kundenportal.oerag.de Open in urlscan Pro
2600:9000:20eb:9000:d:2d60:4e00:93a1  Public Scan

URL: https://kundenportal.oerag.de/
Submission: On July 04 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 2600:9000:20eb:9000:d:2d60:4e00:93a1, located in United States and belongs to AMAZON-02, US. The main domain is kundenportal.oerag.de.
TLS certificate: Issued by Amazon RSA 2048 M02 on July 3rd 2024. Valid for: a year.
This is the only time kundenportal.oerag.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
10 2600:9000:20e... 16509 (AMAZON-02)
10 1
Apex Domain
Subdomains
Transfer
10 oerag.de
kundenportal.oerag.de
847 KB
10 1
Domain Requested by
10 kundenportal.oerag.de kundenportal.oerag.de
10 1

This site contains links to these domains. Also see Links.

Domain
www.meinrecht.de
Subject Issuer Validity Valid
kundenportal.oerag.de
Amazon RSA 2048 M02
2024-07-03 -
2025-07-31
a year crt.sh

This page contains 1 frames:

Primary Page: https://kundenportal.oerag.de/
Frame ID: A81B599D10BCCBE3923F9151B8741EE4
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

MEINRECHT-Kundenportal

Page Statistics

10
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

847 kB
Transfer

1342 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
kundenportal.oerag.de/
4 KB
3 KB
Document
General
Full URL
https://kundenportal.oerag.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:9000:d:2d60:4e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
65bd6d325b8a5ab0608ca537d9649fb5587445ae00a76ac79372b4b638d7227e
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

