a.css>; rel="preload"; as="style", <https://www.boad.org/build/assets/app-0c0592f3.js>; rel="modulepreload", <https://www.boad.org/build/assets/@vue-a8c757c4.js>; rel="modulepreload", <https://www.boad.org/build/assets/axios-d73e320f.js>; rel="modulepreload", <https://www.boad.org/build/assets/aos-bb9a42e7.js>; rel="modulepreload", <https://www.boad.org/build/assets/@inertiajs-abc11441.js>; rel="modulepreload", <https://www.boad.org/build/assets/laravel-vite-plugin-2946317a.js>; rel="modulepreload", <https://www.boad.org/build/assets/deepmerge-41bf8e61.js>; rel="modulepreload", <https://www.boad.org/build/assets/qs-12cf373f.js>; rel="modulepreload", <https://www.boad.org/build/assets/side-channel-f495b945.js>; rel="modulepreload", <https://www.boad.org/build/assets/get-intrinsic-8a96e1a6.js>; rel="modulepreload", <https://www.boad.org/build/assets/es-errors-3229877f.js>; rel="modulepreload", <https://www.boad.org/build/assets/has-symbols-5908a490.js>; rel="modulepreload", <https://www.boad.org/build/assets/has-proto-117654df.js>; rel="modulepreload", <https://www.boad.org/build/assets/function-bind-a13ff0e9.js>; rel="modulepreload", <https://www.boad.org/build/assets/hasown-fbbd6478.js>; rel="modulepreload", <https://www.boad.org/build/assets/call-bind-2d77dcf8.js>; rel="modulepreload", <https://www.boad.org/build/assets/set-function-length-788d5478.js>; rel="modulepreload", <https://www.boad.org/build/assets/define-data-property-c6063fd7.js>; rel="modulepreload", <https://www.boad.org/build/assets/es-define-property-3c27fc4b.js>; rel="modulepreload", <https://www.boad.org/build/assets/gopd-81257f82.js>; rel="modulepreload", <https://www.boad.org/build/assets/has-property-descriptors-7a3000ac.js>; rel="modulepreload", <https://www.boad.org/build/assets/object-inspect-1bf2b7b1.js>; rel="modulepreload", <https://www.boad.org/build/assets/nprogress-d19ef85e.js>; rel="modulepreload", <https://www.boad.org/build/assets/lodash.clonedeep-579dfba3.js>; rel="modulepreload", <https://www.boad.org/build/assets/lodash.isequal-aab1ce6f.js>; rel="modulepreload"
Vary: X-Inertia
Set-Cookie: XSRF-TOKEN=eyJpdiI6Ii9yYTREYVJyTGxidzNjZkJFdzhQN0E9PSIsInZhbHVlIjoiajc1cG8rMEpYdjVWZ0RuV0FVNE5NMVRvRWJkNVBvd0w1SzRBbDFtQmxkY1RxdGgwUDRqalo5LzZiRjMrNzYvYnRGcE1yWXZZWUVBWkQ5L3BWeEozYnAvbi9pMW5DOHMyVjc4d3pZaGY0bE9RVWU3L2l1VWtnazBsR21uRVU5S2oiLCJtYWMiOiJkYzNjNWNiMTNiMDZjMWVlY2E4YWI1MGU4NjdkZTkyMzNiYTY3MDUwODEwZTYwN2ExOWYyNjA3OGIxYTljYzU4IiwidGFnIjoiIn0%3D; expires=Wed, 04 Mar 2026 09:02:02 GMT; Max-Age=7200; path=/; secure; samesite=lax
Set-Cookie: la_boad_session=eyJpdiI6ImcwZGhsS2kvVHJjQmdXK0dTS1BWY2c9PSIsInZhbHVlIjoidUZJVjZPQ3BrZTRXb3AzRSt2eDM3eVpOckhzdDExVDlRWENnR3dKb0FzUktVQ200UmU4OVo5VVVuN1M2YXJvNmFlNElvcEk0UEg0MlJ2SVUyNnZYeFRaVVVxc0JwMGhBM0lYcHhTTlFhakkzVHJZemM4dVl1VjhNbWljbVJSREEiLCJtYWMiOiI2ZGQ3MDcwYWE2ZTBlMTJjNzc3ODNhMWFmZjMxZGE0YTdjMjQ0YmM3M2U4NWRmNjNhMjZkYTg1YzI0YmExNTNkIiwidGFnIjoiIn0%3D; expires=Wed, 04 Mar 2026 09:02:02 GMT; Max-Age=7200; path=/; secure; httponly; samesite=lax
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
  >> SERVER: Server: nginx

--- [2] WORDPRESS API (wp-json) ---
  *** WORDPRESS API DETECTED ***
<!DOCTYPE html>
<html lang="en">
    <head>
        <meta charset="utf-8">
        <meta name="viewport" content="width=device-width, initial-scale=1">

        <title>Not Found</title>

        <style>
            /*! normalize.css v8.0.1 | MIT License | github.com/necolas/normalize.css */html{line-height:1.15;-webkit-text-size-adjust:100%}body{margin:0}a{background-color:transparent}code{font-family:monospace,monospace;font-size:1em}[hidden]{display:none}html{font-family:system-ui,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji;line-height:1.5}*,:after,:before{box-sizing:border-box;border:0 solid #e2e8f0}a{color:inherit;text-decoration:inherit}code{font-family:Menlo,Monaco,Consola

--- [3] COMMON API PATHS ---

--- [4] ROBOTS.TXT ---
User-agent: *
Allow: /

Sitemap: https://www.boad.org/sitemap_index.xml

--- [5] JOOMLA API ---
  [No Joomla API found]

--- [6] ADMIN PANELS ---

--- [7] CONFIG / SENSITIVE FILE LEAKS ---
  /.env -> HTTP 403 (Forbidden - exists but protected)
  /.git/HEAD -> HTTP 403 (Forbidden - exists but protected)
  /.git/config -> HTTP 403 (Forbidden - exists but protected)
  /.htaccess -> HTTP 403 (Forbidden - exists but protected)
  /.DS_Store -> HTTP 403 (Forbidden - exists but protected)

--- SUMMARY for boad.org ---
  Base URL: https://boad.org
  Responded: YES
  Server: nginx
--------------------------------------------------------------------------------

================================================================================
TARGET: CREPMF Stock Regulator (crepmf.org)
DOMAIN: crepmf.org
Probed: 2026-03-04 02:03:57
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://crepmf.org/
  [No response from https://crepmf.org]
  Trying: http://crepmf.org/
  [No response from http://crepmf.org]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

================================================================================
TARGET: BRVM Stock Exchange (brvm.org)
DOMAIN: brvm.org
Probed: 2026-03-04 02:03:58
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://brvm.org/
  [No response from https://brvm.org]
  Trying: http://brvm.org/
  [No response from http://brvm.org]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

########################################################################
#                       TELECOM TARGETS                                #
########################################################################

================================================================================
TARGET: Moov Africa BF (moov-africa.bf)
DOMAIN: moov-africa.bf
Probed: 2026-03-04 02:03:59
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://moov-africa.bf/
HTTP/1.1 200 OK
Date: Wed, 04 Mar 2026 07:00:19 GMT
Server: Apache/2.4.62 (Red Hat Enterprise Linux) OpenSSL/3.5.1 mod_fcgid/2.3.9
X-Powered-By: PHP/8.3.29
Link: <https://moov-africa.bf/wp-json/>; rel="https://api.w.org/"
X-TEC-API-VERSION: v1
X-TEC-API-ROOT: https://moov-africa.bf/wp-json/tribe/events/v1/
X-TEC-API-ORIGIN: https://moov-africa.bf
Content-Type: text/html; charset=UTF-8
  >> SERVER: Server: Apache/2.4.62 (Red Hat Enterprise Linux) OpenSSL/3.5.1 mod_fcgid/2.3.9
  >> POWERED-BY: X-Powered-By: PHP/8.3.29

--- [2] WORDPRESS API (wp-json) ---
  *** WORDPRESS API DETECTED ***

{"name":"Moov Africa Burkina Faso : le leader des t\u00e9l\u00e9communications au Faso","description":"","url":"https:\/\/moov-africa.bf","home":"https:\/\/moov-africa.bf","gmt_offset":0,"timezone_string":"Africa\/Ouagadougou","page_for_posts":0,"page_on_front":0,"show_on_front":"posts","namespaces":["oembed\/1.0","akismet\/v1","contact-form-7\/v1","jetpack\/v4","klaviyo\/v1","wc\/v3","wc\/v1","wc\/pos\/v1\/catalog","yoast\/v1","tribe\/event-aggregator\/v1","tribe\/events\/v1","tribe\/views\/v2","tec\/v2\/onboarding","tec\/v1","pll\/v1","wpcom\/v2","jetpack\/v4\/stats-app","wpcom\/v3","pinterest\/v1","wc-admin","wc-analytics","wc\/store","wc\/store\/v1","wc\/private","wp-statistics\/v2","wc\/v2","wc\/gla","jetpack-boost\/v1","my-jetpack\/v1","jetpack\/v4\/explat","woocommerce-email-editor

--- [3] COMMON API PATHS ---

--- [4] ROBOTS.TXT ---

User-agent: *
Disallow: /wp-content/uploads/wc-logs/
Disallow: /wp-content/uploads/woocommerce_transient_files/
Disallow: /wp-content/uploads/woocommerce_uploads/
Disallow: /*?add-to-cart=
Disallow: /*?*add-to-cart=
Disallow: /wp-admin/
Allow: /wp-admin/admin-ajax.php

# START YOAST BLOCK
# ---------------------------
User-agent: *
Disallow:

Sitemap: https://moov-africa.bf/sitemap_index.xml
# ---------------------------
# END YOAST BLOCK

--- [5] JOOMLA API ---
  [No Joomla API found]

--- [6] ADMIN PANELS ---

--- [7] CONFIG / SENSITIVE FILE LEAKS ---
  /.htaccess -> HTTP 403 (Forbidden - exists but protected)

--- SUMMARY for moov-africa.bf ---
  Base URL: https://moov-africa.bf
  Responded: YES
  Server: Apache/2.4.62 (Red Hat Enterprise Linux) OpenSSL/3.5.1 mod_fcgid/2.3.9
  X-Powered-By: PHP/8.3.29
--------------------------------------------------------------------------------

================================================================================
TARGET: Moov BF (moov.bf)
DOMAIN: moov.bf
Probed: 2026-03-04 02:05:17
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://moov.bf/
  [No response from https://moov.bf]
  Trying: http://moov.bf/
  [No response from http://moov.bf]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

================================================================================
TARGET: Orange BF (orange.bf)
DOMAIN: orange.bf
Probed: 2026-03-04 02:05:17
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://orange.bf/
  [No response from https://orange.bf]
  Trying: http://orange.bf/
  [No response from http://orange.bf]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

================================================================================
TARGET: ONATEL (onatel.bf)
DOMAIN: onatel.bf
Probed: 2026-03-04 02:05:28
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://onatel.bf/
  [No response from https://onatel.bf]
  Trying: http://onatel.bf/
  [No response from http://onatel.bf]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

================================================================================
TARGET: FasoNet (faso-net.bf)
DOMAIN: faso-net.bf
Probed: 2026-03-04 02:05:39
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://faso-net.bf/
  [No response from https://faso-net.bf]
  Trying: http://faso-net.bf/
  [No response from http://faso-net.bf]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

================================================================================
TARGET: FasoNet (fasonet.bf)
DOMAIN: fasonet.bf
Probed: 2026-03-04 02:05:39
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://fasonet.bf/
  [No response from https://fasonet.bf]
  Trying: http://fasonet.bf/
  [No response from http://fasonet.bf]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

########################################################################
#                    MAJOR ENTERPRISE TARGETS                          #
########################################################################

================================================================================
TARGET: SONABEL Electricity (sonabel.bf)
DOMAIN: sonabel.bf
Probed: 2026-03-04 02:05:41
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://sonabel.bf/
  [No response from https://sonabel.bf]
  Trying: http://sonabel.bf/
  [No response from http://sonabel.bf]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

================================================================================
TARGET: ONEA Water (onea.bf)
DOMAIN: onea.bf
Probed: 2026-03-04 02:06:01
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://onea.bf/
HTTP/1.1 200 OK
Date: Wed, 04 Mar 2026 07:05:02 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
CF-RAY: 9d6f07bdaff2bf64-ATL
link: <https://onea.bf/wp-json/>; rel="https://api.w.org/", <https://onea.bf/wp-json/wp/v2/pages/363>; rel="alternate"; title="JSON"; type="application/json", <https://onea.bf/>; rel=shortlink
Cache-Control: max-age=7200
expires: Wed, 04 Mar 2026 09:05:02 GMT
vary: Accept-Encoding
x-endurance-cache-level: 2
x-nginx-cache: WordPress
Set-Cookie: nfd-enable-cf-opt=63a6825d27cab0f204d3b602; path=/; Max-Age=86400; HttpOnly
Set-Cookie: __cf_bm=BA6phQg1lo7eUjfRgrrbtGUZMpJSSdx2Q_RSviWZYhQ-1772607902-1.0.1.1-SVPK4eLg5MYBE7IPihrL_8y3cufBJqUtf8uqUuXHGhBzE_jKgvcRpw6ZQN4FNx8oKaiGazZgodrux7ScqaEQuT0.roK7DA7Hc6vEVvYHubo; path=/; expires=Wed, 04-Mar-26 07:35:02 GMT; domain=.onea.bf; HttpOnly; Secure; SameSite=None
Set-Cookie: _cfuvid=x_Uru5shT8nt7aZZLzhNCHZEMrs9LCvnGWUaoVpoLMU-1772607902688-0.0.1.1-604800000; path=/; domain=.onea.bf; HttpOnly; Secure; SameSite=None
Last-Modified: Wed, 04 Mar 2026 07:05:02 GMT
CF-Cache-Status: MISS
Server: cloudflare
alt-svc: h3=":443"; ma=86400
  >> SERVER: Server: cloudflare

