link.bericht.sparbericht.de Open in urlscan Pro
146.255.57.29 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://link.bericht.sparbericht.de/display.php?M=113482964&C=dc88fa5ab0857e80921fc0caac32be7b&S=114510&L=1345&N=77286
Submission: On October 27 via manual (October 27th 2021, 10:56:38 pm UTC) from US — Scanned from DE

Summary HTTP 13 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 8 domains to perform 13 HTTP transactions. The main IP is 146.255.57.29, located in Austria and belongs to NESSUS, AT. The main domain is link.bericht.sparbericht.de.
TLS certificate: Issued by R3 on September 9th 2021. Valid for: 3 months.

This is the only time link.bericht.sparbericht.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	146.255.57.29 146.255.57.29	47692 (NESSUS) (NESSUS)
1	142.250.185.74 142.250.185.74	15169 (GOOGLE) (GOOGLE)
4	85.13.142.146 85.13.142.146	34788 (NMM-AS D) (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68)
1	172.67.18.130 172.67.18.130	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.28.41.64 52.28.41.64	16509 (AMAZON-02) (AMAZON-02)
1 2	136.243.10.236 136.243.10.236	24940 (HETZNER-AS) (HETZNER-AS)
3	142.250.186.35 142.250.186.35	15169 (GOOGLE) (GOOGLE)
13	7

2 146.255.57.29 (Austria)

ASN47692 (NESSUS, AT)
PTR: ip146255057029.rev.nessus.at

link.bericht.sparbericht.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.sendlx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.74 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 85.13.142.146 (Germany)

ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE)
PTR: dd22938.kasserver.com

media.mailexperts.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.18.130 (United States)

ASN13335 (CLOUDFLARENET, US)

static.lottohelden.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.28.41.64 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-41-64.eu-central-1.compute.amazonaws.com

www.trustedshops.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 136.243.10.236 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: sepp.nubos.de

em.wdr.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.35 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	mailexperts.de media.mailexperts.de	24 KB
3	gstatic.com fonts.gstatic.com	48 KB
2	wdr.to 1 redirects em.wdr.to	1 KB
1	sendlx.com www.sendlx.com	232 B
1	trustedshops.com www.trustedshops.com	11 KB
1	lottohelden.de static.lottohelden.de	284 KB
1	googleapis.com fonts.googleapis.com	1 KB
1	sparbericht.de link.bericht.sparbericht.de	6 KB
13	8

	Domain	Requested by
4	media.mailexperts.de	link.bericht.sparbericht.de
3	fonts.gstatic.com	fonts.googleapis.com
2	em.wdr.to	1 redirects link.bericht.sparbericht.de
1	www.sendlx.com	link.bericht.sparbericht.de
1	www.trustedshops.com	link.bericht.sparbericht.de
1	static.lottohelden.de	link.bericht.sparbericht.de
1	fonts.googleapis.com	link.bericht.sparbericht.de
1	link.bericht.sparbericht.de
13	8

This site contains links to these domains. Also see Links.

Domain
www.sendlx.com

Subject Issuer	Validity	Valid
www.sendlx.com R3	`2021-09-09` - `2021-12-08`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-10-04` - `2021-12-27`	3 months	crt.sh
media.mailexperts.de R3	`2021-10-09` - `2022-01-07`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-01` - `2022-06-30`	a year	crt.sh
*.trustedshops.com Amazon	`2020-12-28` - `2022-01-26`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-10-04` - `2021-12-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://link.bericht.sparbericht.de/display.php?M=113482964&C=dc88fa5ab0857e80921fc0caac32be7b&S=114510&L=1345&N=77286
Frame ID: 2FAD888375B8997CDF6A5B0FF85CE2F0
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

lottohelden.de

Page Statistics

13
Requests

92 %
HTTPS

0 %
IPv6

8
Domains

8
Subdomains

7
IPs

3
Countries

374 kB
Transfer

394 kB
Size

1
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://www.sendlx.com/display.php?M=113482964&C=dc88fa5ab0857e80921fc0caac32be7b&L=1345&N=77286
Title: Onlineversion

Search URL Search Domain Scan URL

URL: https://www.sendlx.com/link.php?M=113482964&N=114510&L=20192602&F=H

Search URL Search Domain Scan URL

URL: https://www.sendlx.com/link.php?M=113482964&N=114510&L=20192603&F=H

Search URL Search Domain Scan URL

URL: https://www.sendlx.com/link.php?M=113482964&N=114510&L=20192604&F=H
Title: 10 € Gutschein sichern

Search URL Search Domain Scan URL

URL: https://www.sendlx.com/link.php?M=113482964&N=114510&L=20192605&F=H
Title: Lottohelden.de - Einfach, sicher, günstig!

Search URL Search Domain Scan URL

URL: https://www.sendlx.com/link.php?M=113482964&N=114510&L=20192606&F=H

Search URL Search Domain Scan URL

URL: https://www.sendlx.com/link.php?M=113482964&N=114510&L=20192607&F=H

Search URL Search Domain Scan URL

URL: https://www.sendlx.com/link.php?M=113482964&N=114510&L=20192608&F=H

Search URL Search Domain Scan URL

URL: https://www.sendlx.com/link.php?M=113482964&N=114510&L=20192609&F=H

Search URL Search Domain Scan URL

URL: https://www.sendlx.com/link.php?M=113482964&N=114510&L=20192610&F=H
Title: Lottohelden.de

Search URL Search Domain Scan URL

URL: https://www.sendlx.com/link.php?M=113482964&N=114510&L=20192611&F=H
Title: www.lottohelden.de/spielsuchtpraeventionen/

Search URL Search Domain Scan URL

URL: https://www.sendlx.com/unsubscribe.php?&M=113482964&N=114510&L=1345&C=dc88fa5ab0857e80921fc0caac32be7b
Title: diesen Link

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7

https://em.wdr.to/l/2c9280877c7d3859017cb7e90230074d HTTP 302
https://em.wdr.to/p

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request display.php Show response
link.bericht.sparbericht.de/ 21 KB
6 KB 188ms
101ms Document
text/html 146.255.57.29
NESSUS

General

Check archive.org

Show headers Download Go to

Full URL: https://link.bericht.sparbericht.de/display.php?M=113482964&C=dc88fa5ab0857e80921fc0caac32be7b&S=114510&L=1345&N=77286
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.255.57.29 , Austria, ASN47692 (NESSUS, AT),
Reverse DNS: ip146255057029.rev.nessus.at
Software: Apache/2.4.25 (Debian) /
Resource Hash: db83b85b8321134f8be1f5e4ecd2420d9257ed03f20ca9d290b13837503cbfea

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Wed, 27 Oct 2021 22:56:33 GMT
Server: Apache/2.4.25 (Debian)
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 5645
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf8

GET
H2 200 css
fonts.googleapis.com/ 9 KB
1 KB 39ms
16ms Stylesheet
text/css 142.250.185.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source%20Sans%20Pro:400,600,700,900&display=swap

Requested by

Host: link.bericht.sparbericht.de
URL: https://link.bericht.sparbericht.de/display.php?M=113482964&C=dc88fa5ab0857e80921fc0caac32be7b&S=114510&L=1345&N=77286

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.74 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f10.1e100.net

Software

ESF /

Resource Hash

75f24c2fce5d88d093b3c4cce6eb44c04f1e4242611b17ca20c280396529f736

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://link.bericht.sparbericht.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 27 Oct 2021 22:56:33 GMT
server: ESF
date: Wed, 27 Oct 2021 22:56:33 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk"
expires: Wed, 27 Oct 2021 22:56:33 GMT

GET
H2 200 LH_Logo.png
media.mailexperts.de/Lottohelden/img/ 22 KB
22 KB 86ms
27ms Image
image/png 85.13.142.146
02742 Friedersdor...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.mailexperts.de/Lottohelden/img/LH_Logo.png
Requested by: Host: link.bericht.sparbericht.de
URL: https://link.bericht.sparbericht.de/display.php?M=113482964&C=dc88fa5ab0857e80921fc0caac32be7b&S=114510&L=1345&N=77286
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 85.13.142.146 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS: dd22938.kasserver.com
Software: Apache /
Resource Hash: 85f19302086f936e857be4646db5afeeed0620368f82e3697951162e6dfa139f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://link.bericht.sparbericht.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 22:56:33 GMT
last-modified: Mon, 08 Mar 2021 16:34:12 GMT
server: Apache
accept-ranges: bytes
etag: "5683-5bd0900fd9923"
content-length: 22147
content-type: image/png

GET
H2 200 LO_10f1_2021.gif
static.lottohelden.de/newsletter/ex/pics/ 283 KB
284 KB 160ms
121ms Image
image/gif 172.67.18.130
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.lottohelden.de/newsletter/ex/pics/LO_10f1_2021.gif
Requested by: Host: link.bericht.sparbericht.de
URL: https://link.bericht.sparbericht.de/display.php?M=113482964&C=dc88fa5ab0857e80921fc0caac32be7b&S=114510&L=1345&N=77286
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.18.130 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 164ad773e46e879d8b7be82101d833bd7ac6f4d5f8a0b437bb67b8f27a2bb8d9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://link.bericht.sparbericht.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 22:56:34 GMT
x-delivered-by: fe-production2
last-modified: Mon, 14 Jun 2021 11:12:00 GMT
server: cloudflare
etag: "60c73980-46a91"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=5
accept-ranges: bytes
cf-ray: 6a4f84b42cb127b4-PRG
cf-cache-status: BYPASS
content-length: 289425

GET
H2 200 service.png
media.mailexperts.de/Lottohelden/img/ 752 B
823 B 110ms
52ms Image
image/png 85.13.142.146
02742 Friedersdor...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.mailexperts.de/Lottohelden/img/service.png
Requested by: Host: link.bericht.sparbericht.de
URL: https://link.bericht.sparbericht.de/display.php?M=113482964&C=dc88fa5ab0857e80921fc0caac32be7b&S=114510&L=1345&N=77286
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 85.13.142.146 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS: dd22938.kasserver.com
Software: Apache /
Resource Hash: 211398888463b33b98dcbec9c89d942b0b48212de67769c4fefa3848d28100f4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://link.bericht.sparbericht.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 22:56:33 GMT
last-modified: Mon, 08 Mar 2021 15:01:33 GMT
server: Apache
accept-ranges: bytes
etag: "2f0-5bd07b5a80dd5"
content-length: 752
content-type: image/png

GET
H2 200 icon_trusted.png
media.mailexperts.de/Lottohelden/img/ 868 B
916 B 110ms
52ms Image
image/png 85.13.142.146
02742 Friedersdor...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.mailexperts.de/Lottohelden/img/icon_trusted.png
Requested by: Host: link.bericht.sparbericht.de
URL: https://link.bericht.sparbericht.de/display.php?M=113482964&C=dc88fa5ab0857e80921fc0caac32be7b&S=114510&L=1345&N=77286
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 85.13.142.146 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS: dd22938.kasserver.com
Software: Apache /
Resource Hash: c3380e0cabf88ae6a4fcb602dd52c754f105e29d478b181649a3a18b09c3399c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://link.bericht.sparbericht.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 22:56:33 GMT
last-modified: Mon, 08 Mar 2021 15:01:33 GMT
server: Apache
accept-ranges: bytes
etag: "364-5bd07b5a81d75"
content-length: 868
content-type: image/png

GET
H2 200 Staat.png
media.mailexperts.de/Lottohelden/img/ 616 B
664 B 110ms
52ms Image
image/png 85.13.142.146
02742 Friedersdor...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.mailexperts.de/Lottohelden/img/Staat.png
Requested by: Host: link.bericht.sparbericht.de
URL: https://link.bericht.sparbericht.de/display.php?M=113482964&C=dc88fa5ab0857e80921fc0caac32be7b&S=114510&L=1345&N=77286
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 85.13.142.146 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),
Reverse DNS: dd22938.kasserver.com
Software: Apache /
Resource Hash: bf05f17902629c6088a81263d213b1a90c813d31c62ddd271f83495eba99dc81

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://link.bericht.sparbericht.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 22:56:33 GMT
last-modified: Mon, 08 Mar 2021 15:01:33 GMT
server: Apache
accept-ranges: bytes
etag: "268-5bd07b5a96595"
content-length: 616
content-type: image/png

GET
H2 200 X1836CCF3C692DF75A609CD82EDACEBDA.gif
www.trustedshops.com/bewertung/widget/widgets/ 11 KB
11 KB 36ms
15ms Image
image/gif 52.28.41.64
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.trustedshops.com/bewertung/widget/widgets/X1836CCF3C692DF75A609CD82EDACEBDA.gif
Requested by: Host: link.bericht.sparbericht.de
URL: https://link.bericht.sparbericht.de/display.php?M=113482964&C=dc88fa5ab0857e80921fc0caac32be7b&S=114510&L=1345&N=77286
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.28.41.64 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-41-64.eu-central-1.compute.amazonaws.com
Software: Apache /
Resource Hash: 7c5c3d25f7fa3f6353b6a806b4a6e40d9f6bda94617c4915c3d164bcb5898fa6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://link.bericht.sparbericht.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 22:56:33 GMT
last-modified: Wed, 27 Oct 2021 02:30:00 GMT
server: Apache
content-type: image/gif
cache-control: max-age=20006
accept-ranges: bytes
content-length: 10913
expires: Thu, 28 Oct 2021 04:30:00 GMT

GET
H/1.1

200

p
em.wdr.to/
Redirect Chain

https://em.wdr.to/l/2c9280877c7d3859017cb7e90230074d
https://em.wdr.to/p

167 B
515 B

33ms
12ms

Image
image/png

136.243.10.236
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://em.wdr.to/p

Requested by

Host: link.bericht.sparbericht.de
URL: https://link.bericht.sparbericht.de/display.php?M=113482964&C=dc88fa5ab0857e80921fc0caac32be7b&S=114510&L=1345&N=77286

Protocol

HTTP/1.1

Server

136.243.10.236 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

sepp.nubos.de

Software

Resource Hash

b4671a5e3b84e8ce16b67cecc9043374d0e05b5cc7f2b6d3277d6a1fca823f08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://link.bericht.sparbericht.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 27 Oct 2021 22:56:34 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Type: image/png
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: close
Content-Length: 167
X-XSS-Protection: 1; mode=block
X-Application-Context: emma:salesbutlers:8080
Expires: 0

Redirect headers

Pragma: no-cache
Date: Wed, 27 Oct 2021 22:56:34 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Language: de-DE
Location: http://em.wdr.to/p
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: close
Content-Length: 0
X-XSS-Protection: 1; mode=block
X-Application-Context: emma:salesbutlers:8080
Expires: 0

GET
H/1.1 200
OK open.php
www.sendlx.com/ 43 B
232 B 76ms
37ms Image
image/gif 146.255.57.29
NESSUS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.sendlx.com/open.php?M=113482964&L=1345&N=114510&F=H
Requested by: Host: link.bericht.sparbericht.de
URL: https://link.bericht.sparbericht.de/display.php?M=113482964&C=dc88fa5ab0857e80921fc0caac32be7b&S=114510&L=1345&N=77286
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.255.57.29 , Austria, ASN47692 (NESSUS, AT),
Reverse DNS: ip146255057029.rev.nessus.at
Software: Apache/2.4.25 (Debian) /
Resource Hash: dd5bdccb831d1b19c505bd3e67553f6049cea2e20dba7eb231a02ed0103e521f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://link.bericht.sparbericht.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Wed, 27 Oct 2021 22:56:33 GMT
Server: Apache/2.4.25 (Debian)
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 43
Content-Type: image/gif

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 15 KB
16 KB 29ms
7ms Font
font/woff2 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source%20Sans%20Pro:400,600,700,900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

24f7e397faec79e62c37ff2f00b170f6dc1557fb46ac169f9f1897a9d641dd03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://link.bericht.sparbericht.de
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 22 Oct 2021 04:16:28 GMT
x-content-type-options: nosniff
age: 499205
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15764
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:17 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 22 Oct 2022 04:16:28 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 16 KB
16 KB 36ms
14ms Font
font/woff2 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source%20Sans%20Pro:400,600,700,900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://link.bericht.sparbericht.de
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 24 Oct 2021 11:16:30 GMT
x-content-type-options: nosniff
age: 301203
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:09 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Mon, 24 Oct 2022 11:16:30 GMT

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 16 KB
16 KB 33ms
11ms Font
font/woff2 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source%20Sans%20Pro:400,600,700,900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

efb3cdc5e4582fd67dffab6fc6e5062074ce3f8c51747346af944e97749dc309

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://link.bericht.sparbericht.de
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 21 Oct 2021 21:28:54 GMT
x-content-type-options: nosniff
age: 523659
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15948
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:32 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Fri, 21 Oct 2022 21:28:54 GMT

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			static.lottohelden.de/	1970-01-19 22:26:20	Name: AWSALBCORS Value: XfO7JZyGi1IGBFQsi51v8LOIq8o2K135V56wCejrBfb79jdbDoTWyywqd57ugVcK6dIu8yFI8svXV0PWCGfHPGCZ4xqNPt0WewFYGjkbFG53JIHHjhPa3Y5I60gt

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://link.bericht.sparbericht.de/display.php?M=113482964&C=dc88fa5ab0857e80921fc0caac32be7b&S=114510&L=1345&N=77286 Message: Mixed Content: The page at 'https://link.bericht.sparbericht.de/display.php?M=113482964&C=dc88fa5ab0857e80921fc0caac32be7b&S=114510&L=1345&N=77286' was loaded over HTTPS, but requested an insecure element 'http://em.wdr.to/l/2c9280877c7d3859017cb7e90230074d'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://link.bericht.sparbericht.de/display.php?M=113482964&C=dc88fa5ab0857e80921fc0caac32be7b&S=114510&L=1345&N=77286 Message: Mixed Content: The page at 'https://link.bericht.sparbericht.de/display.php?M=113482964&C=dc88fa5ab0857e80921fc0caac32be7b&S=114510&L=1345&N=77286' was loaded over HTTPS, but requested an insecure element 'http://em.wdr.to/l/2c9280877c7d3859017cb7e90230074d'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

em.wdr.to
fonts.googleapis.com
fonts.gstatic.com
link.bericht.sparbericht.de
media.mailexperts.de
static.lottohelden.de
www.sendlx.com
www.trustedshops.com
136.243.10.236
142.250.185.74
142.250.186.35
146.255.57.29
172.67.18.130
52.28.41.64
85.13.142.146
164ad773e46e879d8b7be82101d833bd7ac6f4d5f8a0b437bb67b8f27a2bb8d9
211398888463b33b98dcbec9c89d942b0b48212de67769c4fefa3848d28100f4
24f7e397faec79e62c37ff2f00b170f6dc1557fb46ac169f9f1897a9d641dd03
75f24c2fce5d88d093b3c4cce6eb44c04f1e4242611b17ca20c280396529f736
7c5c3d25f7fa3f6353b6a806b4a6e40d9f6bda94617c4915c3d164bcb5898fa6
85f19302086f936e857be4646db5afeeed0620368f82e3697951162e6dfa139f
a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199
b4671a5e3b84e8ce16b67cecc9043374d0e05b5cc7f2b6d3277d6a1fca823f08
bf05f17902629c6088a81263d213b1a90c813d31c62ddd271f83495eba99dc81
c3380e0cabf88ae6a4fcb602dd52c754f105e29d478b181649a3a18b09c3399c
db83b85b8321134f8be1f5e4ecd2420d9257ed03f20ca9d290b13837503cbfea
dd5bdccb831d1b19c505bd3e67553f6049cea2e20dba7eb231a02ed0103e521f
efb3cdc5e4582fd67dffab6fc6e5062074ce3f8c51747346af944e97749dc309

link.bericht.sparbericht.de Open in urlscan Pro 146.255.57.29 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

13 Requests

92 %HTTPS

0 %IPv6

8 Domains

8 Subdomains

7 IPs

3 Countries

374 kBTransfer

394 kBSize

1 Cookies

12 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

link.bericht.sparbericht.de Open in urlscan Pro
146.255.57.29 Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

92 %
HTTPS

0 %
IPv6

8
Domains

8
Subdomains

7
IPs

3
Countries

374 kB
Transfer

394 kB
Size

1
Cookies

13 HTTP transactions
0 data transactions