content-encoding
gzip
content-security-policy
default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
content-type
text/html
date
Thu, 04 Jul 2024 00:07:45 GMT
etag
W/"495158dc1781c2b0328e3b20d658b4fb"
expires
0
last-modified
Tue, 09 Apr 2024 11:37:33 GMT
referrer-policy
same-origin
server
AmazonS3
strict-transport-security
max-age=63072000; includeSubdomains; preload
vary
Accept-Encoding
via
1.1 c7f7b4cf7fd5efe64bac95586db3f62a.cloudfront.net (CloudFront)
x-amz-cf-id
UE4YNwUMa12HqpMWReM6Jcw8vvOVCWyOfFiLX4lOO0vsKwRQIsYz3w==
x-amz-cf-pop
FRA2-C1
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-content-type-options
nosniff
x-frame-options
deny
x-xss-protection
1; mode=block
styles.css
kundenportal.oerag.de/
4 KB
2 KB
Stylesheet
General
Full URL
https://kundenportal.oerag.de/styles.css
Requested by
Host: kundenportal.oerag.de
URL: https://kundenportal.oerag.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:9000:d:2d60:4e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c86aac31f466f6a40f419b57ce87f3c5875651546b98f6b717dc0ae8161f4395
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://kundenportal.oerag.de/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
date
Thu, 04 Jul 2024 00:07:46 GMT
content-encoding
gzip
via
1.1 c7f7b4cf7fd5efe64bac95586db3f62a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
same-origin
last-modified
Tue, 09 Apr 2024 11:37:33 GMT
server
AmazonS3
etag
W/"33abe65405c2b4981172431517e4c09c"
x-frame-options
deny
vary
Accept-Encoding
content-type
text/css
x-amz-cf-id
15UjxipPEJcJwUtE7T5gYBn6P9l8bIdctR9qA3EanwNlzXPRO1XDdQ==
expires
0
meinrecht-logo.svg
kundenportal.oerag.de/assets/icons/
3 KB
2 KB
Image
General
Full URL
https://kundenportal.oerag.de/assets/icons/meinrecht-logo.svg
Requested by
Host: kundenportal.oerag.de
URL: https://kundenportal.oerag.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:9000:d:2d60:4e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3f19c8cc8987e68ace3eff0c1127254ed8d2890c878ee44dc2296d3d623bbcea
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://kundenportal.oerag.de/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
date
Thu, 04 Jul 2024 00:07:46 GMT
content-encoding
gzip
via
1.1 c7f7b4cf7fd5efe64bac95586db3f62a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
same-origin
last-modified
Tue, 09 Apr 2024 11:37:33 GMT
server
AmazonS3
etag
W/"6afcc10cd28318b644f5f9a392e197f8"
x-frame-options
deny
vary
Accept-Encoding
content-type
image/svg+xml
x-amz-cf-id
uw7JjdjeyUXyKQAppmqY9Et1cQtKsBjIPO7mLH_aXZ2ovRGgte9XHg==
expires
0
man-on-scooter-illu.svg
kundenportal.oerag.de/assets/icons/
1 MB
539 KB
Image
General
Full URL
https://kundenportal.oerag.de/assets/icons/man-on-scooter-illu.svg
Requested by
Host: kundenportal.oerag.de
URL: https://kundenportal.oerag.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:9000:d:2d60:4e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
54ca00e506a0abcd5cc209ea8d5a41e6c7daecd99c44d95555192984488f014b
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://kundenportal.oerag.de/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
date
Thu, 04 Jul 2024 00:07:46 GMT
content-encoding
gzip
via
1.1 c7f7b4cf7fd5efe64bac95586db3f62a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
same-origin
last-modified
Tue, 09 Apr 2024 11:37:32 GMT
server
AmazonS3
etag
W/"4512b1918201b18c32a6379868a8026e"
x-frame-options
deny
vary
Accept-Encoding
content-type
image/svg+xml
x-amz-cf-id
K-fiQUMj3I-9bpFl4ZyMebdfnDD4xJmqkJlR0cxIlRBjLlJAdqFjxw==
expires
0
arrow.svg
kundenportal.oerag.de/assets/icons/
338 B
1 KB
Image
General
Full URL
https://kundenportal.oerag.de/assets/icons/arrow.svg
Requested by
Host: kundenportal.oerag.de
URL: https://kundenportal.oerag.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:9000:d:2d60:4e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
99a2de8059b7797b3651fe82b835f767d8c6c07a2c6fe5b25280d670be695801
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://kundenportal.oerag.de/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
date
Thu, 04 Jul 2024 00:07:46 GMT
via
1.1 c7f7b4cf7fd5efe64bac95586db3f62a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
content-length
338
x-xss-protection
1; mode=block
referrer-policy
same-origin
last-modified
Tue, 09 Apr 2024 11:37:33 GMT
server
AmazonS3
etag
"5438be6e4d39d97194edf6e4ef0d29a9"
x-frame-options
deny
vary
Accept-Encoding
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
FeO9xbV1MOTFU_tUeYyUrXwCRQPequN8NwrFEQCeOVf-yBDgOjbIRA==
expires
0
countdown.js
kundenportal.oerag.de/
2 KB
2 KB
Script
General
Full URL
https://kundenportal.oerag.de/countdown.js
Requested by
Host: kundenportal.oerag.de
URL: https://kundenportal.oerag.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:9000:d:2d60:4e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6c14b7ffaea768732b4ec71e6c4c0f7867e85364ae53344b70a1a2c45fb1c662
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://kundenportal.oerag.de/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
date
Thu, 04 Jul 2024 00:07:46 GMT
content-encoding
gzip
via
1.1 c7f7b4cf7fd5efe64bac95586db3f62a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
same-origin
last-modified
Tue, 09 Apr 2024 11:37:33 GMT
server
AmazonS3
etag
W/"131b8bb414394a963e955149178927e1"
x-frame-options
deny
vary
Accept-Encoding
content-type
text/javascript
x-amz-cf-id
8c5wClx1Z0fs6ujQP9g1XktJa8zjGOPDCN9_0Kg0Hhr2j9VeW7D5cw==
expires
0
SparkasseHead_Rg.ttf
kundenportal.oerag.de/assets/fonts/
91 KB
92 KB
Font
General
Full URL
https://kundenportal.oerag.de/assets/fonts/SparkasseHead_Rg.ttf
Requested by
Host: kundenportal.oerag.de
URL: https://kundenportal.oerag.de/styles.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:9000:d:2d60:4e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2f6c1e71843149bd63ddc645a7fafda45e4033c501e31715a7ae1a7970af2d93
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://kundenportal.oerag.de/styles.css
Origin
https://kundenportal.oerag.de
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
date
Thu, 04 Jul 2024 00:07:46 GMT
via
1.1 c7f7b4cf7fd5efe64bac95586db3f62a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
content-length
93368
x-xss-protection
1; mode=block
referrer-policy
same-origin
last-modified
Tue, 09 Apr 2024 11:37:32 GMT
server
AmazonS3
etag
"46ffb019a818fc3670a9a06f33b267e4"
x-frame-options
deny
access-control-allow-methods
GET
content-type
binary/octet-stream
access-control-allow-origin
*
access-control-max-age
0
vary
Accept-Encoding
accept-ranges
bytes
x-amz-cf-id
4kuC233I2kIphckUguUNeT-dP5o1C5KooFGdav7OZ0Y-dN4cPLzoPw==
expires
0
Sparkasse_Lt.ttf
kundenportal.oerag.de/assets/fonts/
76 KB
77 KB
Font
General
Full URL
https://kundenportal.oerag.de/assets/fonts/Sparkasse_Lt.ttf
Requested by
Host: kundenportal.oerag.de
URL: https://kundenportal.oerag.de/styles.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:9000:d:2d60:4e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b1051f6e34802a5e61a1cbbbf92d69b9c36caf6060ad0170bf9992a64b54a1d0
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://kundenportal.oerag.de/styles.css
Origin
https://kundenportal.oerag.de
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
date
Thu, 04 Jul 2024 00:07:46 GMT
via
1.1 c7f7b4cf7fd5efe64bac95586db3f62a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
content-length
77844
x-xss-protection
1; mode=block
referrer-policy
same-origin
last-modified
Tue, 09 Apr 2024 11:37:33 GMT
server
AmazonS3
etag
"91c43725a4e55401b4d073a47df6c006"
x-frame-options
deny
access-control-allow-methods
GET
content-type
binary/octet-stream
access-control-allow-origin
*
access-control-max-age
0
vary
Accept-Encoding
accept-ranges
bytes
x-amz-cf-id
feHs0ckjCBycctZVNT4Yn3HQDK_aGoYmx9ZjvGs9L9dIiW3uWvMPhA==
expires
0
Sparkasse_Rg.ttf
kundenportal.oerag.de/assets/fonts/
111 KB
113 KB
Font
General
Full URL
https://kundenportal.oerag.de/assets/fonts/Sparkasse_Rg.ttf
Requested by
Host: kundenportal.oerag.de
URL: https://kundenportal.oerag.de/styles.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:9000:d:2d60:4e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b15d388f8a14859642b7df7f2c54c4445d7d7587e94bc003f492d84b2c0bdffb
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://kundenportal.oerag.de/styles.css
Origin
https://kundenportal.oerag.de
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
date
Thu, 04 Jul 2024 00:07:46 GMT
via
1.1 c7f7b4cf7fd5efe64bac95586db3f62a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
content-length
114056
x-xss-protection
1; mode=block
referrer-policy
same-origin
last-modified
Tue, 09 Apr 2024 11:37:33 GMT
server
AmazonS3
etag
"9b1c560d0dd7452c115eb5cd0fde41ec"
x-frame-options
deny
access-control-allow-methods
GET
content-type
binary/octet-stream
access-control-allow-origin
*
access-control-max-age
0
vary
Accept-Encoding
accept-ranges
bytes
x-amz-cf-id
N3dx3Jsz5i-e-Mlej11hWJPO7FKtgumEO8CQNmaC1mmohJ5cIOIOtA==
expires
0
favicon.ico
kundenportal.oerag.de/
15 KB
16 KB
Other
General
Full URL
https://kundenportal.oerag.de/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:9000:d:2d60:4e00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8bd64c992f3143e616ba392d571dcd8efddc552d462df87e1e4b70b9055c14f4
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://kundenportal.oerag.de/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
date
Thu, 04 Jul 2024 00:07:46 GMT
via
1.1 c7f7b4cf7fd5efe64bac95586db3f62a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
content-length
15406
x-xss-protection
1; mode=block
referrer-policy
same-origin
last-modified
Tue, 09 Apr 2024 11:37:33 GMT
server
AmazonS3
etag
"a59c489fb574170c6f84cdb65e17f5c3"
x-frame-options
deny
vary
Accept-Encoding
content-type
image/vnd.microsoft.icon
accept-ranges
bytes
x-amz-cf-id
ptn50dCR6S-6OGlzCNwawiL2emVCuFqm1ewUwzghFCdNZDY-D8pWTw==
expires
0

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage object| countDownDate function| getReferrerAddress

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; img-src 'self' https://*.s3.eu-central-1.amazonaws.com data: https://*.oerag.de https://images.ctfassets.net; object-src 'none'; script-src 'self' https://www.google.com/recaptcha/api.js https://www.gstatic.com; style-src 'self' 'unsafe-inline' https://www.gstatic.com; connect-src 'self' blob: https://*.oerag.cloud https://*.meinrecht.de https://*.rdl.oerag.cloud https://*.oerag.de wss://*.oerag.cloud wss://*.oerag.de wss://*.meinrecht.de wss://*.rdl.oerag.cloud https://cdn.contentful.com https://cognito-idp.eu-central-1.amazonaws.com https://*.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com; frame-ancestors 'self'; frame-src https://www.google.com/recaptcha/; base-uri 'self'; form-action 'self'
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block