--- [2] WORDPRESS API (wp-json) ---
  *** WORDPRESS API DETECTED ***
{"name":"ONEA","description":"Office national de l&#039;eau et de l&#039;assainissement","url":"https:\/\/onea.bf","home":"https:\/\/onea.bf","gmt_offset":"0","timezone_string":"","page_for_posts":0,"page_on_front":363,"show_on_front":"page","namespaces":["oembed\/1.0","akismet\/v1","nfd-editor-chat\/v1","bluehost\/v1","newfold-features\/v1","contact-form-7\/v1","jetpack\/v4","jetpack-boost\/v1","my-jetpack\/v1","jetpack\/v4\/explat","mec\/v1","elementor-one\/v1","wpcom\/v2","videopress\/v1","jetpack\/v4\/stats-app","jetpack\/v4\/import","wpcom\/v3","nfd-wonder-blocks\/v1","nfd-help-center\/v1","newfold-multi-search\/v1","newfold-staging\/v1","the7\/v1","jetpack\/v4\/blaze-app","jetpack\/v4\/blaze","newfold-installer\/v1","newfold-ai\/v1","newfold-facebook\/v1","newfold-coming-soon\/v1","n

--- [3] COMMON API PATHS ---

--- [4] ROBOTS.TXT ---
User-agent: *
Disallow: /wp-admin/
Allow: /wp-admin/admin-ajax.php

Sitemap: https://onea.bf/wp-sitemap.xml

--- [5] JOOMLA API ---
  [No Joomla API found]

--- [6] ADMIN PANELS ---
  /admin -> HTTP 200 location: https://onea.bf/wp-admin/
  /admin/ -> HTTP 200 location: https://onea.bf/wp-admin/
  /wp-admin/ -> HTTP 200 location: https://onea.bf/wp-login.php?redirect_to=https%3A%2F%2Fonea.bf%2Fwp-admin%2F&reauth=1
  /login -> HTTP 200 location: https://onea.bf/wp-login.php
  /login/ -> HTTP 200 location: https://onea.bf/wp-login.php
  /dashboard/ -> HTTP 200 location: https://onea.bf/wp-admin/
  /cpanel -> HTTP 200 
  /webmail -> HTTP 200 
  /wp-login.php -> HTTP 200 

--- [7] CONFIG / SENSITIVE FILE LEAKS ---
  /.env -> HTTP 403 (Forbidden - exists but protected)
  /web.config -> HTTP 403 (Forbidden - exists but protected)
  /.git/HEAD -> HTTP 403 (Forbidden - exists but protected)
  /.git/config -> HTTP 403 (Forbidden - exists but protected)
  /.htaccess -> HTTP 403 (Forbidden - exists but protected)
  /phpinfo.php -> HTTP 403 (Forbidden - exists but protected)
  /server-status -> HTTP 403 (Forbidden - exists but protected)

--- SUMMARY for onea.bf ---
  Base URL: https://onea.bf
  Responded: YES
  Server: cloudflare
--------------------------------------------------------------------------------

================================================================================
TARGET: SITARAIL Railway (sitarail.bf)
DOMAIN: sitarail.bf
Probed: 2026-03-04 02:06:29
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://sitarail.bf/
  [No response from https://sitarail.bf]
  Trying: http://sitarail.bf/
  [No response from http://sitarail.bf]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

================================================================================
TARGET: Ouaga Airport (aeroport-ouaga.bf)
DOMAIN: aeroport-ouaga.bf
Probed: 2026-03-04 02:06:29
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://aeroport-ouaga.bf/
  [No response from https://aeroport-ouaga.bf]
  Trying: http://aeroport-ouaga.bf/
  [No response from http://aeroport-ouaga.bf]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

================================================================================
TARGET: Airports BF (aeroports.bf)
DOMAIN: aeroports.bf
Probed: 2026-03-04 02:06:30
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://aeroports.bf/
  [No response from https://aeroports.bf]
  Trying: http://aeroports.bf/
  [No response from http://aeroports.bf]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

================================================================================
TARGET: Air Burkina (air-burkina.com)
DOMAIN: air-burkina.com
Probed: 2026-03-04 02:06:30
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://air-burkina.com/
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 04 Mar 2026 07:05:33 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Content-Language: fr
X-TYPO3-Parsetime: 0ms
X-UA-Compatible: IE=edge
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000; includeSubDomains
X-Powered-By: PleskLin
  >> SERVER: Server: nginx
  >> POWERED-BY: X-Powered-By: PleskLin

--- [2] WORDPRESS API (wp-json) ---
  *** WORDPRESS API DETECTED ***
<!DOCTYPE html>
<html lang="fr">
<head>

<meta charset="utf-8">
<!-- 
	This website is powered by TYPO3 - inspiring people to share!
	TYPO3 is a free open source Content Management Framework initially created by Kasper Skaarhoj and licensed under GNU/GPL.
	TYPO3 is copyright 1998-2026 of Kasper Skaarhoj. Extensions are copyright of their respective owners.
	Information and contribution at https://typo3.org/
-->

<base href="https://air-burkina.com/">

<title>Erreur 404 | Air Burkina</title>
<meta name="generator" content="TYPO3 CMS" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<meta name="robots" content="index,follow,archive" />
<meta property="og:type" content="website" />
<meta name="twitter:card" content="summary" />
<meta name="msapplication-tilecolor" c

--- [3] COMMON API PATHS ---

--- [4] ROBOTS.TXT ---
User-Agent: *
Allow: /
Disallow: /typo3_src/
Allow: /typo3/sysext/frontend/Resources/Public/*

# folders
Disallow: /t3lib/
Disallow: /typo3/
Disallow: /typo3conf/
Allow: /typo3conf/ext/
Allow: /typo3temp/

# parameters
Disallow: /*?id=*               # non-realurl URLs
Disallow: /*cHash               # no cHash
Disallow: /*tx_powermail_pi1    # no powermail thanks pages
Disallow: /*tx_form_formframework    # no forms

# sitemap
Sitemap: https://air-burkina.com/sitemap.xml

--- [5] JOOMLA API ---
  [No Joomla API found]

--- [6] ADMIN PANELS ---

--- [7] CONFIG / SENSITIVE FILE LEAKS ---
  /config.yml -> HTTP 403 (Forbidden - exists but protected)
  /.git/HEAD -> HTTP 403 (Forbidden - exists but protected)
  /.git/config -> HTTP 403 (Forbidden - exists but protected)
  /composer.json -> HTTP 403 (Forbidden - exists but protected)
  /.htaccess -> HTTP 403 (Forbidden - exists but protected)
  /wp-config.php.bak -> HTTP 403 (Forbidden - exists but protected)

--- SUMMARY for air-burkina.com ---
  Base URL: https://air-burkina.com
  Responded: YES
  Server: nginx
  X-Powered-By: PleskLin
--------------------------------------------------------------------------------

================================================================================
TARGET: CAMEG Pharma (cameg.bf)
DOMAIN: cameg.bf
Probed: 2026-03-04 02:07:25
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://cameg.bf/
  [No response from https://cameg.bf]
  Trying: http://cameg.bf/
  [No response from http://cameg.bf]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

================================================================================
TARGET: CMU Health (cmu.bf)
DOMAIN: cmu.bf
Probed: 2026-03-04 02:07:26
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://cmu.bf/
  [No response from https://cmu.bf]
  Trying: http://cmu.bf/
  [No response from http://cmu.bf]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***

================================================================================
TARGET: RSS Social Security (rss-bf.org)
DOMAIN: rss-bf.org
Probed: 2026-03-04 02:07:26
================================================================================

--- [1] HOMEPAGE HEADERS ---
  Trying: https://rss-bf.org/
  [No response from https://rss-bf.org]
  Trying: http://rss-bf.org/
  [No response from http://rss-bf.org]
  *** DOMAIN UNREACHABLE ON BOTH HTTP AND HTTPS ***


########################################################################
#           ALTERNATE DOMAIN RESOLUTION ATTEMPTS                       #
########################################################################

  Testing www.bicia.bf ... UNREACHABLE
  Testing www.biciab.bf ... UNREACHABLE
  Testing www.coris-bank.com ... HTTP -> HTTP 301 Server: nginx
  Testing www.corisbank.bf ... HTTP -> HTTP 301 Server: Apache/2.4.52 (Ubuntu)
  Testing www.sgbf.bf ... UNREACHABLE
  Testing www.bsic.bf ... UNREACHABLE
  Testing www.bcb.bf ... UNREACHABLE
  Testing www.wendkuni-bank.bf ... UNREACHABLE
  Testing www.bceao.int ... HTTPS -> HTTP 200 Server: nginx/1.20.1
  Testing www.crepmf.org ... UNREACHABLE
  Testing www.brvm.org ... HTTPS -> HTTP 200 Server: nginx
  Testing www.moov.bf ... UNREACHABLE
  Testing www.orange.bf ... HTTPS -> HTTP 200 
  Testing www.onatel.bf ... UNREACHABLE
  Testing www.fasonet.bf ... UNREACHABLE
  Testing www.sonabel.bf ... UNREACHABLE
  Testing www.sitarail.bf ... UNREACHABLE
  Testing www.cameg.bf ... UNREACHABLE
  Testing www.cmu.bf ... UNREACHABLE
  Testing www.rss-bf.org ... UNREACHABLE
  Testing corisbank.com ... UNREACHABLE
  Testing www.corisbank.com ... UNREACHABLE
  Testing bceao.bj ... UNREACHABLE
  Testing www.bceao.bj ... UNREACHABLE
  Testing brvm.org ... UNREACHABLE
  Testing www.brvm.org ... HTTPS -> HTTP 200 Server: nginx
  Testing sonabel.bf ... UNREACHABLE
  Testing www.sonabel.bf ... UNREACHABLE
  Testing orange-bf.com ... UNREACHABLE
  Testing www.orange-bf.com ... UNREACHABLE

[*] Alternate domain sweep complete.


########################################################################
#           DEEP DIVE: MOOV-AFRICA.BF (WORDPRESS + WOOCOMMERCE)       #
########################################################################

--- WP REST API Enumeration ---
  /wp-json/wp/v2/users
    HTTP: 200 | Size: 800 bytes
    Preview: 
[{"id":1,"name":"d.coulibaly@moov-africa.bf","url":"https:\/\/moov-africa.bf","description":"","link":"https:\/\/moov-africa.bf\/author\/d-coulibalymoov-africa-bf\/","slug":"d-coulibalymoov-africa-bf","meta":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>d.coulibaly@moov-africa.bf, auteur\/autrice sur Moov Africa Burkina Faso : le leader des t\u00e9l\u00e9communications au Faso<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \

  /wp-json/wp/v2/posts
    HTTP: 200 | Size: 800 bytes
    Preview: 
[{"id":503,"date":"2026-02-03T17:42:42","date_gmt":"2026-02-03T16:42:42","guid":{"rendered":"https:\/\/moov-africa.bf\/?p=503"},"modified":"2026-02-06T17:43:52","modified_gmt":"2026-02-06T16:43:52","slug":"moov-africa-burkina-launches-construction-work-on-its-new-headquarters","status":"publish","type":"post","link":"https:\/\/moov-africa.bf\/en\/moov-africa-burkina-launches-construction-work-on-its-new-headquarters\/","title":{"rendered":"Moov Africa Burkina launches construction work on its new headquarters"},"content":{"rendered":"<p style=\"text-align: justify;\">La Ministre de la Transit

  /wp-json/wp/v2/pages
    HTTP: 200 | Size: 800 bytes
    Preview: 
[{"id":572,"date":"2026-02-13T10:01:00","date_gmt":"2026-02-13T10:01:00","guid":{"rendered":"https:\/\/moov-africa.bf\/?page_id=572"},"modified":"2026-02-13T10:24:52","modified_gmt":"2026-02-13T10:24:52","slug":"forfait-postpaye","status":"publish","type":"page","link":"https:\/\/moov-africa.bf\/forfait-postpaye\/","title":{"rendered":"Forfait Postpay\u00e9"},"content":{"rendered":"<p><strong><span style=\"color: #ff6600;\">FORFAITS LIBERTIS SANS ENGAGEMENT<\/span><\/strong><\/p>\n<p style=\"text-align: justify;\">C\u2019est un abonnement libre et sans obligation de reconduction; constitu\u00

  /wp-json/wp/v2/categories
    HTTP: 200 | Size: 800 bytes
    Preview: 
[{"id":110,"count":5,"description":"","link":"https:\/\/moov-africa.bf\/espace-actionnaire\/cours-de-bourse\/","name":"Actions ONATEL BF","slug":"cours-de-bourse","taxonomy":"category","parent":92,"meta":[],"z_taxonomy_image_url":"https:\/\/moov-africa.bf\/wp-content\/plugins\/categories-images\/assets\/images\/placeholder.png","yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Archives des Actions ONATEL BF - Moov Africa Burkina Faso : le leader des t\u00e9l\u00e9communications au Faso<\/title>\n<meta na

  /wp-json/wp/v2/tags
    HTTP: 200 | Size: 800 bytes
    Preview: 
[{"id":37,"count":0,"description":"","link":"https:\/\/moov-africa.bf\/tag\/4g\/","name":"4G+","slug":"4g","taxonomy":"post_tag","meta":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Archives des 4G+ - Moov Africa Burkina Faso : le leader des t\u00e9l\u00e9communications au Faso<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/moov-africa.bf\/tag\/4g\/\" \/>\n<meta property=\"og:loc

  /wp-json/wp/v2/media
    HTTP: 200 | Size: 800 bytes
    Preview: 
[{"id":585,"date":"2026-03-02T14:48:58","date_gmt":"2026-03-02T14:48:58","guid":{"rendered":"https:\/\/moov-africa.bf\/wp-content\/uploads\/2026\/03\/vinoogoo.jpeg"},"modified":"2026-03-02T14:48:58","modified_gmt":"2026-03-02T14:48:58","slug":"vinoogoo","status":"inherit","type":"attachment","link":"https:\/\/moov-africa.bf\/forfait-vinoogo\/vinoogoo\/","title":{"rendered":"vinoogoo"},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","template":"","meta":[],"class_list":["post-585","attachment","type-attachment","status-inherit","hentry"],"description":{"rendered"

