ghz-winterscheid.de - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 85.13.136.162, located in Germany and belongs to NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE. The main domain is ghz-winterscheid.de.
TLS certificate: Issued by R3 on December 1st 2023. Valid for: 3 months.

This is the only time ghz-winterscheid.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
5	85.13.136.162 85.13.136.162		34788 (NMM-AS D) (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68)
6	2

5 85.13.136.162 (Germany)

ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE)
PTR: dd15336.kasserver.com

ghz-winterscheid.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	ghz-winterscheid.de ghz-winterscheid.de	30 KB
6	1

	Domain	Requested by
5	ghz-winterscheid.de	ghz-winterscheid.de
6	1

This site contains links to these domains. Also see Links.

Domain
de.wordpress.org

Subject Issuer	Validity	Valid
ghz-winterscheid.de R3	`2023-12-01` - `2024-02-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ghz-winterscheid.de/
Frame ID: 514BC964DF5A2E862BF3870D2FD366A6
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

ghz-winterscheid.de

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Page Statistics

6
Requests

83 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

30 kB
Transfer

122 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://de.wordpress.org/
Title: WordPress

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
ghz-winterscheid.de/ 52 KB
11 KB 999ms
224ms Document
text/html 85.13.136.162
02742 Friedersdor...

General

Check archive.org

Show headers Download Go to

Full URL

https://ghz-winterscheid.de/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

85.13.136.162 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),

Reverse DNS

dd15336.kasserver.com

Software

Apache /

Resource Hash

da052671221f65bdc17896aa6aad894c892fa863fcb11c811dbbddd6e26e0b8d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=63072000
X-Content-Security-Policy	default-src 'self'; img-src ; media-src data:;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-headers: Content-Type, Authorization
access-control-allow-methods: GET,POST
content-encoding: br
content-security-policy: upgrade-insecure-requests;
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: unsafe-none; report-to='default'
cross-origin-embedder-policy-report-only: unsafe-none; report-to='default'
cross-origin-opener-policy: unsafe-none
cross-origin-opener-policy-report-only: unsafe-none; report-to='default'
cross-origin-resource-policy: cross-origin
date: Fri, 01 Dec 2023 16:50:56 GMT
link: <https://ghz-winterscheid.de/wp-json/>; rel="https://api.w.org/"
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=()
referrer-policy: strict-origin-when-cross-origin
server: Apache
strict-transport-security: max-age=63072000
vary: Accept-Encoding,User-Agent
x-content-security-policy: default-src 'self'; img-src *; media-src * data:;
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block

GET
H2 200 style.min.css
ghz-winterscheid.de/wp-includes/blocks/navigation/ 16 KB
2 KB 160ms
159ms Stylesheet
text/css 85.13.136.162
02742 Friedersdor...

General

Check archive.org

Show headers Download Go to

Full URL

https://ghz-winterscheid.de/wp-includes/blocks/navigation/style.min.css?ver=6.4.1

Requested by

Host: ghz-winterscheid.de
URL: https://ghz-winterscheid.de/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

85.13.136.162 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),

Reverse DNS

dd15336.kasserver.com

Software

Apache /

Resource Hash

38b1136cf93f9cb1dc433fd40347fed72ebce9522a55393f95feae15a8268233

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=63072000
X-Content-Security-Policy	default-src 'self'; img-src ; media-src data:;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ghz-winterscheid.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests;
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=63072000
x-permitted-cross-domain-policies: none
date: Fri, 01 Dec 2023 16:50:56 GMT
cross-origin-embedder-policy: unsafe-none; report-to='default'
cross-origin-resource-policy: cross-origin
content-length: 2061
x-xss-protection: 1; mode=block
cross-origin-embedder-policy-report-only: unsafe-none; report-to='default'
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 01 Dec 2023 11:16:09 GMT
server: Apache
cross-origin-opener-policy: unsafe-none
etag: "4096-60b70e533beee-br"
vary: Accept-Encoding,User-Agent
access-control-allow-methods: GET,POST
content-type: text/css
x-frame-options: SAMEORIGIN
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=()
accept-ranges: bytes
access-control-allow-headers: Content-Type, Authorization
cross-origin-opener-policy-report-only: unsafe-none; report-to='default'
x-content-security-policy: default-src 'self'; img-src *; media-src * data:;

GET
BLOB 200
OK 6e2812d3-4895-44bf-9b36-4583688c8934
https://ghz-winterscheid.de/ 1 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://ghz-winterscheid.de/6e2812d3-4895-44bf-9b36-4583688c8934
Requested by: Host: ghz-winterscheid.de
URL: https://ghz-winterscheid.de/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Length: 1245
Content-Type: text/javascript

GET
H2 200 interactivity.min.js Show response
ghz-winterscheid.de/wp-includes/js/dist/ 32 KB
12 KB 159ms
158ms Script
application/javascript 85.13.136.162
02742 Friedersdor...

