urlscan.io logo urlscan.io
SecurityTrails logo

bag.adminforge.de Open in urlscan Pro
2a01:4f8:231:1726::33  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://bag.adminforge.de/
Effective URL: https://bag.adminforge.de/login
Submission: On January 27 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 2a01:4f8:231:1726::33, located in Germany and belongs to HETZNER-AS, DE. The main domain is bag.adminforge.de.
TLS certificate: Issued by R3 on January 27th 2024. Valid for: 3 months.
This is the only time bag.adminforge.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 9 2a01:4f8:231:... 24940 (HETZNER-AS)
8 1
Apex Domain
Subdomains		 Transfer
9 adminforge.de
bag.adminforge.de
4 MB
8 1
Domain Requested by
9 bag.adminforge.de 1 redirects bag.adminforge.de
8 1

This site contains no links.

Subject Issuer Validity Valid
bag.adminforge.de
R3		 2024-01-27 -
2024-04-26		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://bag.adminforge.de/login
Frame ID: 1938BA2482AD9FA2665F2D8540B07F91
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Willkommen bei wallabag! – wallabag

Page URL History Show full URLs

  1. https://bag.adminforge.de/ HTTP 302
    http://bag.adminforge.de/login HTTP 307
    https://bag.adminforge.de/login Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href="[^"]*material(?:\.[\w]+-[\w]+)?(?:\.min)?\.css
  • (?:/([\d.]+))?/material(?:\.min)?\.js

Page Statistics

8
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

3800 kB
Transfer

3797 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://bag.adminforge.de/ HTTP 302
    http://bag.adminforge.de/login HTTP 307
    https://bag.adminforge.de/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login
bag.adminforge.de/
Redirect Chain
  • https://bag.adminforge.de/
  • http://bag.adminforge.de/login
  • https://bag.adminforge.de/login
5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bag.adminforge.de/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a01:4f8:231:1726::33 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx /
Resource Hash
139d428583d1cd161700625d60470e91eeddd0fae1c3c4e01ef87d24f16f7816
Security Headers
Name Value
Content-Security-Policy default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; block-all-mixed-content
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

cache-control
max-age=0, must-revalidate, private
content-encoding
gzip
content-security-policy
default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; block-all-mixed-content
content-type
text/html; charset=UTF-8
date
Sat, 27 Jan 2024 12:40:59 GMT
expect-ct
enforce, max-age=21600
expires
Sat, 27 Jan 2024 12:40:59 GMT
pragma
no-cache
referrer-policy
same-origin
server
nginx
strict-transport-security
max-age=31536000; includeSubdomains; preload
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://bag.adminforge.de/login
Non-Authoritative-Reason
HSTS
material.css
bag.adminforge.de/wallassets/ 		270 KB
271 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bag.adminforge.de/wallassets/material.css
Requested by
Host: bag.adminforge.de
URL: https://bag.adminforge.de/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a01:4f8:231:1726::33 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx /
Resource Hash
a156ae00be9035197d183361d8551c297991203d6033b62f04838521e17c4455
Security Headers
Name Value
Content-Security-Policy default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; block-all-mixed-content
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://bag.adminforge.de/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Sat, 27 Jan 2024 12:41:00 GMT
content-security-policy
default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; block-all-mixed-content
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubdomains; preload
last-modified
Wed, 03 Jan 2024 07:24:57 GMT
server
nginx
referrer-policy
same-origin
etag
"65950bc9-43882"
expect-ct
enforce, max-age=21600
x-frame-options
SAMEORIGIN
content-type
text/css
accept-ranges
bytes
content-length
276610
x-xss-protection
1; mode=block
router.js
bag.adminforge.de/bundles/fosjsrouting/js/ 		15 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bag.adminforge.de/bundles/fosjsrouting/js/router.js
Requested by
Host: bag.adminforge.de
URL: https://bag.adminforge.de/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a01:4f8:231:1726::33 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx /
Resource Hash
cee7b3016ac52c0d37b08300c6e9b9b63535f9b77567b036bc7975236a8cd4f3
Security Headers
Name Value
Content-Security-Policy default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; block-all-mixed-content
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://bag.adminforge.de/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Sat, 27 Jan 2024 12:41:00 GMT
content-security-policy
default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; block-all-mixed-content
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubdomains; preload
last-modified
Wed, 03 Jan 2024 08:34:52 GMT
server
nginx
referrer-policy
same-origin
etag
"65951c2c-3c74"
expect-ct
enforce, max-age=21600
x-frame-options
SAMEORIGIN
content-type
application/javascript
accept-ranges
bytes
content-length
15476
x-xss-protection
1; mode=block
routing
bag.adminforge.de/js/ 		2 KB
962 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bag.adminforge.de/js/routing?callback=fos.Router.setData
Requested by
Host: bag.adminforge.de
URL: https://bag.adminforge.de/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a01:4f8:231:1726::33 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx /
Resource Hash
2996dec57dc49f90d0456b7b32f632066e492e5076f9a875623630265fe6396a
Security Headers
Name Value
Content-Security-Policy default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; block-all-mixed-content
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://bag.adminforge.de/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 27 Jan 2024 12:41:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; block-all-mixed-content
server
nginx
strict-transport-security
max-age=31536000; includeSubdomains; preload
referrer-policy
same-origin
expect-ct
enforce, max-age=21600
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
cache-control
max-age=0, must-revalidate, private
x-xss-protection
1; mode=block
expires
Sat, 27 Jan 2024 12:41:00 GMT
material.js
bag.adminforge.de/wallassets/ 		3 MB
3 MB 		Script
General
Check archive.org
Download Go to
Full URL
https://bag.adminforge.de/wallassets/material.js
Requested by
Host: bag.adminforge.de
URL: https://bag.adminforge.de/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a01:4f8:231:1726::33 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx /
Resource Hash
89be7a40bf479f40347c6b098540aedbc865b4909314f7a056312a371b0000a7
Security Headers
Name Value
Content-Security-Policy default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; block-all-mixed-content
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://bag.adminforge.de/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Sat, 27 Jan 2024 12:41:00 GMT
content-security-policy
default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; block-all-mixed-content
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubdomains; preload
last-modified
Wed, 03 Jan 2024 07:24:57 GMT
server
nginx
referrer-policy
same-origin
etag
"65950bc9-33b99b"
expect-ct
enforce, max-age=21600
x-frame-options
SAMEORIGIN
content-type
application/javascript
accept-ranges
bytes
content-length
3389851
x-xss-protection
1; mode=block
logo-wallabag.svg
bag.adminforge.de/img/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bag.adminforge.de/img/logo-wallabag.svg
Requested by
Host: bag.adminforge.de
URL: https://bag.adminforge.de/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a01:4f8:231:1726::33 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx /
Resource Hash
b84e79606d8a835dfdd692d2f7c713b50162532cab46872c30ae5029e1dbf326
Security Headers
Name Value
Content-Security-Policy default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; block-all-mixed-content
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://bag.adminforge.de/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Sat, 27 Jan 2024 12:41:00 GMT
content-security-policy
default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; block-all-mixed-content
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubdomains; preload
last-modified
Wed, 03 Jan 2024 07:24:57 GMT
server
nginx
referrer-policy
same-origin
etag
"65950bc9-24bc"
expect-ct
enforce, max-age=21600
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
content-length
9404
x-xss-protection
1; mode=block
Roboto-Regular.woff2
bag.adminforge.de/wallassets/fonts/ 		63 KB
64 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://bag.adminforge.de/wallassets/fonts/Roboto-Regular.woff2
Requested by
Host: bag.adminforge.de
URL: https://bag.adminforge.de/wallassets/material.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a01:4f8:231:1726::33 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx /
Resource Hash
02a7cd67c545041654af047f04ce327f2df086386eab421adc16269010c50365
Security Headers
Name Value
Content-Security-Policy default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; block-all-mixed-content
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://bag.adminforge.de/wallassets/material.css
Origin
https://bag.adminforge.de
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Sat, 27 Jan 2024 12:41:01 GMT
content-security-policy
default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; block-all-mixed-content
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubdomains; preload
last-modified
Wed, 03 Jan 2024 07:24:57 GMT
server
nginx
referrer-policy
same-origin
etag
"65950bc9-fd40"
expect-ct
enforce, max-age=21600
x-frame-options
SAMEORIGIN
content-type
font/woff2
accept-ranges
bytes
content-length
64832
x-xss-protection
1; mode=block
MaterialIcons-Regular.woff2
bag.adminforge.de/wallassets/fonts/ 		122 KB
123 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://bag.adminforge.de/wallassets/fonts/MaterialIcons-Regular.woff2
Requested by
Host: bag.adminforge.de
URL: https://bag.adminforge.de/wallassets/material.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a01:4f8:231:1726::33 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
nginx /
Resource Hash
5743ed3d91616a10fca2bc2ba0f6f0707300c05bdc65bc6d9d4fb2cd75253ffe
Security Headers
Name Value
Content-Security-Policy default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; block-all-mixed-content
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://bag.adminforge.de/wallassets/material.css
Origin
https://bag.adminforge.de
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Sat, 27 Jan 2024 12:41:01 GMT
content-security-policy
default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; block-all-mixed-content
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubdomains; preload
last-modified
Wed, 03 Jan 2024 07:24:57 GMT
server
nginx
referrer-policy
same-origin
etag
"65950bc9-1e8bc"
expect-ct
enforce, max-age=21600
x-frame-options
SAMEORIGIN
content-type
font/woff2
accept-ranges
bytes
content-length
125116
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| Routing object| fos function| Hammer object| Materialize object| Waves object| MathJax function| Mousetrap function| QRCode object| QRErrorCorrectLevel object| jrQrcode function| validate_field

1 Cookies

Domain/Path Name / Value
bag.adminforge.de/ Name: PHPSESSID
Value: 1a202915fa7a1e548ec0641fdf6ba8d8

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; block-all-mixed-content
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block