  /wp-json/wp/v2/comments
    HTTP: 403 | Size: 90 bytes

  /wp-json/wp/v2/types
    HTTP: 200 | Size: 800 bytes
    Preview: 
{"post":{"description":"","hierarchical":false,"has_archive":false,"name":"Articles","slug":"post","icon":"dashicons-admin-post","taxonomies":["category","post_tag"],"rest_base":"posts","rest_namespace":"wp\/v2","template":[],"template_lock":false,"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Moov Africa Burkina Faso : le leader des t\u00e9l\u00e9communications au Faso -<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link

  /wp-json/wp/v2/statuses
    HTTP: 200 | Size: 800 bytes
    Preview: 
{"publish":{"name":"Publi\u00e9","public":true,"queryable":true,"slug":"publish","date_floating":false,"_links":{"archives":[{"href":"https:\/\/moov-africa.bf\/wp-json\/wp\/v2\/posts"}]}},"tribe-ea-success":{"name":"Import\u00e9","public":true,"queryable":false,"slug":"tribe-ea-success","date_floating":false,"_links":{"archives":[{"href":"https:\/\/moov-africa.bf\/wp-json\/wp\/v2\/posts?status=tribe-ea-success"}]}},"tribe-ea-failed":{"name":"Echec","public":true,"queryable":false,"slug":"tribe-ea-failed","date_floating":false,"_links":{"archives":[{"href":"https:\/\/moov-africa.bf\/wp-json\/w

  /wp-json/wp/v2/taxonomies
    HTTP: 200 | Size: 800 bytes
    Preview: 
{"category":{"name":"Cat\u00e9gories","slug":"category","description":"","types":["post","page"],"hierarchical":true,"rest_base":"categories","rest_namespace":"wp\/v2","_links":{"collection":[{"href":"https:\/\/moov-africa.bf\/wp-json\/wp\/v2\/taxonomies"}],"wp:items":[{"href":"https:\/\/moov-africa.bf\/wp-json\/wp\/v2\/categories"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},"post_tag":{"name":"\u00c9tiquettes","slug":"post_tag","description":"","types":["post","page","tribe_events","tec_calendar_embed"],"hierarchical":false,"rest_base":"tags","rest_names

  /wp-json/wp/v2/search?search=admin
    HTTP: 200 | Size: 800 bytes
    Preview: 
[{"id":503,"title":"Moov Africa Burkina launches construction work on its new headquarters","url":"https:\/\/moov-africa.bf\/en\/moov-africa-burkina-launches-construction-work-on-its-new-headquarters\/","type":"post","subtype":"post","_links":{"self":[{"embeddable":true,"href":"https:\/\/moov-africa.bf\/wp-json\/wp\/v2\/posts\/503","targetHints":{"allow":["GET"]}}],"about":[{"href":"https:\/\/moov-africa.bf\/wp-json\/wp\/v2\/types\/post"}],"collection":[{"href":"https:\/\/moov-africa.bf\/wp-json\/wp\/v2\/search"}]}},{"id":285,"title":"Moov Africa Burkina lance les travaux de construction de s

  /wp-json/wp/v2/settings
    HTTP: 401 | Size: 134 bytes

  /wp-json/wp/v2/plugins
    HTTP: 401 | Size: 170 bytes

  /wp-json/wp/v2/themes
    HTTP: 401 | Size: 153 bytes

  /wp-json/yoast/v1/get_head?url=https://moov-africa.bf/
    HTTP: 200 | Size: 800 bytes
    Preview: 
{"html":"<!-- This site is optimized with the Yoast SEO plugin v27.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Moov Africa Burkina Faso : le leader des t\u00e9l\u00e9communications au Faso -<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/moov-africa.bf\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"website\" \/>\n<meta property=\"og:title\" content=\"Moov Africa Burkina Faso : le leader des t\u00e9l\u

  /wp-json/tribe/events/v1/events
    HTTP: 200 | Size: 210 bytes
    Preview: 
{"events":[],"rest_url":"https:\/\/moov-africa.bf\/wp-json\/tribe\/events\/v1\/events\/?page=1&per_page=10&start_date=2026-03-03 00:00:00&end_date=2028-03-04 23:59:59&status=publish","total":0,"total_pages":0}

  /wp-json/wc/v3/products
    HTTP: 401 | Size: 134 bytes

  /wp-json/wc/store/v1/products
    HTTP: 200 | Size: 800 bytes
    Preview: 
[{"id":277,"name":"Modem FTTH Huawei OptiXStar HG8145X6-10","slug":"modem-ftth-huawei-optixstar-hg8145x6-10","parent":0,"type":"simple","variation":"","permalink":"https:\/\/moov-africa.bf\/produit\/modem-ftth-huawei-optixstar-hg8145x6-10\/","sku":"","short_description":"<p><strong>Modem FTTH Huawei OptiXStar HG8145X6-10<\/strong><\/p>\n<p>Huawei HG8145X6 ONT est un terminal WIFI 6 double bande, bande 5G et 2,4G, dans la bande 5G il dispose de la norme IEEE 802.11 WIFI\/n\/ac\/AX, et dans la bande 2,4G il dispose de la norme IEEE 802.11 b\/g\/AX. Il dispose de 2 antennes externes et est MIMO 

  /wp-json/wc/store/v1/cart
    HTTP: 200 | Size: 800 bytes
    Preview: 
{"items":[],"coupons":[],"fees":[],"totals":{"total_items":"0","total_items_tax":"0","total_fees":"0","total_fees_tax":"0","total_discount":"0","total_discount_tax":"0","total_shipping":null,"total_shipping_tax":null,"total_price":"0","total_tax":"0","tax_lines":[],"currency_code":"XOF","currency_symbol":"CFA","currency_minor_unit":0,"currency_decimal_separator":",","currency_thousand_separator":" ","currency_prefix":"","currency_suffix":" CFA"},"shipping_address":{"first_name":"","last_name":"","company":"","address_1":"","address_2":"","city":"","state":"","postcode":"","country":"BF","phon

  /wp-json/contact-form-7/v1/contact-forms
    HTTP: 403 | Size: 156 bytes

  /wp-json/pll/v1/languages
    HTTP: 200 | Size: 800 bytes
    Preview: 
[{"name":"Fran\u00e7ais","slug":"fr","term_group":0,"term_id":2,"locale":"fr_FR","is_rtl":false,"w3c":"fr-FR","facebook":"fr_FR","home_url":"https:\/\/moov-africa.bf\/","search_url":"https:\/\/moov-africa.bf\/","host":"","page_on_front":0,"page_for_posts":0,"flag_code":"fr","flag_url":"https:\/\/moov-africa.bf\/wp-content\/plugins\/polylang\/flags\/fr.png","flag":"<img src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAALCAMAAABBPP0LAAAAbFBMVEVzldTg4ODS0tLxDwDtAwDjAADD0uz39\/fy8vL3k4nzgna4yOixwuXu7u7s6+zn5+fyd2rvcGPtZljYAABrjNCpvOHrWkxegsqfs93NAADpUUFRd8THAABBa7wnVbERRKa8vLyxsLCoqKigo

  /wp-json/wp-statistics/v2/hit
    HTTP: 404 | Size: 184 bytes

  /wp-json/jetpack/v4/module/all
    HTTP: 401 | Size: 134 bytes

  /wp-json/jetpack/v4/site
    HTTP: 401 | Size: 285 bytes

  /?author=1
    HTTP: 200 | Size: 800 bytes
    Preview: 

<!doctype html>
<html class="no-js" lang="fr-FR">
	<head>
		<meta charset="UTF-8">
		<meta http-equiv="x-ua-compatible" content="ie=edge">
		<title>Moov Africa Burkina Faso : le leader des télécommunications au Faso</title>
		<meta name="robots" content="noindex, follow">
		<meta name="description" content="">
		<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
		<!-- Favicon
		<link rel="shortcut icon" type="image/x-icon" href="images/favicon.png">  -->
		
		<!--WordPress head-->
        <meta name='robots' content='index, follow, max-image-preview:lar

  /?author=2
    HTTP: 200 | Size: 800 bytes
    Preview: 

<!doctype html>
<html class="no-js" lang="fr-FR">
	<head>
		<meta charset="UTF-8">
		<meta http-equiv="x-ua-compatible" content="ie=edge">
		<title>Moov Africa Burkina Faso : le leader des télécommunications au Faso</title>
		<meta name="robots" content="noindex, follow">
		<meta name="description" content="">
		<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
		<!-- Favicon
		<link rel="shortcut icon" type="image/x-icon" href="images/favicon.png">  -->
		
		<!--WordPress head-->
        <meta name='robots' content='index, follow, max-image-preview:lar

  /wp-json/wp/v2/users?per_page=100
    HTTP: 200 | Size: 800 bytes
    Preview: 
[{"id":1,"name":"d.coulibaly@moov-africa.bf","url":"https:\/\/moov-africa.bf","description":"","link":"https:\/\/moov-africa.bf\/author\/d-coulibalymoov-africa-bf\/","slug":"d-coulibalymoov-africa-bf","meta":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>d.coulibaly@moov-africa.bf, auteur\/autrice sur Moov Africa Burkina Faso : le leader des t\u00e9l\u00e9communications au Faso<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \

  /xmlrpc.php
    HTTP: 405 | Size: 43 bytes

  /wp-cron.php
    HTTP: 200 | Size: 0 bytes

  /readme.html
    HTTP: 200 | Size: 800 bytes
    Preview: <!DOCTYPE html>
<html lang="en">
<head>
	<meta name="viewport" content="width=device-width" />
	<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
	<meta name="robots" content="noindex,nofollow" />
	<title>WordPress &#8250; ReadMe</title>
	<link rel="stylesheet" href="wp-admin/css/install.css?ver=20100228" type="text/css" />
</head>
<body>
<h1 id="logo">
	<a href="https://wordpress.org/"><img alt="WordPress" src="wp-admin/images/wordpress-logo.png" /></a>
</h1>
<p style="text-align: center">Semantic Personal Publishing Platform</p>

<h2>First Things First</h2>
<p>Welcome. Wo

  /license.txt
    HTTP: 200 | Size: 800 bytes
    Preview: WordPress - Web publishing software

Copyright 2011-2025 by the contributors

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU Gen

  /wp-includes/version.php
    HTTP: 200 | Size: 0 bytes

  /wp-content/debug.log
    HTTP: 404 | Size: 800 bytes

  /wp-content/uploads/
    HTTP: 200 | Size: 800 bytes
    Preview: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html>
 <head>
  <title>Index of /wp-content/uploads</title>
 </head>
 <body>
<h1>Index of /wp-content/uploads</h1>
  <table>
   <tr><th valign="top"><img src="/icons/blank.gif" alt="[ICO]"></th><th><a href="?C=N;O=D">Name</a></th><th><a href="?C=M;O=A">Last modified</a></th><th><a href="?C=S;O=A">Size</a></th><th><a href="?C=D;O=A">Description</a></th></tr>
   <tr><th colspan="5"><hr></th></tr>
<tr><td valign="top"><img src="/icons/back.gif" alt="[PARENTDIR]"></td><td><a href="/wp-content/">Parent Directory</a>       </td><td>&nbsp;</td>

  /wp-content/plugins/
    HTTP: 200 | Size: 0 bytes

  /wp-content/themes/
    HTTP: 200 | Size: 0 bytes



########################################################################
#           DEEP DIVE: ONEA.BF (WORDPRESS)                            #
########################################################################

--- WP REST API Enumeration ---
  /wp-json/wp/v2/users
    HTTP: 429 | Size: 16 bytes

  /wp-json/wp/v2/users?per_page=100
    HTTP: 429 | Size: 16 bytes

  /wp-json/wp/v2/posts
    HTTP: 429 | Size: 16 bytes

  /wp-json/wp/v2/pages
    HTTP: 429 | Size: 16 bytes

  /wp-json/wp/v2/categories
    HTTP: 429 | Size: 16 bytes

  /wp-json/wp/v2/tags
    HTTP: 429 | Size: 16 bytes

  /wp-json/wp/v2/media
    HTTP: 429 | Size: 16 bytes

  /wp-json/wp/v2/comments
    HTTP: 429 | Size: 16 bytes

  /wp-json/wp/v2/types
    HTTP: 429 | Size: 16 bytes

  /wp-json/wp/v2/statuses
    HTTP: 429 | Size: 16 bytes

  /wp-json/wp/v2/taxonomies
    HTTP: 429 | Size: 16 bytes

  /wp-json/wp/v2/search?search=admin
    HTTP: 429 | Size: 16 bytes

  /wp-json/wp/v2/settings
    HTTP: 429 | Size: 16 bytes

  /wp-json/wp/v2/plugins
    HTTP: 429 | Size: 16 bytes

  /wp-json/wp/v2/themes
    HTTP: 429 | Size: 16 bytes

  /wp-json/contact-form-7/v1/contact-forms
    HTTP: 429 | Size: 16 bytes

  /wp-json/mec/v1/events
    HTTP: 429 | Size: 16 bytes

  /wp-json/elementor-one/v1/
    HTTP: 429 | Size: 16 bytes

  /wp-json/the7/v1/
    HTTP: 429 | Size: 16 bytes

  /wp-json/jetpack/v4/module/all
    HTTP: 429 | Size: 16 bytes

  /wp-json/jetpack/v4/site
    HTTP: 429 | Size: 16 bytes

  /wp-json/nfd-editor-chat/v1/
    HTTP: 429 | Size: 16 bytes

  /wp-json/bluehost/v1/
    HTTP: 429 | Size: 16 bytes

  /?author=1
    HTTP: 429 | Size: 16 bytes

  /?author=2
    HTTP: 429 | Size: 16 bytes

  /xmlrpc.php
    HTTP: 429 | Size: 16 bytes

  /wp-cron.php
    HTTP: 429 | Size: 16 bytes

  /readme.html
    HTTP: 429 | Size: 16 bytes

  /license.txt
    HTTP: 429 | Size: 16 bytes

  /wp-content/debug.log
    HTTP: 429 | Size: 16 bytes

  /wp-content/uploads/
    HTTP: 429 | Size: 16 bytes

  /wp-content/plugins/
    HTTP: 429 | Size: 16 bytes

  /wp-content/themes/
    HTTP: 429 | Size: 16 bytes



########################################################################
#           DEEP DIVE: ECOBANK.COM (ASP.NET)                          #
########################################################################

--- Ecobank Specific Endpoints ---
  /personal-banking
    HTTP: 200 | Size: 800 bytes
    [Default homepage redirect - not a real API endpoint]

  /bf
    HTTP: 200 | Size: 800 bytes
    [Default homepage redirect - not a real API endpoint]

  /bf/personal-banking
    HTTP: 200 | Size: 800 bytes
    [Default homepage redirect - not a real API endpoint]

  /api/ecobank
    HTTP: 200 | Size: 800 bytes
    [Default homepage redirect - not a real API endpoint]

  /api/agency
    HTTP: 200 | Size: 800 bytes
    [Default homepage redirect - not a real API endpoint]

  /api/atm
    HTTP: 200 | Size: 800 bytes
    [Default homepage redirect - not a real API endpoint]

  /api/content
    HTTP: 200 | Size: 800 bytes
    [Default homepage redirect - not a real API endpoint]

  /api/rates
    HTTP: 200 | Size: 800 bytes
    [Default homepage redirect - not a real API endpoint]

  /api/exchange
    HTTP: 200 | Size: 800 bytes
    [Default homepage redirect - not a real API endpoint]

  /api/news
    HTTP: 200 | Size: 800 bytes
    [Default homepage redirect - not a real API endpoint]

  /ContentHandler.ashx
    HTTP: 405 | Size: 799 bytes

  /api/personal
    HTTP: 200 | Size: 800 bytes
    [Default homepage redirect - not a real API endpoint]

  /api/corporate
    HTTP: 200 | Size: 800 bytes
    [Default homepage redirect - not a real API endpoint]

  /api/digital
    HTTP: 200 | Size: 800 bytes
    [Default homepage redirect - not a real API endpoint]

  /api/branches
    HTTP: 200 | Size: 800 bytes
    [Default homepage redirect - not a real API endpoint]

  /api/countries
    HTTP: 200 | Size: 800 bytes
    [Default homepage redirect - not a real API endpoint]

  /api/locale
    HTTP: 200 | Size: 800 bytes
    [Default homepage redirect - not a real API endpoint]

  /api/search
    HTTP: 200 | Size: 800 bytes
    [Default homepage redirect - not a real API endpoint]

  /api/products
    HTTP: 200 | Size: 800 bytes
    [Default homepage redirect - not a real API endpoint]

  /ice.ecobank.com
    HTTP: 404 | Size: 800 bytes

  /digitalonline.ecobank.com
    HTTP: 404 | Size: 800 bytes

  /secure.ecobank.com
    HTTP: 404 | Size: 800 bytes


--- Ecobank Subdomains ---
  secure.ecobank.com ... HTTPS 302 SERVER: 
  digitalonline.ecobank.com ... HTTPS 404 
  ice.ecobank.com ... UNREACHABLE
  api.ecobank.com ... UNREACHABLE
  mobile.ecobank.com ... UNREACHABLE
  portal.ecobank.com ... UNREACHABLE
  ibank.ecobank.com ... UNREACHABLE
  ebanking.ecobank.com ... UNREACHABLE
  pay.ecobank.com ... UNREACHABLE
  gateway.ecobank.com ... UNREACHABLE
  merchant.ecobank.com ... UNREACHABLE
  developer.ecobank.com ... HTTPS 302 Server: BigIP
  developers.ecobank.com ... UNREACHABLE
  openbanking.ecobank.com ... UNREACHABLE



########################################################################
#     DEEP DIVE: SOCIETEGENERALE.BF (TYPO3/NGINX/IMPERVA)             #
########################################################################

--- SocGen BF Endpoint Enumeration ---
  /fr/
    HTTP: 200 | Size: 800 bytes
    Preview: <!DOCTYPE html>
<html dir="ltr" lang="fr-FR">
<head>

<meta charset="utf-8">


<base href="https://societegenerale.bf/">



<meta name="viewport" content="user-scalable=no, initial-scale=1.0, maximum-scale=1, width=device-width" />
<meta name="twitter:card" content="summary" />
<meta name="format-detection" content="telephone=no" />















<title>Burkina Faso </title><meta name="title" con

  /en/
    HTTP: 200 | Size: 800 bytes
    Preview: <!DOCTYPE html>
<html dir="ltr" lang="fr-FR">
<head>

<meta charset="utf-8">


<base href="https://societegenerale.bf/">



<meta name="viewport" content="user-scalable=no, initial-scale=1.0, maximum-scale=1, width=device-width" />
<meta name="twitter:card" content="summary" />
<meta name="format-detection" content="telephone=no" />















<title>Burkina Faso </title><meta name="title" con

  /typo3/
    HTTP: 403 | Size: 226 bytes

  /typo3/login
    HTTP: 403 | Size: 224 bytes

  /typo3conf/
    HTTP: 403 | Size: 272 bytes

  /typo3conf/LocalConfiguration.php
    HTTP: 200 | Size: 0 bytes

  /typo3conf/ext/
    HTTP: 403 | Size: 272 bytes

  /fileadmin/
    HTTP: 403 | Size: 272 bytes

  /fileadmin/_processed_/
    HTTP: 403 | Size: 272 bytes

  /uploads/
    HTTP: 403 | Size: 273 bytes

  /typo3temp/
    HTTP: 403 | Size: 273 bytes

  /sitemaps.xml
    HTTP: 404 | Size: 800 bytes

  /sitemap.xml
    HTTP: 404 | Size: 800 bytes

  /sitemap_index.xml
    HTTP: 404 | Size: 800 bytes

  /?type=1533906435
    HTTP: 200 | Size: 800 bytes
    Preview: <!DOCTYPE html>
<html dir="ltr" lang="fr-FR">
<head>

<meta charset="utf-8">


<base href="https://societegenerale.bf/">



<meta name="viewport" content="user-scalable=no, initial-scale=1.0, maximum-scale=1, width=device-width" />
<meta name="twitter:card" content="summary" />
<meta name="format-detection" content="telephone=no" />















<title>Burkina Faso </title><meta name="title" con

  /?type=98765
    HTTP: 200 | Size: 800 bytes
    Preview: <!DOCTYPE html>
<html dir="ltr" lang="fr-FR">
<head>

<meta charset="utf-8">


<base href="https://societegenerale.bf/">



<meta name="viewport" content="user-scalable=no, initial-scale=1.0, maximum-scale=1, width=device-width" />
<meta name="twitter:card" content="summary" />
<meta name="format-detection" content="telephone=no" />















<title>Burkina Faso </title><meta name="title" con

  /api/
    HTTP: 404 | Size: 800 bytes

  /api/v1/
    HTTP: 404 | Size: 800 bytes

  /rest/
    HTTP: 404 | Size: 800 bytes

  /graphql
    HTTP: 404 | Size: 800 bytes

  /swagger
    HTTP: 404 | Size: 800 bytes

  /particuliers
    HTTP: 404 | Size: 800 bytes

  /entreprises
    HTTP: 404 | Size: 800 bytes

  /professionnels
    HTTP: 404 | Size: 800 bytes

  /contact
    HTTP: 404 | Size: 800 bytes

  /mentions-legales
    HTTP: 404 | Size: 800 bytes

  /recherche
    HTTP: 404 | Size: 800 bytes

  /agences
    HTTP: 404 | Size: 800 bytes



########################################################################
#     DEEP DIVE: BOAD.ORG (LARAVEL/VUE/INERTIA)                      #
########################################################################

--- BOAD Endpoint Enumeration ---
  /fr
    HTTP: 200 | Size: 800 bytes
    Preview: <!DOCTYPE html>
<html lang="fr" class="overflow-x-hidden">

<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1 maximum-scale=5">

    <!-- Favicon -->
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
    <link rel="manifest" href="/site.webmanifest">
    <li

  /en
    HTTP: 200 | Size: 800 bytes
    Preview: <!DOCTYPE html>
<html lang="en" class="overflow-x-hidden">

<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1 maximum-scale=5">

    <!-- Favicon -->
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
    <link rel="manifest" href="/site.webmanifest">
    <li

  /api/
    HTTP: 404 | Size: 800 bytes

  /api/v1/
    HTTP: 404 | Size: 800 bytes

  /api/projects
    HTTP: 404 | Size: 800 bytes

  /api/publications
    HTTP: 404 | Size: 800 bytes

  /api/news
    HTTP: 404 | Size: 800 bytes

  /api/events
    HTTP: 404 | Size: 800 bytes

  /api/countries
    HTTP: 404 | Size: 800 bytes

  /api/members
    HTTP: 404 | Size: 800 bytes

  /api/tenders
    HTTP: 404 | Size: 800 bytes

  /api/search
    HTTP: 404 | Size: 800 bytes

  /graphql
    HTTP: 404 | Size: 800 bytes

  /login
    HTTP: 404 | Size: 800 bytes

  /register
    HTTP: 404 | Size: 800 bytes

  /admin
    HTTP: 404 | Size: 800 bytes

  /nova
    HTTP: 404 | Size: 800 bytes

  /horizon
    HTTP: 404 | Size: 800 bytes

  /telescope
    HTTP: 404 | Size: 800 bytes

  /telescope/requests
    HTTP: 404 | Size: 800 bytes

  /_ignition/health-check
    HTTP: 404 | Size: 800 bytes

  /_debugbar/open
    HTTP: 404 | Size: 800 bytes

  /storage/
    HTTP: 403 | Size: 138 bytes

  /storage/logs/
    HTTP: 404 | Size: 800 bytes

  /public/storage/
    HTTP: 404 | Size: 800 bytes

  /sitemap_index.xml
    HTTP: 200 | Size: 800 bytes
    Preview: <?xml version="1.0" encoding="UTF-8"?>
<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
    <sitemap>
        <loc>https://www.boad.org/contacts_sitemap.xml</loc>
            <lastmod>2026-03-02T16:41:19+00:00</lastmod>
    </sitemap>
    <sitemap>
        <loc>https://www.boad.org/definitions_sitemap.xml</loc>
            <lastmod>2026-03-02T16:41:20+00:00</lastmod>
    </sitemap>
    <sitemap>
        <loc>https://www.boad.org/documents_sitemap.xml</loc>
            <lastmod>

  /sitemap.xml
    HTTP: 404 | Size: 800 bytes

  /feed
    HTTP: 404 | Size: 800 bytes

  /.well-known/security.txt
    HTTP: 404 | Size: 800 bytes

  /composer.json
    HTTP: 404 | Size: 800 bytes

  /package.json
    HTTP: 404 | Size: 800 bytes

  /mix-manifest.json
    HTTP: 404 | Size: 800 bytes

  /build/assets/
    HTTP: 403 | Size: 138 bytes

  /vendor/
    HTTP: 403 | Size: 138 bytes

  /artisan
    HTTP: 404 | Size: 800 bytes

  /env
    HTTP: 404 | Size: 800 bytes

  /config/app.php
    HTTP: 404 | Size: 15 bytes



########################################################################
#     DEEP DIVE: AIR-BURKINA.COM (TYPO3/PLESK)                       #
########################################################################

--- Air Burkina Endpoint Enumeration ---
  /fr/
    HTTP: 000 | Size: 0 bytes

  /en/
    HTTP: 000 | Size: 0 bytes

  /typo3/
    HTTP: 000 | Size: 0 bytes

  /typo3/login
    HTTP: 000 | Size: 0 bytes

  /typo3conf/
    HTTP: 000 | Size: 0 bytes

  /typo3conf/LocalConfiguration.php
    HTTP: 000 | Size: 0 bytes

  /typo3conf/ext/
    HTTP: 000 | Size: 0 bytes

  /fileadmin/
    HTTP: 000 | Size: 0 bytes

  /fileadmin/_processed_/
    HTTP: 000 | Size: 0 bytes

  /uploads/
    HTTP: 000 | Size: 0 bytes

  /typo3temp/
    HTTP: 000 | Size: 0 bytes

  /sitemap.xml
    HTTP: 000 | Size: 0 bytes

  /api/
    HTTP: 000 | Size: 0 bytes

  /api/v1/
    HTTP: 000 | Size: 0 bytes

  /rest/
    HTTP: 404 | Size: 800 bytes

  /graphql
    HTTP: 404 | Size: 800 bytes

  /reservations
    HTTP: 404 | Size: 800 bytes

  /booking
    HTTP: 404 | Size: 800 bytes

  /destinations
    HTTP: 404 | Size: 800 bytes

  /tarifs
    HTTP: 404 | Size: 800 bytes

  /horaires
    HTTP: 404 | Size: 800 bytes

  /contact
    HTTP: 404 | Size: 800 bytes

  /agences
    HTTP: 404 | Size: 800 bytes



########################################################################
#     NEWLY DISCOVERED LIVE DOMAINS - FULL PROBE                      #
########################################################################

== www.coris-bank.com ==
  / -> HTTP 301 (0b)
  /wp-json/ -> HTTP 301 (0b)
  /api/ -> HTTP 301 (0b)
  /robots.txt -> HTTP 301 (0b)
  /api/index.php/v1 -> HTTP 301 (0b)
  /admin -> HTTP 301 (0b)
  /administrator/ -> HTTP 301 (0b)
  /login -> HTTP 301 (0b)
  /.env -> HTTP 301 (0b)
  /.git/HEAD -> HTTP 301 (0b)
  /wp-admin/ -> HTTP 301 (0b)
  /swagger -> HTTP 301 (0b)

== www.corisbank.bf ==
  / -> HTTP 200 (400b)
    <!doctype html><html lang="fr-FR" prefix="og: https://ogp.me/ns#"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="http://gmpg.org/xfn/11">  <script async src="https://www.googletagmanager.com/gtag/js?id=UA-156337342-5"></scrip
  /wp-json/ -> HTTP 200 (400b)
    {"name":"Coris Bank International B\u00e9nin, votre banque au B\u00e9nin","description":"la banque Autrement","url":"https:\/\/benin.coris.bank","home":"https:\/\/benin.coris.bank","gmt_offset":1,"timezone_string":"Africa\/Porto-Novo","namespaces":["oembed\/1.0","fluent-smtp","akismet\/v1","jetpack\
  /api/ -> HTTP 404 (400b)
  /robots.txt -> HTTP 200 (119b)
    User-agent: *
Disallow: /wp-admin/
Allow: /wp-admin/admin-ajax.php

Sitemap: https://benin.coris.bank/sitemap_index.xml
  /api/index.php/v1 -> HTTP 404 (400b)
  /admin -> HTTP 200 (400b)
    <!DOCTYPE html>
	<html lang="fr-FR">
	<head>
	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
	<title>Se connecter &lsaquo; Coris Bank International Bénin, votre banque au Bénin &#8212; WordPress</title>
	<meta name='robots' content='max-image-preview:large, noindex, noarchiv
  /administrator/ -> HTTP 404 (400b)
  /login -> HTTP 200 (400b)
    <!DOCTYPE html>
	<html lang="fr-FR">
	<head>
	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
	<title>Se connecter &lsaquo; Coris Bank International Bénin, votre banque au Bénin &#8212; WordPress</title>
	<meta name='robots' content='max-image-preview:large, noindex, noarchiv
  /.env -> HTTP 404 (400b)
  /.git/HEAD -> HTTP 404 (400b)
  /wp-admin/ -> HTTP 200 (400b)
    <!DOCTYPE html>
	<html lang="fr-FR">
	<head>
	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
	<title>Se connecter &lsaquo; Coris Bank International Bénin, votre banque au Bénin &#8212; WordPress</title>
	<meta name='robots' content='max-image-preview:large, noindex, noarchiv
  /swagger -> HTTP 404 (400b)

== www.bceao.int ==
--- Headers ---
HTTP/1.1 200 OK
Server: nginx/1.20.1
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Cache-Control: max-age=21600, public
Date: Wed, 04 Mar 2026 06:02:44 GMT
X-Drupal-Dynamic-Cache: MISS
Link: <https://www.bceao.int/fr>; rel="canonical", <https://www.bceao.int/fr>; rel="shortlink"
X-UA-Compatible: IE=edge
Content-language: fr
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Drupal-Cache-Tags: block_content:1 block_content:10 block_content:11 block_content:12 block_content:13 block_content:15 block_content:16 block_content:17 block_content:18 block_content:19 block_content:2 block_content:23 block_content:24 block_content:25 block_content:26 block_content:27 block_content:28 block_content:29 block_content:3 block_content:36 block_content:37 block_content:4 block_content:42 block_content:43 block_content:45 block_content:46 block_content:47 block_content:49 block_content:5 block_content:50 block_content:51 block_content:53 block_content:6 block_content:66 block_content:68 block_content:69 block_content:7 block_content:70 block_content:71 block_content:72 block_content:73 block_content:74 block_content:79 block_content:8 block_content:80 block_content:81 block_content:9 block_content:98 block_content_view block_view config:block.block.accesrapide config:block.block.albumcpmdecembre2018 config:block.block.application config:block.block.articleslies config:block.block.autrespublications config:block.block.autrespublications_2 config:block.block.banknotesandcoins config:block.block.bannerright config:block.block.bceaoannualreport config:block.block.bloc_billetpice_right config:block.block.bloc_right_edition2018_prix config:block.block.bloc_right_stat config:block.block.bloc_toutes_publications config:block.block.blocdevise config:block.block.blocdevise_2 config:block.block.blocktabshometabs1 config:block.block.blocktabshometabs1_2 config:block.block.blocktabshometabs2 config:block.block.blocktabshometabsen config:block.block.blocktype1 config:block.block.blocktype2 config:block.block.blocktype3 config:block.block.blocmenustatistique config:block.block.blocmenustatistique_2 config:block.block.bouton config:block.block.brokenmissing config:block.block.candidaturesinternes config:block.block.cofeb config:block.block.cofebdocright config:block.block.companyperformance config:block.block.companyperformance2525 config:block.block.conferencesurlia config:block.block.consultezaussi config:block.block.contactgris config:block.block.contactopenclose config:block.block.conventionregissantlacommissionbancairedelumoa config:block.block.coursdesdevisescontrefranccfa config:block.block.coursdesdevisescontrefranccfa_2 config:block.block.customjs config:block.block.decouvrezaussi config:block.block.decouvrezlesaccesrapides config:block.block.devise config:block.block.devise2 config:block.block.documentacaorelativaaopremio config:block.block.documentationrelativeauprix config:block.block.documentsutilesdelaformation config:block.block.educationfinanciere config:block.block.educationfinanciere_2 config:block.block.emissionmonetaire config:block.block.etablissementsdecredit config:block.block.etudesetrecherches config:block.block.etudesetrecherches_2 config:block.block.etudesetrecherches_3 config:block.block.exposedformsearch_bceaopage_1 config:block.block.exposedformsearch_bceaopage_1_2 config:block.block.facetbceaocontenttype config:block.block.faq_bic config:block.block.faq_fintech config:block.block.faq_inclusion config:block.block.faq_prix config:block.block.faqtext config:block.block.faqtext_2 config:block.block.footercopyright config:block.block.footeren config:block.block.formulairespourlesprofessionnels config:block.block.galerieconference config:block.block.galerieconference_2 config:block.block.galeriephotoconferenceinternationale config:block.block.inclusion_financiere_salon config:block.block.inscription_prix config:block.block.interventiontiemoko config:block.block.interventiontiemoko_2 config:block.block.interventiontiemokoindex config:block.block.lacommissionbancaire config:block.block.languageswitchercontent config:block.block.lesorganesdelabceao config:block.block.lesorganesquiassurentlefonctionnementdelumoa config:block.block.lesorganesquiassurentlefonctionnementdelumoasont config:block.block.liensutiles config:block.block.linksaccesrapide config:block.block.mainnavigation config:block.block.mainnavigationen config:block.block.marchedestitrespublicsetprivesemisparappelpublic config:block.block.marchemonetaire config:block.block.marchespublicsachats config:block.block.medianet_account_menu config:block.block.medianet_branding config:block.block.medianet_breadcrumbs config:block.block.medianet_content config:block.block.medianet_footer config:block.block.medianet_help config:block.block.medianet_local_actions config:block.block.medianet_local_tasks config:block.block.medianet_main_menu config:block.block.medianet_messages config:block.block.medianet_powered config:block.block.medianet_search config:block.block.medianet_tools config:block.block.menu1bloc config:block.block.menu1bloc2 config:block.block.menu_bceao config:block.block.menu_billet_right config:block.block.menu_billetetpiece config:block.block.menu_politiquemonetaire config:block.block.menu_stabilitefinanciere config:block.block.menutop config:block.block.menutopen config:block.block.messagenooffres config:block.block.museedelamonnaie config:block.block.newsletter config:block.block.paf2018 config:block.block.pagetitle config:block.block.planstrategique20162018 config:block.block.presentationjuridique config:block.block.prixabdoulayefadiga config:block.block.prixabdoulayefadiga2 config:block.block.promotiondebancarisation config:block.block.promotiondebancarisation_2 config:block.block.publicationsperiodiques config:block.block.publicationsperiodiques_2 config:block.block.rapportannuelimbrique config:block.block.rapportssurlapolitiquemonetaire20162017 config:block.block.reglementation config:block.block.reglementation_2 config:block.block.reglementation_3 config:block.block.reseauxsociaux config:block.block.reseauxsociaux_2 config:block.block.semainedelinclusionfinanciere2018 config:block.block.sicastar config:block.block.sicastar_2 config:block.block.siegedelabceao config:block.block.situationdelamicrofinance config:block.block.star_right config:block.block.systemepaiementmenu config:block.block.systemesfinanciersdecentralises config:block.block.tabs config:block.block.views_block__album_photo_block_1 config:block.block.views_block__album_photo_block_lister_photos config:block.block.views_block__appels_offres_block_10 config:block.block.views_block__appels_offres_block_11 config:block.block.views_block__appels_offres_block_2 config:block.block.views_block__appels_offres_block_3 config:block.block.views_block__appels_offres_block_8 config:block.block.views_block__appels_offres_block_9 config:block.block.views_block__banner_index_block_1 config:block.block.views_block__bceao_news_block_2 config:block.block.views_block__communique_presse_block_2 config:block.block.views_block__communique_presse_block_3 config:block.block.views_block__communique_presse_block_4 config:block.block.views_block__communique_presse_block_6 config:block.block.views_block__documents_block_1 config:block.block.views_block__etats_membres_block_2 config:block.block.views_block__etats_membres_block_3 config:block.block.views_block__evenements_block_1 config:block.block.views_block__institutions_block_1 config:block.block.views_block__interventions_du_gouverneur_block_1 config:block.block.views_block__interventions_du_gouverneur_block_1_2 config:block.block.views_block__interventions_du_gouverneur_block_1_3 config:block.block.views_block__interventions_du_gouverneur_block_2 config:block.block.views_block__interventions_du_gouverneur_block_3 config:block.block.views_block__publications_block_1 config:block.block.views_block__publications_block_6 config:block.block.views_block__publications_block_7 config:block.block.views_block__reglementations_block_1 config:block.block.views_block__reglementations_block_2 config:block.block.views_block__reunions_block_1 config:block.block.views_block__reunions_block_2 config:block.block.voiraussi config:block.block.vousavezbesoindeplusdinformations config:block_list config:color.theme.medianet config:configurable_language_list config:core.entity_form_display.webform_submission.newsletter.add config:field.storage.node.body config:field.storage.node.field_date config:field.storage.node.field_date_debut config:field.storage.node.field_date_fin config:field.storage.node.field_description config:field.storage.node.field_fichier config:field.storage.node.field_image config:field.storage.node.field_info_banner config:field.storage.node.field_lien config:field.storage.node.field_page_publication config:field.storage.node.field_page_reglementation config:field.storage.node.field_reference config:field.storage.node.field_sub_title config:field.storage.node.field_tags_banner config:field.storage.node.field_theme_offres config:filter.format.basic_html config:filter.format.full_html config:system.menu.footer config:system.menu.main config:system.menu.menu-top config:system.site config:user.role.anonymous config:views.view.appels_offres config:views.view.banner_index config:views.view.bceao_news config:views.view.institutions config:views.view.interventions_du_gouverneur config:views.view.tabs_home config:webform.settings config:webform.webform.contactez_nous config:webform.webform.newsletter file:11506 file:11507 file:11508 file:144200 file:144203 file:144208 file:144210 file:144214 file:144240 file:144262 file:144263 file:1459 file:16 file:17 file:18 file:19 file:20 file:21 file:2494 file:26 file:28 file:29 file:32552 file:32877 file:3696 file:3701 file:3812 file:3915 file:3919 file:3920 file:3926 file:3946 file:3947 file:3949 file:4151 file:4156 file:4201 file:435 file:51192 file:520 file:521 file:52810 file:52811 file:53991 file:5679 file:6045 file:93620 file:93621 file:94519 file:95389 http_response node:1193 node:1242 node:1243 node:140 node:2221 node:3068 node:3778 node:57 node:61 node:6309 node:6732 node:7 node:7006 node:7011 node:7013 node:7408 node:792 node:8 node:8102 node:8433 node:8435 node:8564 node:8565 node:8571 node:8642 node:8673 node:8692 node:8696 node:8702 node:8703 node:8707 node:8720 node:8725 node:8729 node:8732 node:8744 node:8754 node:8755 node:8757 node:8759 node:8760 node:8761 node:9 node_list rendered taxonomy_term:100 taxonomy_term:101 taxonomy_term:102 user:0 webform:contactez_nous webform:newsletter
X-Drupal-Cache-Contexts: cookies:big_pipe_nojs languages:language_content languages:language_interface languages:language_url route session.exists theme timezone url user
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Last-Modified: Wed, 04 Mar 2026 06:02:42 GMT
ETag: "1772604162"
Vary: Cookie
X-Generator: Drupal 8 (https://www.drupal.org)
X-Drupal-Cache: HIT


  /wp-json/ -> HTTP 200 (400b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct:
  /api/ -> HTTP 200 (400b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct:
  /robots.txt -> HTTP 200 (400b)
    #
# robots.txt
#
# This file is to prevent the crawling and indexing of certain parts
# of your site by web crawlers and spiders run by sites like Yahoo!
# and Google. By telling these "robots" where not to go on your site,
# you save bandwidth and server resources.
#
# This file will be ignored unl
  /api/index.php/v1 -> HTTP 200 (400b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct:
  /administrator/ -> HTTP 404 (400b)
  /login -> HTTP 200 (400b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct:
  /.env -> HTTP 200 (400b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct:
  /.git/HEAD -> HTTP 200 (400b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct:
  /swagger -> HTTP 200 (400b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct:
  /graphql -> HTTP 200 (400b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct:
  /rest/ -> HTTP 200 (400b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct:
  /fr/ -> HTTP 200 (400b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct:
  /en/ -> HTTP 200 (400b)
    <!DOCTYPE html>
<html lang="en" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct:

== www.brvm.org ==
--- Headers ---
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 04 Mar 2026 07:18:05 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
X-Powered-By: PHP/7.0.33
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
X-Content-Type-Options: nosniff
Content-Language: fr
X-Frame-Options: SAMEORIGIN
Permissions-Policy: interest-cohort=()
X-Generator: Drupal 7 (http://drupal.org)
Link: <https://www.brvm.org/fr>; rel="canonical",<https://www.brvm.org/fr>; rel="shortlink"
Strict-Transport-Security: max-age=15768000
X-Powered-By: PleskLin


  /wp-json/ -> HTTP 404 (400b)
  /api/ -> HTTP 404 (400b)
  /api/v1/ -> HTTP 404 (400b)
  /robots.txt -> HTTP 200 (400b)
    #
# robots.txt
#
# This file is to prevent the crawling and indexing of certain parts
# of your site by web crawlers and spiders run by sites like Yahoo!
# and Google. By telling these "robots" where not to go on your site,
# you save bandwidth and server resources.
#
# This file will be ignored unl
  /api/index.php/v1 -> HTTP 404 (400b)
  /administrator/ -> HTTP 404 (400b)
  /login -> HTTP 404 (400b)
  /.env -> HTTP 403 (400b)
  /.git/HEAD -> HTTP 403 (400b)
  /swagger -> HTTP 404 (400b)
  /graphql -> HTTP 404 (400b)
  /rest/ -> HTTP 404 (400b)

== www.orange.bf ==
--- Headers ---
HTTP/1.1 200 OK
date: Wed, 04 Mar 2026 07:18:20 GMT
content-type: text/html; charset=utf-8
content-length: 244771
last-modified: Tue, 03 Mar 2026 05:20:16 GMT
vary: Accept-Encoding
etag: "69a66f90-3bc23"
x-frame-options: SAMEORIGIN
content-security-policy: script-src 'self' 'unsafe-inline' blob: 'unsafe-eval' www.orange.bf *.orange.bf prod.botconnector.cloud.orange botman-prod.apps.fr01.paas.diod.orange.com bot-connector-prod.apps.fr01.paas.diod.orange.com td.doubleclick.net *.smartly.ai www.googletagmanager.com cdn.jsdelivr.net *.readspeaker.com cdn.datatables.net cdnjs.cloudflare.com maps.gstatic.com googletagmanager.com orange-rdv.right-q.com www.googleadservices.com api.orangefootballclub.com survey.alchemer.com survey.alchemer.eu help.dimelo.com cobrowsing.eu2.digital.ringcentral.com dimelo-chat.s3.amazonaws.com orange-burkina.ws.dimelo.com orange-burkina.engagement.dimelo.com orange-burkina.dimelochat.com orange-burkina.messaging.dimelo.com sfdc.dimelo.com engagement-connect.herokuapp.com www.gstatic.com www.google.com *.googleapis.com googleapis.com connect.facebook.net maps.gstatic.com gstatic.com www.ciuvo.com optimize.google.com s.ytimg.com www.youtube.com tagmanager.google.com w.usabilla.com appstatic.quanta.io completion.ke.orange.fr img.ke.woopic.com www.googletagmanager.com www.google-analytics.com graph.facebook.com urls.api.twitter.com api.pinterest.com www.linkedin.com *.crazyegg.com;
content-security-policy: script-src-elem 'self' 'unsafe-inline' blob: 'unsafe-eval' www.orange.bf *.orange.bf prod.botconnector.cloud.orange botman-prod.apps.fr01.paas.diod.orange.com bot-connector-prod.apps.fr01.paas.diod.orange.com td.doubleclick.net *.smartly.ai www.googletagmanager.com cdn.jsdelivr.net *.readspeaker.com cdn.datatables.net cdnjs.cloudflare.com maps.gstatic.com googletagmanager.com orange-rdv.right-q.com www.googleadservices.com api.orangefootballclub.com survey.alchemer.com survey.alchemer.eu help.dimelo.com cobrowsing.eu2.digital.ringcentral.com dimelo-chat.s3.amazonaws.com orange-burkina.ws.dimelo.com orange-burkina.engagement.dimelo.com orange-burkina.dimelochat.com orange-burkina.messaging.dimelo.com sfdc.dimelo.com engagement-connect.herokuapp.com www.gstatic.com www.google.com *.googleapis.com googleapis.com connect.facebook.net maps.gstatic.com gstatic.com www.ciuvo.com optimize.google.com s.ytimg.com www.youtube.com tagmanager.google.com w.usabilla.com appstatic.quanta.io completion.ke.orange.fr img.ke.woopic.com www.googletagmanager.com www.google-analytics.com graph.facebook.com urls.api.twitter.com api.pinterest.com www.linkedin.com *.crazyegg.com;
content-security-policy: frame-src 'unsafe-inline' prod.botconnector.cloud.orange bot-connector-prod.apps.fr01.paas.diod.orange.com td.doubleclick.net *.smartly.ai orange.bf *.orange.bf www.googletagmanager.com gametime.monnumeroorange.com *.crazyegg.com live-homescreen.orange.com *.orange.com *.readspeaker.com maps.gstatic.com googletagmanager.com orange-rdv.right-q.com api.orangefootballclub.com survey.alchemer.com survey.alchemer.eu help.dimelo.com cobrowsing.eu2.digital.ringcentral.com dimelo-chat.s3.amazonaws.com orange-burkina.ws.dimelo.com orange-burkina.engagement.dimelo.com orange-burkina.dimelochat.com orange-burkina.messaging.dimelo.com sfdc.dimelo.com engagement-connect.herokuapp.com www.orange.bf *.googleapis.com googleapis.com connect.facebook.net maps.gstatic.com gstatic.com www.ciuvo.com optimize.google.com www.youtube.com datastudio.google.com otapoci.gos.orange.com;
content-security-policy: img-src blob: 'self' 'unsafe-inline' data: prod.botconnector.cloud.orange *.gstatic.com td.doubleclick.net *.smartly.ai https://bot-connector-prod.apps.fr01.paas.diod.orange.com *.google.bf *.google.com sport365.fr *.sport365.fr www.googletagmanager.com *.crazyegg.com *.readspeaker.com 178.32.6.108 maps.gstatic.com googletagmanager.com orange-rdv.right-q.com api.orangefootballclub.com survey.alchemer.com survey.alchemer.eu help.dimelo.com cobrowsing.eu2.digital.ringcentral.com dimelo-chat.s3.amazonaws.com orange-burkina.ws.dimelo.com orange-burkina.engagement.dimelo.com orange-burkina.dimelochat.com orange-burkina.messaging.dimelo.com sfdc.dimelo.com engagement-connect.herokuapp.com www.orange.bf *.googleapis.com googleapis.com connect.facebook.net maps.gstatic.com gstatic.com www.ciuvo.com optimize.google.com i.ytimg.com fr.orangefootballclub.com www.google-analytics.com stats.g.doubleclick.net www.google.com www.google.com.pk www.google.fr rum-metrics.quanta.io d212beldn0wvcm.cloudfront.net dimelo.s3.amazonaws.com;
content-security-policy: style-src 'self' 'unsafe-inline' prod.botconnector.cloud.orange *.orange.com *.crazyegg.com *.readspeaker.com maps.gstatic.com www.googletagmanager.com orange-rdv.right-q.com api.orangefootballclub.com survey.alchemer.com survey.alchemer.eu help.dimelo.com cobrowsing.eu2.digital.ringcentral.com dimelo-chat.s3.amazonaws.com orange-burkina.ws.dimelo.com orange-burkina.engagement.dimelo.com orange-burkina.dimelochat.com orange-burkina.messaging.dimelo.com sfdc.dimelo.com engagement-connect.herokuapp.com www.orange.bf *.googleapis.com googleapis.com connect.facebook.net maps.gstatic.com gstatic.com *.googleapis.com googleapis.com www.ciuvo.com optimize.google.com img.ke.woopic.com;
content-security-policy: form-action 'self' prod.botconnector.cloud.orange secureacceptance.cybersource.com testsecureacceptance.cybersource.com;
content-security-policy: object-src 'self' 'unsafe-inline' prod.botconnector.cloud.orange *.crazyegg.com *.readspeaker.com;
content-security-policy: frame-ancestors 'self' prod.botconnector.cloud.orange botman-prod.apps.fr01.paas.diod.orange.com orange.bf *.orange.bf live-homescreen.orange.com preprod.live-homescreen.orange.com livescreen-pwa-demo.apps.fr01.paas.diod.orange.com livescreen-react-weather-branch.apps.fr01.paas.diod.orange.com;
strict-transport-security: max-age=16070400; includeSubDomains
cache-control: no-cache
accept-ranges: bytes
x-xss-protection: 1;mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
x-permitted-cross-domain-policies: none
cache-control: max-age=0 no-cache no-store private must-revalidate
pragma: no-cache
set-cookie: SRV=s2; path=/; HttpOnly; Secure


  /wp-json/ -> HTTP 404 (400b)
  /api/ -> HTTP 404 (400b)
  /api/v1/ -> HTTP 404 (400b)
  /robots.txt -> HTTP 200 (400b)
    #
# robots.txt
#
# This file is to prevent the crawling and indexing of certain parts
# of your site by web crawlers and spiders run by sites like Yahoo!
# and Google. By telling these "robots" where not to go on your site,
# you save bandwidth and server resources.
#
# This file will be ignored unl
  /api/index.php/v1 -> HTTP 404 (400b)
  /administrator/ -> HTTP 404 (400b)
  /login -> HTTP 404 (400b)
  /.env -> HTTP 403 (134b)
  /.git/HEAD -> HTTP 403 (134b)
  /swagger -> HTTP 404 (400b)
  /graphql -> HTTP 404 (400b)
  /rest/ -> HTTP 404 (400b)
  /wp-admin/ -> HTTP 404 (400b)
  /admin -> HTTP 404 (400b)

[*] Newly discovered domains probed.


########################################################################
#     DEEP DIVE: www.bceao.int (DRUPAL 8)                             #
########################################################################

  /jsonapi -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /jsonapi/node/article -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /jsonapi/node/page -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /jsonapi/user/user -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /jsonapi/taxonomy_term/tags -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /jsonapi/file/file -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /jsonapi/node/publication -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /jsonapi/node/event -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /jsonapi/node/document -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /jsonapi/node/news -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /jsonapi/node/communique_presse -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /jsonapi/node/offre -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /jsonapi/node/appels_offres -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /rest/type/node/article?_format=json -> HTTP 404 (76b)
  /node/1?_format=json -> HTTP 401 (53b)
  /node/7?_format=json -> HTTP 200 (600b)
    {"nid":[{"value":7}],"uuid":[{"value":"8904a195-9701-4d22-b8d0-40a361e71fb2"}],"vid":[{"value":16268}],"langcode":[{"value":"fr"}],"type":[{"target_id":"institutions","target_type":"node_type","target_uuid":"471b811d-2f75-49bb-8ec0-d62ad649f353"}],"revision_timestamp":[{"value":"2025-05-21T21:11:56+00:00","format":"Y-m-d\\TH:i:sP"}],"revision_uid":[{"target_id":120,"target_type":"user","target_uuid":"f4093e88-0dfd-42b0-bc65-7d5d0387b6b3","url":"\/fr\/user\/120"}],"revision_log":[],"status":[{"va
  /node/8?_format=json -> HTTP 200 (600b)
    {"nid":[{"value":8}],"uuid":[{"value":"c161587a-2974-4189-bf90-6887d4e092c6"}],"vid":[{"value":9728}],"langcode":[{"value":"fr"}],"type":[{"target_id":"institutions","target_type":"node_type","target_uuid":"471b811d-2f75-49bb-8ec0-d62ad649f353"}],"revision_timestamp":[{"value":"2021-02-22T16:26:19+00:00","format":"Y-m-d\\TH:i:sP"}],"revision_uid":[{"target_id":85}],"revision_log":[],"status":[{"value":true}],"uid":[{"target_id":1,"target_type":"user","target_uuid":"9d1f6176-fe5a-42a5-bd95-45bdd7
  /node/9?_format=json -> HTTP 200 (600b)
    {"nid":[{"value":9}],"uuid":[{"value":"703d3fdf-175f-47e6-b410-f85a2c0f7f1b"}],"vid":[{"value":16267}],"langcode":[{"value":"fr"}],"type":[{"target_id":"institutions","target_type":"node_type","target_uuid":"471b811d-2f75-49bb-8ec0-d62ad649f353"}],"revision_timestamp":[{"value":"2025-05-21T21:11:29+00:00","format":"Y-m-d\\TH:i:sP"}],"revision_uid":[{"target_id":120,"target_type":"user","target_uuid":"f4093e88-0dfd-42b0-bc65-7d5d0387b6b3","url":"\/fr\/user\/120"}],"revision_log":[],"status":[{"va
  /user/1?_format=json -> HTTP 403 (102b)
  /user/0?_format=json -> HTTP 403 (14b)
  /admin/content -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /admin/structure -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /user/login -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /user/register -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /fr/user/login -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /core/install.php -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<meta name="Generator" content="Drupal 8 (http
  /sites/default/files/ -> HTTP 403 (145b)
  /sites/default/settings.php -> HTTP 200 (0b)
  /CHANGELOG.txt -> HTTP 404 (192b)
  /core/CHANGELOG.txt -> HTTP 200 (398b)
    New minor (feature) releases of Drupal are released every six months and
patch (bugfix) releases are released every month. More information on the
Drupal release cycle: https://www.drupal.org/core/release-cycle-overview

* For a full list of fixes in the latest release, visit:
 https://www.drupal.org/latest-release
* API change records for Drupal core:
 https://www.drupal.org/list-changes/drupal
  /update.php -> HTTP 403 (157b)
  /install.php -> HTTP 404 (15b)
  /cron/ -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /fr/admin -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /fr/node -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /fr/search -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.
  /fr/rss.xml -> HTTP 200 (600b)
    <?xml version="1.0" encoding="utf-8"?>
<rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:foaf="http://xmlns.com/foaf/0.1/" xmlns:og="http://ogp.me/ns#" xmlns:rdfs="http://www.w3.org/2000/01/rdf-schema#" xmlns:schema="http://schema.org/" xmlns:sioc="http://rdfs.org/sioc/ns#" xmlns:sioct="http://rdfs.org/sioc/types#" xmlns:skos="http://www.w3.org/2004/02/skos/core#" xmlns:xsd="http://www.w3.org/2001/XMLSchema#" version="2.0" xml:base="h
  /fr/sitemap.xml -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/  dc: http://purl.org/dc/terms/  foaf: http://xmlns.com/foaf/0.1/  og: http://ogp.me/ns#  rdfs: http://www.w3.org/2000/01/rdf-schema#  schema: http://schema.org/  sioc: http://rdfs.org/sioc/ns#  sioct: http://rdfs.org/sioc/types#  skos: http://www.w3.org/2004/02/skos/core#  xsd: http://www.w3.org/2001/XMLSchema# ">
  <head>
    <meta charset="utf-8" />
<link rel="canonical" href="https://www.bceao.



########################################################################
#     DEEP DIVE: www.brvm.org (DRUPAL 7) + www.corisbank.bf (WP)     #
########################################################################

--- BRVM (Drupal 7) ---
  /node/1?_format=json -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/ dc: http://purl.org/dc/terms/ foaf: http://xmlns.com/foaf/0.1/ og: http://ogp.me/ns# rdfs: http://www.w3.org/2000/01/rdf-schema# sioc: http://rdfs.org/sioc/ns# sioct: http://rdfs.org/sioc/types# skos: http://www.w3.org/2004/02/skos/core# xsd: http://www.w3.org/2001/XMLSchema#">
<head profile="http:/
  /user/1?_format=json -> HTTP 403 (600b)
  /fr -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/ dc: http://purl.org/dc/terms/ foaf: http://xmlns.com/foaf/0.1/ og: http://ogp.me/ns# rdfs: http://www.w3.org/2000/01/rdf-schema# sioc: http://rdfs.org/sioc/ns# sioct: http://rdfs.org/sioc/types# skos: http://www.w3.org/2004/02/skos/core# xsd: http://www.w3.org/2001/XMLSchema#">
<head profile="http:/
  /en -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="en" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/ dc: http://purl.org/dc/terms/ foaf: http://xmlns.com/foaf/0.1/ og: http://ogp.me/ns# rdfs: http://www.w3.org/2000/01/rdf-schema# sioc: http://rdfs.org/sioc/ns# sioct: http://rdfs.org/sioc/types# skos: http://www.w3.org/2004/02/skos/core# xsd: http://www.w3.org/2001/XMLSchema#">
<head profile="http:/
  /fr/user/login -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/ dc: http://purl.org/dc/terms/ foaf: http://xmlns.com/foaf/0.1/ og: http://ogp.me/ns# rdfs: http://www.w3.org/2000/01/rdf-schema# sioc: http://rdfs.org/sioc/ns# sioct: http://rdfs.org/sioc/types# skos: http://www.w3.org/2004/02/skos/core# xsd: http://www.w3.org/2001/XMLSchema#">
<head profile="http:/
  /fr/admin -> HTTP 403 (600b)
  /CHANGELOG.txt -> HTTP 200 (600b)
    Drupal 7.82, 2021-07-21
-----------------------
- Fixed security issues:
   - SA-CORE-2021-004

Drupal 7.81, 2021-06-02
-----------------------
- Block Google FLoC by default
- Testing and accessibility enhancements
- Various bug fixes, optimizations and improvements

Drupal 7.80, 2021-04-20
-----------------------
- Fixed security issues:
   - SA-CORE-2021-002

Drupal 7.79, 2021-04-07
-----------
  /update.php -> HTTP 403 (600b)
  /install.php -> HTTP 200 (600b)
    <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
  <head>
    <title>Drupal already installed | Drupal</title>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="Generator" content="Drupal 7 (http://drupal.org)" />
<meta nam
  /cron.php -> HTTP 403 (600b)
  /sites/default/files/ -> HTTP 404 (600b)
  /fr/cours-actions -> HTTP 404 (600b)
  /fr/obligations -> HTTP 404 (600b)
  /fr/indices -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/ dc: http://purl.org/dc/terms/ foaf: http://xmlns.com/foaf/0.1/ og: http://ogp.me/ns# rdfs: http://www.w3.org/2000/01/rdf-schema# sioc: http://rdfs.org/sioc/ns# sioct: http://rdfs.org/sioc/types# skos: http://www.w3.org/2004/02/skos/core# xsd: http://www.w3.org/2001/XMLSchema#">
<head profile="http:/
  /fr/cotation -> HTTP 404 (600b)
  /fr/marche -> HTTP 404 (600b)
  /fr/actualites -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="fr" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/ dc: http://purl.org/dc/terms/ foaf: http://xmlns.com/foaf/0.1/ og: http://ogp.me/ns# rdfs: http://www.w3.org/2000/01/rdf-schema# sioc: http://rdfs.org/sioc/ns# sioct: http://rdfs.org/sioc/types# skos: http://www.w3.org/2004/02/skos/core# xsd: http://www.w3.org/2001/XMLSchema#">
<head profile="http:/
  /fr/rss.xml -> HTTP 200 (600b)
    <?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xml:base="https://www.brvm.org"  xmlns:dc="http://purl.org/dc/elements/1.1/">
<channel>
 <title>BRVM - Bourse Régionale des Valeurs Mobilières</title>
 <link>https://www.brvm.org</link>
 <description></description>
 <language>fr</language>
<item>
 <title>LA BRVM ACCENTUE SON DYNAMISME EN CE DÉBUT D’ANNÉE</title>
 <link>https://www.brv
  /fr/sitemap.xml -> HTTP 404 (600b)
  /rest/session/token -> HTTP 404 (600b)

--- Coris Bank Benin (WordPress via www.corisbank.bf -> benin.coris.bank) ---
  /wp-json/wp/v2/users -> HTTP 401 (108b)
  /wp-json/wp/v2/posts -> HTTP 200 (600b)
    [{"id":7811,"date":"2025-09-19T18:30:33","date_gmt":"2025-09-19T17:30:33","guid":{"rendered":"https:\/\/benin.coris.bank\/?p=7811"},"modified":"2025-09-19T18:30:36","modified_gmt":"2025-09-19T17:30:36","slug":"recrutement-assistant-sales-tresorerie","status":"publish","type":"post","link":"https:\/\/benin.coris.bank\/recrutement-assistant-sales-tresorerie\/","title":{"rendered":"CBI B\u00e9nin rec
  /wp-json/wp/v2/pages -> HTTP 200 (600b)
    [{"id":7413,"date":"2024-03-18T10:34:16","date_gmt":"2024-03-18T09:34:16","guid":{"rendered":"https:\/\/benin.coris.bank\/?page_id=7413"},"modified":"2024-03-18T11:48:49","modified_gmt":"2024-03-18T10:48:49","slug":"mentions-legales","status":"publish","type":"page","link":"https:\/\/benin.coris.bank\/mentions-legales\/","title":{"rendered":"Mentions legales"},"content":{"rendered":"\t\t<div data-
  /wp-json/wp/v2/media -> HTTP 200 (600b)
    [{"id":7842,"date":"2026-02-19T17:42:59","date_gmt":"2026-02-19T16:42:59","guid":{"rendered":"https:\/\/benin.coris.bank\/wp-content\/uploads\/2026\/02\/Gabon_icon.svg"},"modified":"2026-02-19T17:42:59","modified_gmt":"2026-02-19T16:42:59","slug":"gabon_icon","status":"inherit","type":"attachment","link":"https:\/\/benin.coris.bank\/filiale\/gabon\/gabon_icon\/","title":{"rendered":"Gabon_icon"},"
  /wp-json/wp/v2/categories -> HTTP 200 (600b)
    [{"id":6,"count":28,"description":"","link":"https:\/\/benin.coris.bank\/category\/non-classifiee\/","name":"Non classifi\u00e9(e)","slug":"non-classifiee","taxonomy":"category","parent":0,"meta":[],"acf":[],"_links":{"self":[{"href":"https:\/\/benin.coris.bank\/wp-json\/wp\/v2\/categories\/6","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/benin.coris.bank\/wp-json\/wp\/v2\/cat
  /wp-json/wp/v2/comments -> HTTP 200 (2b)
  /wp-json/wp/v2/types -> HTTP 200 (600b)
    {"post":{"description":"","hierarchical":false,"has_archive":false,"name":"Articles","slug":"post","icon":"dashicons-admin-post","taxonomies":["category","post_tag"],"rest_base":"posts","rest_namespace":"wp\/v2","template":[],"template_lock":false,"_links":{"collection":[{"href":"https:\/\/benin.coris.bank\/wp-json\/wp\/v2\/types"}],"wp:items":[{"href":"https:\/\/benin.coris.bank\/wp-json\/wp\/v2\
  /wp-json/wp/v2/search?search=admin -> HTTP 200 (600b)
    [{"id":5222,"title":"Coris Holding affiche un PNB en hausse de 32%","url":"https:\/\/benin.coris.bank\/coris-holding-affiche-un-pnb-en-hausse\/","type":"post","subtype":"post","_links":{"self":[{"embeddable":true,"href":"https:\/\/benin.coris.bank\/wp-json\/wp\/v2\/posts\/5222","targetHints":{"allow":["GET"]}}],"about":[{"href":"https:\/\/benin.coris.bank\/wp-json\/wp\/v2\/types\/post"}],"collecti
  /wp-json/wp/v2/settings -> HTTP 401 (133b)
  /wp-json/wp/v2/plugins -> HTTP 401 (169b)
  /xmlrpc.php -> HTTP 405 (42b)
  /readme.html -> HTTP 200 (600b)
    <!DOCTYPE html>
<html lang="en">
<head>
	<meta name="viewport" content="width=device-width" />
	<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
	<title>WordPress &#8250; ReadMe</title>
	<link rel="stylesheet" href="wp-admin/css/install.css?ver=20100228" type="text/css" />
</head>
<body>
<h1 id="logo">
	<a href="https://wordpress.org/"><img alt="WordPress" src="wp-admin/images
  /wp-content/uploads/ -> HTTP 200 (600b)
    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<html>
 <head>
  <title>Index of /wp-content/uploads</title>
 </head>
 <body>
<h1>Index of /wp-content/uploads</h1>
  <table>
   <tr><th valign="top"><img src="/icons/blank.gif" alt="[ICO]"></th><th><a href="?C=N;O=D">Name</a></th><th><a href="?C=M;O=A">Last modified</a></th><th><a href="?C=S;O=A">Size</a></th><th><a href="?C=D;O=A">Descripti
  /wp-content/debug.log -> HTTP 404 (600b)
  /?author=1 -> HTTP 404 (0b)

################################################################################
################################################################################
##                                                                            ##
##                     EXECUTIVE SUMMARY & PRIORITY TARGETS                   ##
##                                                                            ##
################################################################################
################################################################################

Generated: 2026-03-04
Total targets tested: 29 primary domains + 30 alternate domains
Responded: 10 domains live out of 59 tested
Full raw data: probe-results.txt (same directory)


================================================================================
  PRIORITY - OPEN API FOUND: moov-africa.bf
================================================================================
CMS: WordPress + WooCommerce + Polylang + Yoast + Jetpack + Tribe Events
Server: Apache/2.4.62 (Red Hat Enterprise Linux) OpenSSL/3.5.1 mod_fcgid/2.3.9
PHP: 8.3.29
Protocol: HTTPS

OPEN APIs:
  - /wp-json/wp/v2/users        -> 200 (LEAKS EMAIL: d.coulibaly@moov-africa.bf, user ID 1)
  - /wp-json/wp/v2/posts        -> 200 (full post content, dates, slugs)
  - /wp-json/wp/v2/pages        -> 200 (page content including pricing/plans)
  - /wp-json/wp/v2/categories   -> 200 (includes "Actions ONATEL BF" = stock info)
  - /wp-json/wp/v2/tags         -> 200
  - /wp-json/wp/v2/media        -> 200 (full media library with URLs)
  - /wp-json/wp/v2/types        -> 200 (tribe-ea statuses exposed)
  - /wp-json/wp/v2/statuses     -> 200
  - /wp-json/wp/v2/taxonomies   -> 200
  - /wp-json/wp/v2/search       -> 200
  - /wp-json/tribe/events/v1/events -> 200 (events API)
  - /wp-json/wc/store/v1/products -> 200 (WooCommerce Store: FTTH modems, pricing)
  - /wp-json/wc/store/v1/cart    -> 200 (cart API - currency XOF)
  - /wp-json/pll/v1/languages    -> 200 (FR/EN language config)
  - /wp-json/yoast/v1/get_head   -> 200

DIRECTORY LISTING:
  - /wp-content/uploads/         -> 200 (OPEN DIRECTORY LISTING - full file tree)

OTHER:
  - /readme.html                 -> 200 (WordPress version disclosure)
  - /license.txt                 -> 200
  - /xmlrpc.php                  -> 405 (Method Not Allowed - exists)
  - /wp-cron.php                 -> 200
  - /.htaccess                   -> 403

NOTES: Moov Africa Burkina Faso (ONATEL subsidiary) telecom site.
WooCommerce store API is open. User enumeration succeeded. Full WP REST API open.
ONATEL stock data category present. Major telecom with wide open API surface.


================================================================================
  PRIORITY - OPEN API FOUND: www.bceao.int (BCEAO Central Bank)
================================================================================
CMS: Drupal 8
Server: nginx/1.20.1
Protocol: HTTPS

OPEN APIs:
  - /node/7?_format=json         -> 200 (JSON data: institution nodes, UIDs, revisions)
  - /node/8?_format=json         -> 200 (institution data with user references)
  - /node/9?_format=json         -> 200 (institution data, revision UIDs)
  - /core/CHANGELOG.txt          -> 200 (Drupal version info)
  - /fr/rss.xml                  -> 200 (RSS feed with full content)
  - /user/login                  -> 200 (login form accessible)
  - /user/register               -> 200 (registration page accessible)

EXPOSED METADATA:
  - X-Drupal-Cache-Tags header leaks complete site structure:
    * Node types: article, institutions, publication, event, document, communique_presse, offre
    * Block content IDs: 1-98+ (massive block structure)
    * Views: appels_offres, bceao_news, communique_presse, documents, evenements,
             institutions, interventions_du_gouverneur, publications, reglementations,
             reunions, tabs_home, banner_index, etats_membres, album_photo
    * Webforms: contactez_nous, newsletter
    * User IDs referenced: 1, 85, 120
  - X-Generator: Drupal 8 (https://www.drupal.org)

BLOCKED:
  - /node/1?_format=json         -> 401 (protected)
  - /user/1?_format=json         -> 403
  - /jsonapi/* endpoints          -> all redirect to homepage (JSON:API disabled or requires auth)
  - /sites/default/files/         -> 403
  - /update.php                   -> 403

NOTES: Central bank of West Africa. Drupal 8 with REST module partially enabled.
Node JSON export works for some node IDs. Cache tags leak extensive site architecture.
Node enumeration possible (/node/N?_format=json for N=7,8,9 and likely more).


================================================================================
  PRIORITY - OPEN API FOUND: benin.coris.bank (Coris Bank Benin)
================================================================================
Discovered via: www.corisbank.bf -> redirects to benin.coris.bank
CMS: WordPress (with Jetpack, Fluent SMTP, Akismet, ACF)
Server: Apache (Ubuntu)
Protocol: HTTPS

OPEN APIs:
  - /wp-json/ (full namespace listing including jetpack, fluent-smtp, akismet, ACF)
  - /wp-json/wp/v2/posts         -> 200 (recruitment posts, bank news)
  - /wp-json/wp/v2/pages         -> 200 (mentions legales, etc.)
  - /wp-json/wp/v2/media         -> 200 (uploaded files: SVGs, images, with full URLs)
  - /wp-json/wp/v2/categories    -> 200
  - /wp-json/wp/v2/comments      -> 200
  - /wp-json/wp/v2/types         -> 200
  - /wp-json/wp/v2/search        -> 200

DIRECTORY LISTING:
  - /wp-content/uploads/          -> 200 (OPEN DIRECTORY LISTING)

BLOCKED (but confirms WordPress):
  - /wp-json/wp/v2/users          -> 401 (user enum blocked)
  - /wp-json/wp/v2/settings       -> 401
  - /wp-json/wp/v2/plugins        -> 401

OTHER:
  - /readme.html                  -> 200
  - /xmlrpc.php                   -> 405
  - /admin, /login, /wp-admin/    -> redirect to wp-login.php

NOTES: Coris Bank International Benin branch.
Other Coris Bank branches likely at *.coris.bank (e.g., bf.coris.bank, tg.coris.bank).
WordPress REST API open with content and media enumeration.
Open upload directory listing.


================================================================================
  PRIORITY - OPEN API FOUND: onea.bf (ONEA Water Utility)
================================================================================
CMS: WordPress (with Elementor, The7, Jetpack, MEC Events, Bluehost/Newfold)
Server: Cloudflare (origin unknown)
Protocol: HTTPS

OPEN APIs:
  - /wp-json/ (full namespace listing: elementor, the7, jetpack, jetpack-boost,
    newfold-*, mec, videopress, etc.)
  - Initial probe confirmed WP-JSON with site description:
    "Office national de l eau et de l assainissement"
  - Rate limited (429) on deep probe - Cloudflare WAF active

ADMIN PANELS:
  - /wp-admin/                    -> redirects to wp-login.php (login form)
  - /wp-login.php                 -> 200
  - /cpanel                       -> 200 (cPanel accessible)
  - /webmail                      -> 200 (Webmail accessible)
  - /admin -> /admin/ -> /dashboard/ all redirect to wp-admin

CONFIG:
  - /.env                         -> 403 (exists but protected)
  - /web.config                   -> 403
  - /.git/HEAD                    -> 403 (GIT REPO EXISTS)
  - /.git/config                  -> 403
  - /.htaccess                    -> 403
  - /phpinfo.php                  -> 403 (exists)
  - /server-status                -> 403

NOTES: Government water utility. WordPress on Bluehost/Newfold hosting with Cloudflare.
Rate limited API access (429). cPanel and Webmail endpoints exposed.
Git repository exists but is protected. Multiple sensitive files confirmed to exist.
Hosting appears to be Bluehost (newfold-* namespaces in API).


================================================================================
  INTERESTING: www.brvm.org (BRVM Stock Exchange)
================================================================================
CMS: Drupal 7.82 (OUTDATED - last update 2021-07-21)
Server: nginx + PleskLin
PHP: 7.0.33 (SEVERELY OUTDATED - EOL)
Protocol: HTTPS

FINDINGS:
  - /CHANGELOG.txt               -> 200 (Drupal 7.82 confirmed)
  - /install.php                  -> 200 ("Drupal already installed")
  - /fr/user/login                -> 200 (login form)
  - /fr/indices                   -> 200 (stock market data)
  - /fr/actualites                -> 200 (news)
  - /fr/rss.xml                   -> 200 (RSS feed with full content)
  - /.env                         -> 403 (exists)
  - /.git/HEAD                    -> 403 (GIT REPO EXISTS)

NOTES: Regional stock exchange. Running severely outdated Drupal 7.82 on PHP 7.0.33.
Both are well past end-of-life. Multiple known CVEs for this version.
Stock market index data at /fr/indices.


================================================================================
  INTERESTING: societegenerale.bf (Societe Generale BF)
================================================================================
CMS: TYPO3 CMS
Server: nginx (behind Imperva CDN)
Protocol: HTTPS
Redirect header: x-redirect-by: TYPO3 Redirect 17

FINDINGS:
  - /typo3/                       -> 403 (admin panel exists but blocked by Imperva)
  - /typo3/login                  -> 403
  - /typo3conf/                   -> 403
  - /typo3conf/LocalConfiguration.php -> 200 (EMPTY - may be accessible)
  - /.env                         -> 403 (exists)
  - /web.config                   -> 403 (exists)
  - /config.yml                   -> 403 (exists)
  - /.git/HEAD                    -> 403 (GIT REPO EXISTS)
  - /.git/config                  -> 403 (GIT REPO EXISTS)
  - /composer.json                -> 403 (exists)
  - /.htaccess                    -> 403 (exists)
  - /wp-config.php.bak            -> 403 (exists - WP migration remnant?)
  - /wp-admin/                    -> 403
  - /wp-login.php                 -> 403

SECURITY DISCLOSURE:
  - /.well-known/security.txt     -> 200
    Contact: cert.sg@socgen.com
    Contact: tel:+33(0)1-5898-7200
    VDP: https://vdp.societegenerale.com

NOTES: Well-protected by Imperva WAF. Many files exist (403) but are blocked.
Multiple config files confirmed to exist. Has a formal VDP program.
TYPO3 version unclear but Redirect 17 suggests relatively modern.


================================================================================
  INTERESTING: ecobank.com (Ecobank Pan-Africa)
================================================================================
CMS: ASP.NET (custom MVC app)
Server: [blank] (deliberately hidden)
Protocol: HTTPS
Session: ASP.NET_SessionId
CDN: Custom (not Cloudflare/Imperva)

FINDINGS:
  - All /api/* paths return 200 with homepage (catch-all routing)
  - /ContentHandler.ashx           -> 405 (Method Not Allowed - API endpoint exists)
  - /login                         -> 200 (distinct login page)
  - robots.txt disallows: /js/, /WebResource.axd, /upload/, /ScriptResource.axd

SUBDOMAINS:
  - secure.ecobank.com             -> 302 (internet banking portal)
  - developer.ecobank.com          -> 302 (Server: BigIP - DEVELOPER PORTAL)
  - digitalonline.ecobank.com      -> 404

CSP reveals internal services:
  - secure.ecobank.com/ContentHandler.ashx
  - ice.ecobank.com (corporate banking)
  - digitalonline.ecobank.com
  - edctradingportal.ecobank.com (trading portal)
  - ecobank-prod.custhelp.com (Oracle Service Cloud)

NOTES: Pan-African bank. ASP.NET application with catch-all routing.
Developer portal at developer.ecobank.com behind BigIP load balancer.
Trading portal referenced in CORS headers.


================================================================================
  INTERESTING: air-burkina.com (Air Burkina)
================================================================================
CMS: TYPO3 CMS
Server: nginx
Hosting: Plesk (PleskLin)
Protocol: HTTPS

FINDINGS:
  - /config.yml                    -> 403 (exists)
  - /.git/HEAD                     -> 403 (GIT REPO EXISTS)
  - /.git/config                   -> 403 (GIT REPO EXISTS)
  - /composer.json                 -> 403 (exists)
  - /.htaccess                     -> 403 (exists)
  - /wp-config.php.bak             -> 403 (exists - WP migration remnant)
  - robots.txt disallows: /typo3_src/, /t3lib/, /typo3/, /typo3conf/

NOTES: National airline. TYPO3 CMS on Plesk hosting. Git repo exists.
Deep probe timed out (000 responses) - server may be slow or rate limiting.


================================================================================
  INTERESTING: boad.org (BOAD West African Development Bank)
================================================================================
CMS: Laravel (with Vue.js + Inertia.js)
Server: nginx
Protocol: HTTPS
Framework: Laravel (XSRF-TOKEN cookie, la_boad_session cookie)

FINDINGS:
  - Exposes XSRF-TOKEN in cookies (Laravel CSRF)
  - /sitemap_index.xml            -> 200 (contacts, definitions, documents sitemaps)
  - /storage/                     -> 403 (Laravel storage exists)
  - /build/assets/                -> 403 (Vite build assets exist)
  - /vendor/                      -> 403 (Composer vendor dir exists)
  - /.env                         -> 403 (exists)
  - /.git/HEAD                    -> 403 (GIT REPO EXISTS)
  - /.git/config                  -> 403 (GIT REPO EXISTS)
  - /.htaccess                    -> 403 (exists)
  - /.DS_Store                    -> 403 (macOS dev artifact)

NOTES: Modern Laravel/Vue SPA. Well-protected but git repo and .env confirmed to exist.
Sitemap reveals content structure (contacts, definitions, documents).


================================================================================
  INTERESTING: www.orange.bf (Orange Burkina Faso)
================================================================================
Server: Custom (no server header)
Protocol: HTTPS (static site served via nginx)
Framework: Static HTML (prebuilt)

FINDINGS:
  - Massive CSP header reveals internal infrastructure:
    * Bot platform: prod.botconnector.cloud.orange, *.smartly.ai
    * Live homescreen: live-homescreen.orange.com
    * Payment: secureacceptance.cybersource.com (CyberSource payments)
    * Customer service: orange-burkina.dimelochat.com, *.dimelo.com (RingCentral)
    * Engagement: orange-burkina.engagement.dimelo.com
    * Analytics: *.crazyegg.com, w.usabilla.com, quanta.io
    * Appointment system: orange-rdv.right-q.com
  - /.env                         -> 403 (exists)
  - /.git/HEAD                    -> 403 (GIT REPO EXISTS)
  - No WP/Drupal/Joomla detected - appears to be static pre-built site
  - robots.txt present (standard Drupal format from template)

NOTES: Major telecom. Static site but CSP reveals rich backend infrastructure.
CyberSource payment integration. Dimelo/RingCentral chat platform.


================================================================================
                          DOMAINS UNREACHABLE
================================================================================
The following domains were unreachable on both HTTP and HTTPS (both bare and www):

BANKING:
  - bicia.bf / www.bicia.bf (BICIA-B Bank)
  - coris-bank.com (redirects 301 from www but final destination unreachable)
  - sgbf.bf / www.sgbf.bf (Societe Generale alternate)
  - bsic.bf / www.bsic.bf (BSIC Bank)
  - bcb.bf / www.bcb.bf (Banque Commerciale)
  - wendkuni-bank.bf (Wendkuni Bank)
  - crepmf.org / www.crepmf.org (Stock Market Regulator)

TELECOM:
  - moov.bf / www.moov.bf (Moov alternate)
  - onatel.bf / www.onatel.bf (ONATEL)
  - faso-net.bf / fasonet.bf (FasoNet)

ENTERPRISE:
  - sonabel.bf / www.sonabel.bf (SONABEL Electricity - known WP site, possibly down)
  - sitarail.bf (SITARAIL Railway)
  - aeroport-ouaga.bf / aeroports.bf (Airport)
  - cameg.bf (CAMEG Pharma)
  - cmu.bf (CMU Health Coverage)
  - rss-bf.org (Social Security)


================================================================================
                     RECOMMENDED FOLLOW-UP ACTIONS
================================================================================

1. moov-africa.bf (HIGHEST PRIORITY):
   - Enumerate all WP users: /wp-json/wp/v2/users?per_page=100&page=N
   - Dump all WooCommerce products: /wp-json/wc/store/v1/products?per_page=100
   - Spider /wp-content/uploads/ directory listing
   - Check for WP plugin vulnerabilities (Yoast 27.0, WooCommerce, Jetpack, Tribe Events)
   - Test WooCommerce payment flow
   - Check for ONATEL stock data in categories

2. www.bceao.int (HIGH PRIORITY):
   - Enumerate all nodes: /node/N?_format=json for N=1..10000+
   - Focus on node types from cache tags: publication, document, offre, appels_offres
   - Test user registration at /user/register
   - Check if REST views are accessible

3. benin.coris.bank (HIGH PRIORITY):
   - Spider /wp-content/uploads/ directory listing
   - Check other Coris branches: bf.coris.bank, tg.coris.bank, ci.coris.bank, etc.
   - Dump all media: /wp-json/wp/v2/media?per_page=100&page=N

4. onea.bf (MEDIUM - rate limited):
   - Retry API endpoints with delays (rate limited at 429)
   - Investigate cPanel/Webmail exposure
   - Test if .git repo can be dumped despite 403

5. www.brvm.org (MEDIUM):
   - Drupal 7.82 + PHP 7.0.33 are severely outdated with known CVEs
   - Test Drupalgeddon variants
   - Enumerate nodes and views

6. developer.ecobank.com (MEDIUM):
   - Investigate developer portal (302 redirect behind BigIP)
   - May expose API documentation or developer keys

7. societegenerale.bf (LOW - well protected):
   - Has formal VDP at vdp.societegenerale.com
   - Imperva WAF blocks most probes

8. boad.org (LOW - well protected):
   - Laravel app, modern stack, properly configured