GoKawiilAugust 21, 2026 · 9 min read
Note: to protect the company, I swapped out anything that could point back to it for fake examples. The domain electricscootercompany.com.br , the app package, and the user details (slug, name, and email) are all made up. None of it matches the real company.
It started with a news article. A company had just dropped a bunch of electric scooters in my city. Most people saw a new way to get around town. I saw a fleet of internet-connected devices running on a backend nobody had poked at yet.
First I needed two things: which company this was, and how the service worked for a normal user. The name was right there in the article, and a quick Google got me to their site, which laid out the flow:
open the app on your phone; scan the scooter's QR Code; pay to unlock the vehicle; ride.
That's the happy path for any user. I wanted to see what was going on behind it.
Step 1: Recon
I started by mapping everything tied to electricscootercompany.com.br . Subdomain enumeration pulled up a bunch, including:
www app api privacidade privacidade2 dev membro vouchers planos validate painel
Not all of those were real apps. app , membro , vouchers , and planos all served basically the same page that just pushed you to the app stores. Lots of names, not much new to look at.
... continue reading