login.mehrgehalt.de Open in urlscan Pro
2a01:4f8:c0:2c56::247 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://login.mehrgehalt.de/
Effective URL:
https://login.mehrgehalt.de/authentication/admin
Submission: On August 28 via automatic, source certstream-suspicious (August 28th 2021, 1:46:21 am UTC)

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 2a01:4f8:c0:2c56::247, located in Germany and belongs to HETZNER-AS, DE. The main domain is login.mehrgehalt.de.
TLS certificate: Issued by R3 on June 29th 2021. Valid for: 3 months.

This is the only time login.mehrgehalt.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
3 11	2a01:4f8:c0:2... 2a01:4f8:c0:2c56::247		24940 (HETZNER-AS) (HETZNER-AS)
8	1

11 2a01:4f8:c0:2c56::247 (Germany) 3 redirects

ASN24940 (HETZNER-AS, DE)

login.mehrgehalt.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	mehrgehalt.de 3 redirects login.mehrgehalt.de	97 KB
8	1

	Domain	Requested by
11	login.mehrgehalt.de	3 redirects login.mehrgehalt.de
8	1

This site contains no links.

Subject Issuer	Validity	Valid
login.mehrgehalt.de R3	`2021-06-29` - `2021-09-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://login.mehrgehalt.de/authentication/admin
Frame ID: D653B6747F19424B43FB62A1117DF533
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Lohnkonzepte GmbH - Authentication

Page URL History Show full URLs

https://login.mehrgehalt.de/ HTTP 307
https://login.mehrgehalt.de/clients/login HTTP 302
https://login.mehrgehalt.de/admin?/clients/login HTTP 307
https://login.mehrgehalt.de/authentication/admin Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