General

Check archive.org

Show headers Download Go to

Full URL

https://ghz-winterscheid.de/wp-includes/js/dist/interactivity.min.js?ver=6.4.1

Requested by

Host: ghz-winterscheid.de
URL: https://ghz-winterscheid.de/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

85.13.136.162 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),

Reverse DNS

dd15336.kasserver.com

Software

Apache /

Resource Hash

8debf919f9d44ba37fa60607809c029f16307d1b27d5472eccb2234563d713bc

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=63072000
X-Content-Security-Policy	default-src 'self'; img-src ; media-src data:;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ghz-winterscheid.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests;
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=63072000
x-permitted-cross-domain-policies: none
date: Fri, 01 Dec 2023 16:50:56 GMT
cross-origin-embedder-policy: unsafe-none; report-to='default'
cross-origin-resource-policy: cross-origin
content-length: 11716
x-xss-protection: 1; mode=block
cross-origin-embedder-policy-report-only: unsafe-none; report-to='default'
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 01 Dec 2023 11:16:09 GMT
server: Apache
cross-origin-opener-policy: unsafe-none
etag: "7e19-60b70e5343bee-br"
vary: Accept-Encoding,User-Agent
access-control-allow-methods: GET,POST
content-type: application/javascript
x-frame-options: SAMEORIGIN
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=()
accept-ranges: bytes
access-control-allow-headers: Content-Type, Authorization
cross-origin-opener-policy-report-only: unsafe-none; report-to='default'
x-content-security-policy: default-src 'self'; img-src *; media-src * data:;

GET
H2 200 view.min.js Show response
ghz-winterscheid.de/wp-includes/blocks/navigation/ 4 KB
1 KB 156ms
156ms Script
application/javascript 85.13.136.162
02742 Friedersdor...

General

Check archive.org

Show headers Download Go to

Full URL

https://ghz-winterscheid.de/wp-includes/blocks/navigation/view.min.js?ver=e3d6f3216904b5b42831

Requested by

Host: ghz-winterscheid.de
URL: https://ghz-winterscheid.de/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

85.13.136.162 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),

Reverse DNS

dd15336.kasserver.com

Software

Apache /

Resource Hash

ecfc357ad95e64230925cfe8fc310394fe5c1b4385eb08354b8fec69af0d6966

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=63072000
X-Content-Security-Policy	default-src 'self'; img-src ; media-src data:;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ghz-winterscheid.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests;
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=63072000
x-permitted-cross-domain-policies: none
date: Fri, 01 Dec 2023 16:50:56 GMT
cross-origin-embedder-policy: unsafe-none; report-to='default'
cross-origin-resource-policy: cross-origin
content-length: 993
x-xss-protection: 1; mode=block
cross-origin-embedder-policy-report-only: unsafe-none; report-to='default'
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 01 Dec 2023 11:16:09 GMT
server: Apache
cross-origin-opener-policy: unsafe-none
etag: "e02-60b70e533beee-br"
vary: Accept-Encoding,User-Agent
access-control-allow-methods: GET,POST
content-type: application/javascript
x-frame-options: SAMEORIGIN
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=()
accept-ranges: bytes
access-control-allow-headers: Content-Type, Authorization
cross-origin-opener-policy-report-only: unsafe-none; report-to='default'
x-content-security-policy: default-src 'self'; img-src *; media-src * data:;

GET
H2 200 wp-emoji-release.min.js Show response
ghz-winterscheid.de/wp-includes/js/ 18 KB
5 KB 160ms
160ms Script
application/javascript 85.13.136.162
02742 Friedersdor...

General

Check archive.org

Show headers Download Go to

Full URL

https://ghz-winterscheid.de/wp-includes/js/wp-emoji-release.min.js?ver=6.4.1

Requested by

Host: ghz-winterscheid.de
URL: https://ghz-winterscheid.de/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

85.13.136.162 , Germany, ASN34788 (NMM-AS D - 02742 Friedersdorf Hauptstrasse 68, DE),

Reverse DNS

dd15336.kasserver.com

Software

Apache /

Resource Hash

4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=63072000
X-Content-Security-Policy	default-src 'self'; img-src ; media-src data:;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ghz-winterscheid.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests;
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=63072000
x-permitted-cross-domain-policies: none
date: Fri, 01 Dec 2023 16:50:56 GMT
cross-origin-embedder-policy: unsafe-none; report-to='default'
cross-origin-resource-policy: cross-origin
content-length: 4647
x-xss-protection: 1; mode=block
cross-origin-embedder-policy-report-only: unsafe-none; report-to='default'
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 01 Dec 2023 11:11:27 GMT
server: Apache
cross-origin-opener-policy: unsafe-none
etag: "4904-60b70d45d827c-br"
vary: Accept-Encoding,User-Agent
access-control-allow-methods: GET,POST
content-type: application/javascript
x-frame-options: SAMEORIGIN
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=()
accept-ranges: bytes
access-control-allow-headers: Content-Type, Authorization
cross-origin-opener-policy-report-only: unsafe-none; report-to='default'
x-content-security-policy: default-src 'self'; img-src *; media-src * data:;

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=63072000
X-Content-Security-Policy	default-src 'self'; img-src ; media-src data:;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ghz-winterscheid.de
85.13.136.162
38b1136cf93f9cb1dc433fd40347fed72ebce9522a55393f95feae15a8268233
453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
8debf919f9d44ba37fa60607809c029f16307d1b27d5472eccb2234563d713bc
da052671221f65bdc17896aa6aad894c892fa863fcb11c811dbbddd6e26e0b8d
ecfc357ad95e64230925cfe8fc310394fe5c1b4385eb08354b8fec69af0d6966

ghz-winterscheid.de Open in urlscan Pro 85.13.136.162 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

6 Requests

83 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

30 kBTransfer

122 kBSize

0 Cookies

1 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

ghz-winterscheid.de Open in urlscan Pro
85.13.136.162 Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

83 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

30 kB
Transfer

122 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions