Submitted URL: https://media.vpn.do-not-reply.khck24.de/
Effective URL: https://www.check24.de/
Submission: On November 13 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 5 IPs in 1 countries across 3 domains to perform 12 HTTP transactions. The main IP is 89.191.69.71, located in Germany and belongs to MEGASPACE-AS, DE. The main domain is www.check24.de. The Cisco Umbrella rank of the primary domain is 168216.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on November 14th 2023. Valid for: a year.
This is the only time www.check24.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 62.116.173.69 15456 (INTERNETX-AS)
3 89.191.69.71 34624 (MEGASPACE-AS)
2 2a00:1450:400... 15169 (GOOGLE)
1 195.30.141.73 5539 (SPACENET ...)
1 89.191.91.251 34624 (MEGASPACE-AS)
12 5
Apex Domain
Subdomains
Transfer
5 check24.de
t.check24.de
www.check24.de — Cisco Umbrella Rank: 168216
hotel.check24.de — Cisco Umbrella Rank: 223120
156 KB
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 65
22 KB
1 khck24.de
media.vpn.do-not-reply.khck24.de
242 B
12 3
Domain Requested by
2 www.check24.de www.check24.de
2 www.google-analytics.com t.check24.de
www.google-analytics.com
2 t.check24.de
1 hotel.check24.de www.check24.de
1 media.vpn.do-not-reply.khck24.de 1 redirects
12 5
Subject Issuer Validity Valid
*.check24.de
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-11-14 -
2024-12-14
a year crt.sh
*.google-analytics.com
WR2
2024-10-21 -
2025-01-13
3 months crt.sh
www.check24.de
DigiCert EV RSA CA G2
2023-12-04 -
2025-01-03
a year crt.sh
hotel.check24.de
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-02-12 -
2025-02-11
a year crt.sh

This page contains 2 frames:

Primary Page: https://www.check24.de/
Frame ID: 4A7D9CB24F70C0899BC6B304AD3276A4
Requests: 18 HTTP requests in this frame

Frame: https://hotel.check24.de/external/home-teaser/variables
Frame ID: 3282FCC7054D54FF51DB8D1C65046BA5
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

CHECK24 | Das Vergleichsportal

Page URL History Show full URLs

  1. https://media.vpn.do-not-reply.khck24.de/ HTTP 307
    http://t.check24.de/?wpset=ch24_hp_tc24_2 HTTP 307
    https://t.check24.de/?wpset=ch24_hp_tc24_2 Page URL
  2. https://www.check24.de/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Page Statistics

12
Requests

58 %
HTTPS

20 %
IPv6

3
Domains

5
Subdomains

5
IPs

1
Countries

177 kB
Transfer

2171 kB
Size

14
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://media.vpn.do-not-reply.khck24.de/ HTTP 307
    http://t.check24.de/?wpset=ch24_hp_tc24_2 HTTP 307
    https://t.check24.de/?wpset=ch24_hp_tc24_2 Page URL
  2. https://www.check24.de/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://media.vpn.do-not-reply.khck24.de/ HTTP 307
  • http://t.check24.de/?wpset=ch24_hp_tc24_2 HTTP 307
  • https://t.check24.de/?wpset=ch24_hp_tc24_2

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
t.check24.de/
Redirect Chain
  • https://media.vpn.do-not-reply.khck24.de/
  • http://t.check24.de/?wpset=ch24_hp_tc24_2
  • https://t.check24.de/?wpset=ch24_hp_tc24_2
878 B
782 B
Document
General
Full URL
https://t.check24.de/?wpset=ch24_hp_tc24_2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.191.69.71 , Germany, ASN34624 (MEGASPACE-AS, DE),
Reverse DNS
Software
nginx /
Resource Hash
0a0124112fc0438d42fa1b9981cc824b178e1c0d98868315e6f42cbd3bd8ad21

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 13 Nov 2024 02:04:59 GMT
server
nginx
vary
Accept-Encoding Accept-Encoding
x-robots-tag
noindex, nofollow

Redirect headers

Location
https://t.check24.de/?wpset=ch24_hp_tc24_2
Non-Authoritative-Reason
HttpsUpgrades
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: t.check24.de
URL: https://t.check24.de/?wpset=ch24_hp_tc24_2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://t.check24.de/

Response headers

content-encoding
gzip
age
2092
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options
nosniff
expires
Wed, 13 Nov 2024 03:30:07 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 13 Nov 2024 01:30:07 GMT
last-modified
Tue, 12 Dec 2023 18:09:08 GMT
content-type
text/javascript
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
20994
server
Golfe2
collect
www.google-analytics.com/j/
3 B
419 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1614361195&t=pageview&_s=1&dl=https%3A%2F%2Ft.check24.de%2F%3Fwpset%3Dch24_hp_tc24_2&ul=de-de&de=UTF-8&dt=Redirect&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=1677098039&gjid=1781405139&cid=1291856613.1731463500&tid=UA-67623541-1&_gid=416486217.1731463500&_r=1&_slc=1&z=1014468992
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://t.check24.de/

Response headers

report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 13 Nov 2024 02:05:00 GMT
last-modified
Sun, 17 May 1998 03:00:00 GMT
content-type
text/plain
cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin
https://t.check24.de
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
3
server
Golfe2
Primary Request /
www.check24.de/
2 MB
0
Document
General
Full URL
https://www.check24.de/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.191.69.71 , Germany, ASN34624 (MEGASPACE-AS, DE),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-ancestors check24.de *.check24.de
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://t.check24.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ch
Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-WoW64
cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-security-policy
frame-ancestors check24.de *.check24.de
content-type
text/html; charset=UTF-8
critical-ch
Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-WoW64
date
Wed, 13 Nov 2024 02:05:00 GMT
expires
Mon, 26 Jul 1997 05:00:00 GMT
last-modified
Wed, 13 Nov 2024 02:05:00 GMT
pragma
no-cache
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding Accept-Encoding
favicon.ico
t.check24.de/
1 KB
748 B
Other
General
Full URL
https://t.check24.de/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.191.69.71 , Germany, ASN34624 (MEGASPACE-AS, DE),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://t.check24.de/?wpset=ch24_hp_tc24_2

Response headers

cache-control
max-age=432000
content-encoding
gzip
etag
W/"672386fd-47e"
expires
Mon, 18 Nov 2024 02:05:00 GMT
date
Wed, 13 Nov 2024 02:05:00 GMT
content-type
image/x-icon
vary
Accept-Encoding, Accept-Encoding
server
nginx
last-modified
Thu, 31 Oct 2024 13:32:45 GMT
/
www.check24.de/ajax/device/detect/
17 B
643 B
XHR
General
Full URL
https://www.check24.de/ajax/device/detect/
Requested by
Host: www.check24.de
URL: https://www.check24.de/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
195.30.141.73 , Germany, ASN5539 (SPACENET SpaceNET AG, DE),
Reverse DNS
Software
nginx /
Resource Hash
fba7b6f05dcca579a233543992fe09ab3eca5f10a1f2b81240210a2025dcc61f
Security Headers
Name Value
Content-Security-Policy frame-ancestors check24.de *.check24.de
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Referer
https://www.check24.de/

Response headers

strict-transport-security
max-age=31536000
content-security-policy
frame-ancestors check24.de *.check24.de
content-encoding
gzip
accept-ch
Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-WoW64
critical-ch
Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-WoW64
date
Wed, 13 Nov 2024 02:05:02 GMT
content-type
application/json; charset=UTF-8
vary
Accept-Encoding, Accept-Encoding
server
nginx
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c254c73326ba1310e3df199d0a16813db36862a85d4288e2dea35dd017293cde

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/
8 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
58cab3b8390cf5808646dd42373bcb521e84417b29f63b4e727878a5ce0cddd7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/
745 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
15344ec1431f922a4d1f7a5318ce2c2457037891bdff5790802225c3d3b2ee20

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/
574 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3054670734c59da957419fc268b422342c7b6d732ed5d6bcc3d4c21e6cf78729

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
20a5d20f12e6676878add5e93ed041156f9427e034e78ff934658dc723836e42

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5aaca7b771f05711c13da850000af460a70dfbb0e68ad54a7fcda219cc4a7f96

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
background_kfz_v1.jpg
www.check24.de/assets/images/ver/kfz/teaser/
0
0

info-icon-white-outline.svg
www.check24.de/assets/images/web/svg/
0
0

truncated
/
340 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7b31efd1bcf78b3fe2842115a42c671e9f679a8006e4d50e65ad32f2422fd336

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml;charset=utf8
variables
hotel.check24.de/external/home-teaser/ Frame 3282
497 KB
154 KB
Document
General
Full URL
https://hotel.check24.de/external/home-teaser/variables
Requested by
Host: www.check24.de
URL: https://www.check24.de/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.191.91.251 , Germany, ASN34624 (MEGASPACE-AS, DE),
Reverse DNS
Software
nginx /
Resource Hash
f710ad7cdf7cbeae0f8fc0d9e3369d596c00de980c377313a890f5ef600c403a
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.check24.de https://*.check24-test.de https://*.check24-int.de https://*.check24.at https://*.check24-test.at https://*.check24-int.at https://www.check24.de;

Request headers

Referer
https://www.check24.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

accept-ch
Sec-Ch-Ua,Sec-Ch-Ua-Arch,Sec-Ch-Ua-Bitness,Sec-Ch-Ua-Full-Version,Sec-Ch-Ua-Full-Version-List,Sec-Ch-Ua-Mobile,Sec-Ch-Ua-Model,Sec-Ch-Ua-Platform,Sec-Ch-Ua-Platform-Version
c24-correlation-id
15d6901d-5fee-4d56-bb51-0ea49625cb94
cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-security-policy
frame-ancestors https://*.check24.de https://*.check24-test.de https://*.check24-int.de https://*.check24.at https://*.check24-test.at https://*.check24-int.at https://www.check24.de;
content-type
text/html; charset=UTF-8
critical-ch
Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version
date
Wed, 13 Nov 2024 02:05:04 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx
vary
Accept-Encoding User-Agent
allseason_grey.svg
www.check24.de/assets/images/svg/icons/
0
0

winter_grey.svg
www.check24.de/assets/images/svg/icons/
0
0

summer_grey.svg
www.check24.de/assets/images/svg/icons/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.check24.de
URL
https://www.check24.de/assets/images/ver/kfz/teaser/background_kfz_v1.jpg?v=1
Domain
www.check24.de
URL
https://www.check24.de/assets/images/web/svg/info-icon-white-outline.svg
Domain
www.check24.de
URL
https://www.check24.de/assets/images/svg/icons/allseason_grey.svg?v=7
Domain
www.check24.de
URL
https://www.check24.de/assets/images/svg/icons/winter_grey.svg?v=7
Domain
www.check24.de
URL
https://www.check24.de/assets/images/svg/icons/summer_grey.svg?v=7

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 string| CHECK24_HOST object| xhr

14 Cookies

Domain/Path Name / Value
.check24.de/ Name: wpset
Value: ch24_hp_tc24_2
.check24.de/ Name: _ga
Value: GA1.2.1291856613.1731463500
.check24.de/ Name: _gid
Value: GA1.2.416486217.1731463500
.check24.de/ Name: _gat
Value: 1
.check24.de/ Name: devicetype
Value: desktop
.check24.de/ Name: deviceoutput
Value: desktop
hotel.check24.de/ Name: ho_check24
Value: dc5461e344784ae8aaa39de2ac0f5945
hotel.check24.de/ Name: olth
Value: 93
hotel.check24.de/ Name: c24usersession
Value: 9abf146686215adc2b723e08
.check24.de/ Name: travel_initialvertical
Value: hotel
hotel.check24.de/ Name: ho_user_session_identifier
Value: 29f28cd7d3459dc3cf89a4ac3080143269957590
hotel.check24.de/ Name: c24usertoken
Value: usertoken2--43ac1f483d0a48dfd0c401117699682585c3d7baa16cd9eb376aad5a0d7947b2+qZjyP6sEQROGEULSdVQ+1O597JQBD5Y3GajCK5yViAFyle52LWkBDOZnQNtlAm/3fmlBsCyKQ/Ait5vMBeZvpy7BVvepyb5yaVLabS7EomI+v1PNeC/ii/0cCaJZlFBAbdV0VfiTLqIxUglKBzOHSOKhWyfjSt0+jm+VuR4KgFFmI3HqBuqPug7KQMixF9afZAWgcdQl81n0w8nhQZmQN/TT2XJWD2QjzFxqBFBbFZ6ppk9Ww01SHB+qlVI+/LiwBvTtxGMWr+Eu+2lpfFV/HpurDT5+OBJkM6bCk7kKfUs8bKE9w7DfKhUQ/0NZ3LvIReEOxomFmihu4C2EU4kyhvgS9QV+PMvnfRMnj/IFTxQO+H3tw/5RHafU1d6cp9wayzZrmUAQUHJBdesfbamemTHsY+zN7G/ghgz63W1eOE5JUXBnc4Xj9yOhRwEuSfct6kW5KDfN9dNAV1H021ekYcX1lUg+diq1lEKt7gVZ96rIH90ybTbp79jBz6U/58E+EDk8v7MozONltvmhDqBPq/7lHEJ25Xd9Ga+icOJqgoVKvRoq6S3yzE/PqxIGnfxDWqEbzFZKGzh1nKHepwO2K2UE4ODCWOng8rjmmaOT5Cwa00q3u0mm73nwPWOv02WpKBeZ+quw5RVpp2gtJTXqcCh4DiVRtszQuTZ5PTy43yEbnQ+c6aduL1Q8fWrJtYSi60wy9sqpL7wt4LhLuhD/9Q2QPf80sOCuN7OivT9F3OXoO1I1CvlGX+He5FHWDrqy6/eS+hcZI+eRGHzphVeKs6u7vKKxdQHnB1d9oCWf/I9bQl5aQNPMY2UoCMB/jo1E0+9P1pTUgMza7njGKEPI2HfprOV6kftbONkTvQ04OA=
hotel.check24.de/ Name: verticalId7
Value: ec0f081f583ccdd54f170903ec54d40c%7C%7C29f28cd7d3459dc3cf89a4ac3080143269957590
hotel.check24.de/ Name: hotel_splash
Value: true