8
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

96 kB
Transfer

214 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://login.mehrgehalt.de/ HTTP 307
https://login.mehrgehalt.de/clients/login HTTP 302
https://login.mehrgehalt.de/admin?/clients/login HTTP 307
https://login.mehrgehalt.de/authentication/admin Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request admin Show response login.mehrgehalt.de/authentication/ Redirect Chain https://login.mehrgehalt.de/ https://login.mehrgehalt.de/clients/login https://login.mehrgehalt.de/admin?/clients/login https://login.mehrgehalt.de/authentication/admin	11 KB 2 KB	108ms 107ms	Document text/html	2a01:4f8:c0:2c56::247 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://login.mehrgehalt.de/authentication/admin Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a01:4f8:c0:2c56::247 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software Apache / Resource Hash `bc33a95471d9d518a83a0f3e6fc1b594717b4163f5b6f49964c84d229cf5e23a` Request headers Host login.mehrgehalt.de Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Cookie sp_session=srp3cgval9gtie28k23ls658qe7lcmq2 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Sat, 28 Aug 2021 01:46:04 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Vary Accept-Encoding Content-Encoding gzip Content-Length 1767 Keep-Alive timeout=5, max=97 Connection Keep-Alive Content-Type text/html; charset=utf-8 Redirect headers Date Sat, 28 Aug 2021 01:46:03 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Location https://login.mehrgehalt.de/authentication/admin Content-Length 0 Keep-Alive timeout=5, max=98 Connection Keep-Alive Content-Type text/html; charset=utf-8
GET H/1.1	200 OK	reset.min.css login.mehrgehalt.de/assets/css/	971 B 833 B	5ms 4ms	Stylesheet text/css	2a01:4f8:c0:2c56::247 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://login.mehrgehalt.de/assets/css/reset.min.css?v=1.9.4 Requested by Host: login.mehrgehalt.de URL: https://login.mehrgehalt.de/authentication/admin Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a01:4f8:c0:2c56::247 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software Apache / Resource Hash `5a027114a8b16751f9abf1505dbac6c51360dc25217697e7da0e0f70887c013f` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host login.mehrgehalt.de Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://login.mehrgehalt.de/authentication/admin Cookie sp_session=srp3cgval9gtie28k23ls658qe7lcmq2 Connection keep-alive Referer https://login.mehrgehalt.de/authentication/admin User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Sat, 28 Aug 2021 01:46:04 GMT Content-Encoding gzip Last-Modified Fri, 02 Mar 2018 09:18:44 GMT Server Apache ETag "3cb-5666a767ca500-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 514
GET H/1.1	200 OK	bootstrap.min.css login.mehrgehalt.de/assets/plugins/bootstrap/css/	118 KB 20 KB	13ms 8ms	Stylesheet text/css	2a01:4f8:c0:2c56::247 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://login.mehrgehalt.de/assets/plugins/bootstrap/css/bootstrap.min.css Requested by Host: login.mehrgehalt.de URL: https://login.mehrgehalt.de/authentication/admin Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a01:4f8:c0:2c56::247 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software Apache / Resource Hash `5a3d8c05785485d36ee5c94d4681e5b1d9e4b94c5be8b5bd7b0f3168fff1bd9a` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host login.mehrgehalt.de Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://login.mehrgehalt.de/authentication/admin Cookie sp_session=srp3cgval9gtie28k23ls658qe7lcmq2 Connection keep-alive Referer https://login.mehrgehalt.de/authentication/admin User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Sat, 28 Aug 2021 01:46:04 GMT Content-Encoding gzip Last-Modified Fri, 02 Mar 2018 09:18:50 GMT Server Apache ETag "1d975-5666a76d83280-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=95 Content-Length 19749
GET H/1.1	200 OK	roboto.css login.mehrgehalt.de/assets/plugins/roboto/	1011 B 608 B	11ms 4ms	Stylesheet text/css	2a01:4f8:c0:2c56::247 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://login.mehrgehalt.de/assets/plugins/roboto/roboto.css Requested by Host: login.mehrgehalt.de URL: https://login.mehrgehalt.de/authentication/admin Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a01:4f8:c0:2c56::247 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software Apache / Resource Hash `124272ebb1f3debb6ca59e2a27622a7f9fe193f58fa5037170e83d514d0291c4` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host login.mehrgehalt.de Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://login.mehrgehalt.de/authentication/admin Cookie sp_session=srp3cgval9gtie28k23ls658qe7lcmq2 Connection keep-alive Referer https://login.mehrgehalt.de/authentication/admin User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Sat, 28 Aug 2021 01:46:04 GMT Content-Encoding gzip Last-Modified Fri, 02 Mar 2018 09:19:34 GMT Server Apache ETag "3f3-5666a79779580-gzip" Vary Accept-Encoding Upgrade h2 Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type text/css Keep-Alive timeout=5, max=100 Content-Length 266
GET H/1.1	200 OK	bs-overides.min.css login.mehrgehalt.de/assets/css/	11 KB 2 KB	16ms 4ms	Stylesheet text/css	2a01:4f8:c0:2c56::247 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://login.mehrgehalt.de/assets/css/bs-overides.min.css Requested by Host: login.mehrgehalt.de URL: https://login.mehrgehalt.de/authentication/admin Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a01:4f8:c0:2c56::247 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software Apache / Resource Hash `9b31c828d48b7290994fd88a8c9354a4e849fe206e821497ad1b6f7400dd0925` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host login.mehrgehalt.de Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://login.mehrgehalt.de/authentication/admin Cookie sp_session=srp3cgval9gtie28k23ls658qe7lcmq2 Connection keep-alive Referer https://login.mehrgehalt.de/authentication/admin User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Sat, 28 Aug 2021 01:46:04 GMT Content-Encoding gzip Last-Modified Fri, 02 Mar 2018 09:18:44 GMT Server Apache ETag "2a4b-5666a767ca500-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1611
GET H/1.1	200 OK	authentication.min.css login.mehrgehalt.de/assets/css/	3 KB 1 KB	18ms 4ms	Stylesheet text/css	2a01:4f8:c0:2c56::247 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://login.mehrgehalt.de/assets/css/authentication.min.css?v=1.9.4 Requested by Host: login.mehrgehalt.de URL: https://login.mehrgehalt.de/authentication/admin Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a01:4f8:c0:2c56::247 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software Apache / Resource Hash `f6da9bbfe3a82979c3c7cb8be269f72204f0a93e3b1ef7ace19075761a95c7db` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host login.mehrgehalt.de Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://login.mehrgehalt.de/authentication/admin Cookie sp_session=srp3cgval9gtie28k23ls658qe7lcmq2 Connection keep-alive Referer https://login.mehrgehalt.de/authentication/admin User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Sat, 28 Aug 2021 01:46:04 GMT Content-Encoding gzip Last-Modified Fri, 02 Mar 2018 09:18:44 GMT Server Apache ETag "c32-5666a767ca500-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=94 Content-Length 880
GET H/1.1	200 OK	logo.png login.mehrgehalt.de/uploads/company/	8 KB 8 KB	19ms 3ms	Image image/png	2a01:4f8:c0:2c56::247 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://login.mehrgehalt.de/uploads/company/logo.png Requested by Host: login.mehrgehalt.de URL: https://login.mehrgehalt.de/authentication/admin Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a01:4f8:c0:2c56::247 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software Apache / Resource Hash `23f642dc4fdb24b9b514b31e9355d2ca92b0d32a5f46e6bcc3b88bb36f3bc775` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host login.mehrgehalt.de Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Cache-Control* no-cache Sec-Fetch-Dest image Referer https://login.mehrgehalt.de/authentication/admin Cookie sp_session=srp3cgval9gtie28k23ls658qe7lcmq2 Connection keep-alive Referer https://login.mehrgehalt.de/authentication/admin User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Sat, 28 Aug 2021 01:46:04 GMT Last-Modified Fri, 02 Mar 2018 09:21:30 GMT Server Apache ETag "1e66-5666a80619a80" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 7782
GET H/1.1	200 OK	Roboto-Regular.woff2 login.mehrgehalt.de/assets/plugins/roboto/fonts/Regular/	62 KB 62 KB	5ms 5ms	Font font/woff2	2a01:4f8:c0:2c56::247 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://login.mehrgehalt.de/assets/plugins/roboto/fonts/Regular/Roboto-Regular.woff2?v=1.1.0 Requested by Host: login.mehrgehalt.de URL: https://login.mehrgehalt.de/assets/plugins/roboto/roboto.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a01:4f8:c0:2c56::247 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS Software Apache / Resource Hash `cc7b26ac53700f78f8a452be6d14f14943e88dceb14edf64cddceba6e66f3f5e` Request headers Pragma no-cache Sec-Fetch-Site same-origin Origin https://login.mehrgehalt.de Accept-Encoding gzip, deflate, br Host login.mehrgehalt.de Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode cors Accept / Cache-Control no-cache Sec-Fetch-Dest font Referer https://login.mehrgehalt.de/assets/plugins/roboto/roboto.css Cookie sp_session=srp3cgval9gtie28k23ls658qe7lcmq2 Connection keep-alive Origin https://login.mehrgehalt.de Referer https://login.mehrgehalt.de/assets/plugins/roboto/roboto.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Sat, 28 Aug 2021 01:46:04 GMT Last-Modified Fri, 02 Mar 2018 09:19:36 GMT Server Apache ETag "f7b4-5666a79961a00" Content-Type font/woff2 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 63412

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			login.mehrgehalt.de/	1970-01-19 20:49:03	Name: sp_session Value: srp3cgval9gtie28k23ls658qe7lcmq2

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

login.mehrgehalt.de
2a01:4f8:c0:2c56::247
124272ebb1f3debb6ca59e2a27622a7f9fe193f58fa5037170e83d514d0291c4
23f642dc4fdb24b9b514b31e9355d2ca92b0d32a5f46e6bcc3b88bb36f3bc775
5a027114a8b16751f9abf1505dbac6c51360dc25217697e7da0e0f70887c013f
5a3d8c05785485d36ee5c94d4681e5b1d9e4b94c5be8b5bd7b0f3168fff1bd9a
9b31c828d48b7290994fd88a8c9354a4e849fe206e821497ad1b6f7400dd0925
bc33a95471d9d518a83a0f3e6fc1b594717b4163f5b6f49964c84d229cf5e23a
cc7b26ac53700f78f8a452be6d14f14943e88dceb14edf64cddceba6e66f3f5e
f6da9bbfe3a82979c3c7cb8be269f72204f0a93e3b1ef7ace19075761a95c7db

login.mehrgehalt.de Open in urlscan Pro 2a01:4f8:c0:2c56::247 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

96 kBTransfer

214 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

1 Cookies

Indicators

login.mehrgehalt.de Open in urlscan Pro
2a01:4f8:c0:2c56::247 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

96 kB
Transfer

214 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions