suche.guenstiger.de Open in urlscan Pro
2606:4700::6812:18c3 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://pauramountplus.com/
Effective URL:
https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719
Submission: On February 03 via api (February 3rd 2022, 6:07:03 pm UTC) from US — Scanned from DE

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 15 HTTP transactions. The main IP is 2606:4700::6812:18c3, located in United States and belongs to CLOUDFLARENET, US. The main domain is suche.guenstiger.de. The Cisco Umbrella rank of the primary domain is 330235.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on September 14th 2021. Valid for: a year.

This is the only time suche.guenstiger.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	81.17.29.150 81.17.29.150	51852 (PLI-AS) (PLI-AS)
1 2	104.206.252.90 104.206.252.90	62904 (EONIX-COM...) (EONIX-COMMUNICATIONS-ASBLOCK-62904)
1 1	78.46.197.88 78.46.197.88	24940 (HETZNER-AS) (HETZNER-AS)
2	157.90.169.168 157.90.169.168	24940 (HETZNER-AS) (HETZNER-AS)
2 3	2a00:12c0:101... 2a00:12c0:101b:200::19	47215 (FILOO-ASN...) (FILOO-ASN Rhedaer Strasse 25)
10	2606:4700::68... 2606:4700::6812:18c3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	6

2 81.17.29.150 (Zurich, Switzerland) 1 redirects

ASN51852 (PLI-AS, PA)

pauramountplus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.206.252.90 (New York, United States) 1 redirects

ASN62904 (EONIX-COMMUNICATIONS-ASBLOCK-62904, US)
PTR: 90-252-206-104.staticrdns.eonix.net

4773.booknower.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 78.46.197.88 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.88.197.46.78.clients.your-server.de

clever-redirect.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.90.169.168 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.168.169.90.157.clients.your-server.de

lookandfind.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:12c0:101b:200::19 (Germany) 2 redirects

ASN47215 (FILOO-ASN Rhedaer Strasse 25, DE)

tracking.s24.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2606:4700::6812:18c3 (United States)

ASN13335 (CLOUDFLARENET, US)

suche.guenstiger.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	guenstiger.de suche.guenstiger.de — Cisco Umbrella Rank: 330235	491 KB
3	s24.com 2 redirects tracking.s24.com — Cisco Umbrella Rank: 121501	3 KB
2	lookandfind.me lookandfind.me	1 KB
2	booknower.com 1 redirects 4773.booknower.com	2 KB
2	pauramountplus.com 1 redirects pauramountplus.com	1 KB
1	clever-redirect.com 1 redirects clever-redirect.com	440 B
15	6

	Domain	Requested by
10	suche.guenstiger.de	suche.guenstiger.de pauramountplus.com
3	tracking.s24.com	2 redirects lookandfind.me
2	lookandfind.me	pauramountplus.com
2	4773.booknower.com	1 redirects pauramountplus.com
2	pauramountplus.com	1 redirects
1	clever-redirect.com	1 redirects
15	6

This site contains no links.

Subject Issuer	Validity	Valid
lookandfind.me R3	`2022-01-02` - `2022-04-02`	3 months	crt.sh
*.s24.com R3	`2022-01-13` - `2022-04-13`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-14` - `2022-09-13`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719
Frame ID: 03205C062CB5CB5194970C237CCFA0E8
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Guenstiger.de - Der große Preisvergleich im Internet

Page URL History Show full URLs

http://pauramountplus.com/ Page URL
http://pauramountplus.com/?js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY0Mzk... HTTP 302
http://4773.booknower.com/match-4773/67091/195273269/1643911617/mf_ee21c8f7-e932-4a66-b456-60706d5cabf... Page URL
http://4773.booknower.com/match-4773/67091/195273269/1643911617/mf_ee21c8f7-e932-4a66-b456-60706d5cabf... HTTP 302
https://clever-redirect.com/s/r6?s=822615&s3=apix07-pauramountplus.com HTTP 302
https://lookandfind.me/s/a?t=9&f=1&u=f4bdb01fc36e3f720c2a963a770625c6&m=bauhaus.info&s1=822615&s2=&... Page URL
https://lookandfind.me/s/r?u=https%3A%2F%2Ftracking.s24.com%2Fv3%2Fclickout%2F9c8a1f68%2F4865%2F429... Page URL
https://tracking.s24.com/v3/clickout/9c8a1f68/4865/4291424447/c36c5470844d1d71faa3391f0d87fe60864667a... HTTP 303
https://tracking.s24.com/v3/proceed?cor_b=CiRhOWE1NzY1OS0zMDU0LTQ1YjMtYWQ3Zi04ZjFkYzIyYTI2YWISIDVmMTh... Page URL
https://tracking.s24.com/v3/commit?cor_b=CiRhOWE1NzY1OS0zMDU0LTQ1YjMtYWQ3Zi04ZjFkYzIyYTI2YWISIDVmMThm... HTTP 303
https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traff... Page URL
https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traff... Page URL

Detected technologies

TrackJs (Analytics) Expand

Overall confidence: 100%
Detected patterns

tracker\.js

Page Statistics

15
Requests

87 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

496 kB
Transfer

883 kB
Size

9
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://pauramountplus.com/ Page URL
http://pauramountplus.com/?js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY0MzkxODgxNywiaWF0IjoxNjQzOTExNjE3LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIycjg1aHB2b2EzazNtbG4zNWcwODh0MGkiLCJuYmYiOjE2NDM5MTE2MTcsInRzIjoxNjQzOTExNjE3MzE2OTE4fQ.A6m37FKASzrHXRwIOcG_fPq1qrG1x6I2RBoJuCb1Xyg&sid=136bc810-851c-11ec-9967-4e6e7ca9c31b HTTP 302
http://4773.booknower.com/match-4773/67091/195273269/1643911617/mf_ee21c8f7-e932-4a66-b456-60706d5cabfc/YXBpeDA3LXBhdXJhbW91bnRwbHVzLmNvbQ==/feed Page URL
http://4773.booknower.com/match-4773/67091/195273269/1643911617/mf_ee21c8f7-e932-4a66-b456-60706d5cabfc/YXBpeDA3LXBhdXJhbW91bnRwbHVzLmNvbQ== HTTP 302
https://clever-redirect.com/s/r6?s=822615&s3=apix07-pauramountplus.com HTTP 302
https://lookandfind.me/s/a?t=9&f=1&u=f4bdb01fc36e3f720c2a963a770625c6&m=bauhaus.info&s1=822615&s2=&s3=apix07-pauramountplus.com&s5=cf Page URL
https://lookandfind.me/s/r?u=https%3A%2F%2Ftracking.s24.com%2Fv3%2Fclickout%2F9c8a1f68%2F4865%2F4291424447%2Fc36c5470844d1d71faa3391f0d87fe60864667a6%3Fs24plid%3D5f18ff15e8ae65f012d9e340cb9e6c94%26s24cid%3Dde&h=aa1aa52d01d4e5b4dd2edcbff9caec88 Page URL
https://tracking.s24.com/v3/clickout/9c8a1f68/4865/4291424447/c36c5470844d1d71faa3391f0d87fe60864667a6?s24plid=5f18ff15e8ae65f012d9e340cb9e6c94&s24cid=de HTTP 303
https://tracking.s24.com/v3/proceed?cor_b=CiRhOWE1NzY1OS0zMDU0LTQ1YjMtYWQ3Zi04ZjFkYzIyYTI2YWISIDVmMThmZjE1ZThhZTY1ZjAxMmQ5ZTM0MGNiOWU2Yzk0Ggg5YzhhMWY2OCCBJii_4af-DzICZGVA0cCShuwvSiB5bVZVV05haVlZYm1wNVA0N0JPUmhZTTM1MFVOblZrYVJyTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzk3LjAuNDY5Mi43MSBTYWZhcmkvNTM3LjM2WiQyMDAxOmFjODoyMDozZDAwOjEwMTE6MWRjZDpiM2Q4OjNmZDJiF2h0dHBzOi8vbG9va2FuZGZpbmQubWUvggEkZDZlNDc5YTEtOTFiNC00MDVhLWEwNzUtYjE4MjEwNTQ1ZTRhkAEA&cor_h=cbxC60Y6POmoqRXbIkXS4b9GHXFq9n6CbxDSdYhRviE%3D Page URL
https://tracking.s24.com/v3/commit?cor_b=CiRhOWE1NzY1OS0zMDU0LTQ1YjMtYWQ3Zi04ZjFkYzIyYTI2YWISIDVmMThmZjE1ZThhZTY1ZjAxMmQ5ZTM0MGNiOWU2Yzk0Ggg5YzhhMWY2OCCBJii_4af-DzICZGVA0cCShuwvSiB5bVZVV05haVlZYm1wNVA0N0JPUmhZTTM1MFVOblZrYVJyTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzk3LjAuNDY5Mi43MSBTYWZhcmkvNTM3LjM2WiQyMDAxOmFjODoyMDozZDAwOjEwMTE6MWRjZDpiM2Q4OjNmZDJiF2h0dHBzOi8vbG9va2FuZGZpbmQubWUvggEkZDZlNDc5YTEtOTFiNC00MDVhLWEwNzUtYjE4MjEwNTQ1ZTRhkAEA&cor_h=cbxC60Y6POmoqRXbIkXS4b9GHXFq9n6CbxDSdYhRviE%3D HTTP 303
https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719 Page URL
https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

http://pauramountplus.com/?js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY0MzkxODgxNywiaWF0IjoxNjQzOTExNjE3LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIycjg1aHB2b2EzazNtbG4zNWcwODh0MGkiLCJuYmYiOjE2NDM5MTE2MTcsInRzIjoxNjQzOTExNjE3MzE2OTE4fQ.A6m37FKASzrHXRwIOcG_fPq1qrG1x6I2RBoJuCb1Xyg&sid=136bc810-851c-11ec-9967-4e6e7ca9c31b HTTP 302
http://4773.booknower.com/match-4773/67091/195273269/1643911617/mf_ee21c8f7-e932-4a66-b456-60706d5cabfc/YXBpeDA3LXBhdXJhbW91bnRwbHVzLmNvbQ==/feed

Request Chain 2

http://4773.booknower.com/match-4773/67091/195273269/1643911617/mf_ee21c8f7-e932-4a66-b456-60706d5cabfc/YXBpeDA3LXBhdXJhbW91bnRwbHVzLmNvbQ== HTTP 302
https://clever-redirect.com/s/r6?s=822615&s3=apix07-pauramountplus.com HTTP 302
https://lookandfind.me/s/a?t=9&f=1&u=f4bdb01fc36e3f720c2a963a770625c6&m=bauhaus.info&s1=822615&s2=&s3=apix07-pauramountplus.com&s5=cf

Request Chain 4

https://tracking.s24.com/v3/clickout/9c8a1f68/4865/4291424447/c36c5470844d1d71faa3391f0d87fe60864667a6?s24plid=5f18ff15e8ae65f012d9e340cb9e6c94&s24cid=de HTTP 303
https://tracking.s24.com/v3/proceed?cor_b=CiRhOWE1NzY1OS0zMDU0LTQ1YjMtYWQ3Zi04ZjFkYzIyYTI2YWISIDVmMThmZjE1ZThhZTY1ZjAxMmQ5ZTM0MGNiOWU2Yzk0Ggg5YzhhMWY2OCCBJii_4af-DzICZGVA0cCShuwvSiB5bVZVV05haVlZYm1wNVA0N0JPUmhZTTM1MFVOblZrYVJyTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzk3LjAuNDY5Mi43MSBTYWZhcmkvNTM3LjM2WiQyMDAxOmFjODoyMDozZDAwOjEwMTE6MWRjZDpiM2Q4OjNmZDJiF2h0dHBzOi8vbG9va2FuZGZpbmQubWUvggEkZDZlNDc5YTEtOTFiNC00MDVhLWEwNzUtYjE4MjEwNTQ1ZTRhkAEA&cor_h=cbxC60Y6POmoqRXbIkXS4b9GHXFq9n6CbxDSdYhRviE%3D

Request Chain 5

https://tracking.s24.com/v3/commit?cor_b=CiRhOWE1NzY1OS0zMDU0LTQ1YjMtYWQ3Zi04ZjFkYzIyYTI2YWISIDVmMThmZjE1ZThhZTY1ZjAxMmQ5ZTM0MGNiOWU2Yzk0Ggg5YzhhMWY2OCCBJii_4af-DzICZGVA0cCShuwvSiB5bVZVV05haVlZYm1wNVA0N0JPUmhZTTM1MFVOblZrYVJyTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzk3LjAuNDY5Mi43MSBTYWZhcmkvNTM3LjM2WiQyMDAxOmFjODoyMDozZDAwOjEwMTE6MWRjZDpiM2Q4OjNmZDJiF2h0dHBzOi8vbG9va2FuZGZpbmQubWUvggEkZDZlNDc5YTEtOTFiNC00MDVhLWEwNzUtYjE4MjEwNTQ1ZTRhkAEA&cor_h=cbxC60Y6POmoqRXbIkXS4b9GHXFq9n6CbxDSdYhRviE%3D HTTP 303
https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719

15 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK /
pauramountplus.com/ 474 B
836 B 65ms
29ms Document
text/html 81.17.29.150
PLI-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://pauramountplus.com/
Protocol: HTTP/1.1
Server: 81.17.29.150 Zurich, Switzerland, ASN51852 (PLI-AS, PA),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 474
content-type: text/html; charset=utf-8
date: Thu, 03 Feb 2022 18:06:57 GMT
server: nginx

GET
H/1.1

200
OK

feed Show response
4773.booknower.com/match-4773/67091/195273269/1643911617/mf_ee21c8f7-e932-4a66-b456-60706d5cabfc/YXBpeDA3LXBhdXJhbW91bnRwbHVzLmNvbQ==/
Redirect Chain

http://pauramountplus.com/?js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY0MzkxODgxNywiaWF0IjoxNjQzOTExNjE3LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIycjg1aHB2b2EzazNtbG4zNWcwOD...
http://4773.booknower.com/match-4773/67091/195273269/1643911617/mf_ee21c8f7-e932-4a66-b456-60706d5cabfc/YXBpeDA3LXBhdXJhbW91bnRwbHVzLmNvbQ==/feed

3 KB
2 KB

258ms
152ms

Document
text/html

104.206.252.90
EONIX-COMMUNICATI...

General

Check archive.org

Show headers Download Go to

Full URL: http://4773.booknower.com/match-4773/67091/195273269/1643911617/mf_ee21c8f7-e932-4a66-b456-60706d5cabfc/YXBpeDA3LXBhdXJhbW91bnRwbHVzLmNvbQ==/feed
Requested by: Host: pauramountplus.com
URL: http://pauramountplus.com/
Protocol: HTTP/1.1
Server: 104.206.252.90 New York, United States, ASN62904 (EONIX-COMMUNICATIONS-ASBLOCK-62904, US),
Reverse DNS: 90-252-206-104.staticrdns.eonix.net
Software: nginx/1.14.2 /
Resource Hash: fe693cc4c546a6e5e066eaa723d760b8623f6551210230a772db293cb28c1a5f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://pauramountplus.com/

Response headers

Server: nginx/1.14.2
Date: Thu, 03 Feb 2022 18:06:58 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Content-Encoding: gzip

Redirect headers

cache-control: max-age=0, private, must-revalidate
connection: close
content-length: 11
date: Thu, 03 Feb 2022 18:06:57 GMT
location: http://4773.booknower.com/match-4773/67091/195273269/1643911617/mf_ee21c8f7-e932-4a66-b456-60706d5cabfc/YXBpeDA3LXBhdXJhbW91bnRwbHVzLmNvbQ==/feed
server: nginx

GET
H2

200

a
lookandfind.me/s/
Redirect Chain

http://4773.booknower.com/match-4773/67091/195273269/1643911617/mf_ee21c8f7-e932-4a66-b456-60706d5cabfc/YXBpeDA3LXBhdXJhbW91bnRwbHVzLmNvbQ==
https://clever-redirect.com/s/r6?s=822615&s3=apix07-pauramountplus.com
https://lookandfind.me/s/a?t=9&f=1&u=f4bdb01fc36e3f720c2a963a770625c6&m=bauhaus.info&s1=822615&s2=&s3=apix07-pauramountplus.com&s5=cf

430 B
794 B

130ms
20ms

Document
text/html

157.90.169.168
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://lookandfind.me/s/a?t=9&f=1&u=f4bdb01fc36e3f720c2a963a770625c6&m=bauhaus.info&s1=822615&s2=&s3=apix07-pauramountplus.com&s5=cf
Requested by: Host: pauramountplus.com
URL: http://pauramountplus.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 157.90.169.168 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.168.169.90.157.clients.your-server.de
Software: Apache/2.4.49 (codeit) OpenSSL/1.1.1l PHP/7.4.24 / PHP/7.4.24
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://4773.booknower.com/match-4773/67091/195273269/1643911617/mf_ee21c8f7-e932-4a66-b456-60706d5cabfc/YXBpeDA3LXBhdXJhbW91bnRwbHVzLmNvbQ==/feed

Response headers

referrer-policy: strict-origin-when-cross-origin
x-powered-by: PHP/7.4.24
content-length: 430
content-type: text/html; charset=UTF-8
date: Thu, 03 Feb 2022 18:06:58 GMT
server: Apache/2.4.49 (codeit) OpenSSL/1.1.1l PHP/7.4.24

Redirect headers

referrer-policy: no-referrer
x-powered-by: PHP/7.4.27
location: https://lookandfind.me/s/a?t=9&f=1&u=f4bdb01fc36e3f720c2a963a770625c6&m=bauhaus.info&s1=822615&s2=&s3=apix07-pauramountplus.com&s5=cf
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 03 Feb 2022 18:06:58 GMT
server: Apache/2.4.52 (codeit) OpenSSL/1.1.1m PHP/7.4.27

GET
H2 200 r
lookandfind.me/s/ 358 B
388 B 14ms
14ms Document
text/html 157.90.169.168
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://lookandfind.me/s/r?u=https%3A%2F%2Ftracking.s24.com%2Fv3%2Fclickout%2F9c8a1f68%2F4865%2F4291424447%2Fc36c5470844d1d71faa3391f0d87fe60864667a6%3Fs24plid%3D5f18ff15e8ae65f012d9e340cb9e6c94%26s24cid%3Dde&h=aa1aa52d01d4e5b4dd2edcbff9caec88
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 157.90.169.168 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.168.169.90.157.clients.your-server.de
Software: Apache/2.4.49 (codeit) OpenSSL/1.1.1l PHP/7.4.24 / PHP/7.4.24
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://lookandfind.me/s/a?t=9&f=1&u=f4bdb01fc36e3f720c2a963a770625c6&m=bauhaus.info&s1=822615&s2=&s3=apix07-pauramountplus.com&s5=cf

Response headers

referrer-policy: strict-origin-when-cross-origin
x-powered-by: PHP/7.4.24
content-length: 358
content-type: text/html; charset=UTF-8
date: Thu, 03 Feb 2022 18:06:58 GMT
server: Apache/2.4.49 (codeit) OpenSSL/1.1.1l PHP/7.4.24

GET
H2

200

proceed Show response
tracking.s24.com/v3/
Redirect Chain

https://tracking.s24.com/v3/clickout/9c8a1f68/4865/4291424447/c36c5470844d1d71faa3391f0d87fe60864667a6?s24plid=5f18ff15e8ae65f012d9e340cb9e6c94&s24cid=de
https://tracking.s24.com/v3/proceed?cor_b=CiRhOWE1NzY1OS0zMDU0LTQ1YjMtYWQ3Zi04ZjFkYzIyYTI2YWISIDVmMThmZjE1ZThhZTY1ZjAxMmQ5ZTM0MGNiOWU2Yzk0Ggg5YzhhMWY2OCCBJii_4af-DzICZGVA0cCShuwvSiB5bVZVV05haVlZYm1...

1 KB
1 KB

15ms
15ms

Document
text/html

2a00:12c0:101b:200::19
FILOO-ASN Rhedaer...

General

Check archive.org

Show headers Download Go to

Full URL

https://tracking.s24.com/v3/proceed?cor_b=CiRhOWE1NzY1OS0zMDU0LTQ1YjMtYWQ3Zi04ZjFkYzIyYTI2YWISIDVmMThmZjE1ZThhZTY1ZjAxMmQ5ZTM0MGNiOWU2Yzk0Ggg5YzhhMWY2OCCBJii_4af-DzICZGVA0cCShuwvSiB5bVZVV05haVlZYm1wNVA0N0JPUmhZTTM1MFVOblZrYVJyTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzk3LjAuNDY5Mi43MSBTYWZhcmkvNTM3LjM2WiQyMDAxOmFjODoyMDozZDAwOjEwMTE6MWRjZDpiM2Q4OjNmZDJiF2h0dHBzOi8vbG9va2FuZGZpbmQubWUvggEkZDZlNDc5YTEtOTFiNC00MDVhLWEwNzUtYjE4MjEwNTQ1ZTRhkAEA&cor_h=cbxC60Y6POmoqRXbIkXS4b9GHXFq9n6CbxDSdYhRviE%3D

Requested by

Host: lookandfind.me
URL: https://lookandfind.me/s/r?u=https%3A%2F%2Ftracking.s24.com%2Fv3%2Fclickout%2F9c8a1f68%2F4865%2F4291424447%2Fc36c5470844d1d71faa3391f0d87fe60864667a6%3Fs24plid%3D5f18ff15e8ae65f012d9e340cb9e6c94%26s24cid%3Dde&h=aa1aa52d01d4e5b4dd2edcbff9caec88

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a00:12c0:101b:200::19 , Germany, ASN47215 (FILOO-ASN Rhedaer Strasse 25, DE),

Reverse DNS

Software

Resource Hash

6a7cdc3707c7505ae1dde83296be4626db66a16c1aafd3240835b4ead50fe45d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://lookandfind.me/s/r?u=https%3A%2F%2Ftracking.s24.com%2Fv3%2Fclickout%2F9c8a1f68%2F4865%2F4291424447%2Fc36c5470844d1d71faa3391f0d87fe60864667a6%3Fs24plid%3D5f18ff15e8ae65f012d9e340cb9e6c94%26s24cid%3Dde&h=aa1aa52d01d4e5b4dd2edcbff9caec88

Response headers

content-language: de-DE
content-type: text/html;charset=UTF-8
date: Thu, 03 Feb 2022 18:06:57 GMT
etag: W/"03af212afbef2772da576eed35f917e77"
p3p: CP="NOI DSP LAW NID CURa ADMa PSAa OUR LEG PUR COM NAV STA"
x-robots-tag: noindex, nofollow
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://cspreport.s24.com/;
strict-transport-security: max-age=31536000;
vary: Accept-Encoding Accept-Encoding
content-encoding: gzip

Redirect headers

cache-control: no-cache, no-store
content-language: de-DE
content-length: 0
date: Thu, 03 Feb 2022 18:06:57 GMT
location: https://tracking.s24.com/v3/proceed?cor_b=CiRhOWE1NzY1OS0zMDU0LTQ1YjMtYWQ3Zi04ZjFkYzIyYTI2YWISIDVmMThmZjE1ZThhZTY1ZjAxMmQ5ZTM0MGNiOWU2Yzk0Ggg5YzhhMWY2OCCBJii_4af-DzICZGVA0cCShuwvSiB5bVZVV05haVlZYm1wNVA0N0JPUmhZTTM1MFVOblZrYVJyTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzk3LjAuNDY5Mi43MSBTYWZhcmkvNTM3LjM2WiQyMDAxOmFjODoyMDozZDAwOjEwMTE6MWRjZDpiM2Q4OjNmZDJiF2h0dHBzOi8vbG9va2FuZGZpbmQubWUvggEkZDZlNDc5YTEtOTFiNC00MDVhLWEwNzUtYjE4MjEwNTQ1ZTRhkAEA&cor_h=cbxC60Y6POmoqRXbIkXS4b9GHXFq9n6CbxDSdYhRviE%3D
p3p: CP="NOI DSP LAW NID CURa ADMa PSAa OUR LEG PUR COM NAV STA"
x-robots-tag: noindex, nofollow
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://cspreport.s24.com/;
strict-transport-security: max-age=31536000;

GET
H2

503

ClickTracker.jsp Show response
suche.guenstiger.de/norob/
Redirect Chain

https://tracking.s24.com/v3/commit?cor_b=CiRhOWE1NzY1OS0zMDU0LTQ1YjMtYWQ3Zi04ZjFkYzIyYTI2YWISIDVmMThmZjE1ZThhZTY1ZjAxMmQ5ZTM0MGNiOWU2Yzk0Ggg5YzhhMWY2OCCBJii_4af-DzICZGVA0cCShuwvSiB5bVZVV05haVlZYm1w...
https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719

171 KB
171 KB

275ms
52ms

Document
text/html

2606:4700::6812:18c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:18c3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

17e5656a4b47c67c5fc50544d6d453625dacdee93be81090980868087fd4ad27

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
Origin: https://tracking.s24.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://tracking.s24.com/

Response headers

date: Thu, 03 Feb 2022 18:06:58 GMT
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 6d7d98a25bce5a19-MXP

Redirect headers

content-language: de-DE
content-length: 0
date: Thu, 03 Feb 2022 18:06:57 GMT
location: https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719
p3p: CP="NOI DSP LAW NID CURa ADMa PSAa OUR LEG PUR COM NAV STA"
x-robots-tag: noindex, nofollow
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://cspreport.s24.com/;
strict-transport-security: max-age=31536000;

GET
DATA 200
OK truncated
/ 9 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8f4d68883424d8bcf3c15f6ec7c665694b214ff04f1cb6a570da843c517d363c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 111 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 98b4c724b0cc41e5106fc4d32b48bcce768085d277853c7aadbc2acc81ac4b59

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 v1 Show response
suche.guenstiger.de/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/ 43 KB
16 KB 113ms
113ms Script
text/javascript 2606:4700::6812:18c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://suche.guenstiger.de/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=6d7d98a25bce5a19
Requested by: Host: suche.guenstiger.de
URL: https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18c3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: edcc5d6e42ba8381decba487187c4708f23a0cabe18b4229e7a9c7c248f04bbf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719&__cf_chl_rt_tk=Gzk_WTvMqagKcQ3v2VOngubIPcHQ9nufSfuASdQ5isI-1643911618-0-gaNycGzNCH0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 03 Feb 2022 18:06:59 GMT
content-encoding: br
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=0, must-revalidate
cf-ray: 6d7d98a2fd9e5a19-MXP

GET
H2 200 transparent.gif
suche.guenstiger.de/cdn-cgi/images/trace/jschal/js/ 42 B
243 B 34ms
34ms Image
image/gif 2606:4700::6812:18c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://suche.guenstiger.de/cdn-cgi/images/trace/jschal/js/transparent.gif?ray=6d7d98a25bce5a19

Requested by

Host: suche.guenstiger.de
URL: https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719&__cf_chl_rt_tk=Gzk_WTvMqagKcQ3v2VOngubIPcHQ9nufSfuASdQ5isI-1643911618-0-gaNycGzNCH0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:18c3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719&__cf_chl_rt_tk=Gzk_WTvMqagKcQ3v2VOngubIPcHQ9nufSfuASdQ5isI-1643911618-0-gaNycGzNCH0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 03 Feb 2022 18:06:59 GMT
x-content-type-options: nosniff
last-modified: Wed, 26 Jan 2022 18:50:31 GMT
server: cloudflare
etag: "61f197f7-2a"
x-frame-options: DENY
content-type: image/gif
cache-control: max-age=7200, public
accept-ranges: bytes
cf-ray: 6d7d98a2fda15a19-MXP
vary: Accept-Encoding
content-length: 42
expires: Thu, 03 Feb 2022 20:06:59 GMT

POST
H2 200 5ac4ccc777d7e5b Show response
suche.guenstiger.de/cdn-cgi/challenge-platform/h/g/flow/ov1/0.7214256219833204:1643911350:6ad9db9d9ccf9a65abaa6bbd34b91c1487691fef6d2ca750feb8e62a246b6d2a/6d7d98a25bce5a19/ 100 KB
55 KB 108ms
108ms XHR
text/plain 2606:4700::6812:18c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://suche.guenstiger.de/cdn-cgi/challenge-platform/h/g/flow/ov1/0.7214256219833204:1643911350:6ad9db9d9ccf9a65abaa6bbd34b91c1487691fef6d2ca750feb8e62a246b6d2a/6d7d98a25bce5a19/5ac4ccc777d7e5b
Requested by: Host: suche.guenstiger.de
URL: https://suche.guenstiger.de/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=6d7d98a25bce5a19
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18c3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7cd060dfcea00a9eee609e339fed37065a6ed942d8269262308918a92117fe9f

Request headers

Referer: https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
CF-Challenge: 5ac4ccc777d7e5b
Content-type: application/x-www-form-urlencoded

Response headers

date: Thu, 03 Feb 2022 18:06:59 GMT
content-encoding: br
server: cloudflare
cf-ray: 6d7d98a469aa5a19-MXP
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/plain;charset=UTF-8

GET
H2 200 5413be234b16345-1643911619278
suche.guenstiger.de/cdn-cgi/challenge-platform/h/g/img/6d7d98a25bce5a19/e323db4f/ 676 B
740 B 30ms
30ms Image
image/png 2606:4700::6812:18c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://suche.guenstiger.de/cdn-cgi/challenge-platform/h/g/img/6d7d98a25bce5a19/e323db4f/5413be234b16345-1643911619278
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18c3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d55a575bf9e128fdee5957c8c9f446399ccb5aaf46b05f1df4044d558f3c1e65

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 03 Feb 2022 18:06:59 GMT
server: cloudflare
cf-ray: 6d7d98a54c345a19-MXP
content-length: 676
vary: Accept-Encoding
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/png

POST
H2 200 5ac4ccc777d7e5b Show response
suche.guenstiger.de/cdn-cgi/challenge-platform/h/g/flow/ov1/0.7214256219833204:1643911350:6ad9db9d9ccf9a65abaa6bbd34b91c1487691fef6d2ca750feb8e62a246b6d2a/6d7d98a25bce5a19/ 2 KB
2 KB 208ms
208ms XHR
text/plain 2606:4700::6812:18c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://suche.guenstiger.de/cdn-cgi/challenge-platform/h/g/flow/ov1/0.7214256219833204:1643911350:6ad9db9d9ccf9a65abaa6bbd34b91c1487691fef6d2ca750feb8e62a246b6d2a/6d7d98a25bce5a19/5ac4ccc777d7e5b
Requested by: Host: suche.guenstiger.de
URL: https://suche.guenstiger.de/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=6d7d98a25bce5a19
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18c3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2e6f88974a56f191329ded73ff06e7307c0668fff3b4b1c68c29e9922fea9248

Request headers

Referer: https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
CF-Challenge: 5ac4ccc777d7e5b
Content-type: application/x-www-form-urlencoded

Response headers

date: Thu, 03 Feb 2022 18:07:00 GMT
content-encoding: br
server: cloudflare
cf_chl_out: iWE0UvbtfSzN58Q0npVAky9hPJjI75SjbRG71cnozXpWEbJnF8wRGfjwRY3Arzw4OTvG0Bmi4w1g3PirTWJyPg==$aYWSpEsPkhkMB2N2fP6pdQ==
vary: Accept-Encoding
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: text/plain;charset=UTF-8
cf_chl_out_s: hTNnwbNZ/7qOW3LTAyBegONuPvtMzaqHpGkjm9r29LrUEn1Xc8lKHqWesGZbGbli42g/pgIvLOp+g6tuFjvneBTy1ubwKe0B8Hxc4r55y16fDX2kmx8ih65mIjobDTB8kx72jeJc5O7OYQF25NuoupLDgyk2J2jg1G3QVuGqdueqc3b4zkt/vAu5gKhWVGMgfcDqC2xFdQ5w2TN/2w4/q/t6RltfTsvFRXB0PTpD39uVH97occdDgSXOezLT/ZpOLfrZAMdbEL3BpVtmVtajPA==$s4Rt0mJgjj8qFOEUusu4Yg==
cf-ray: 6d7d98aa8ce15a19-MXP

GET
H2 503 Primary Request ClickTracker.jsp Show response
suche.guenstiger.de/norob/ 171 KB
171 KB 37ms
37ms Document
text/html 2606:4700::6812:18c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719

Requested by

Host: pauramountplus.com
URL: http://pauramountplus.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:18c3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce6a2b261bfbc1b194e2f1e8e378366d1a2aa9486d3b3235d9dda422c6590eff

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719

Response headers

date: Thu, 03 Feb 2022 18:07:02 GMT
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 6d7d98b86e2e5a19-MXP

GET
DATA 200
OK truncated
/ 9 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8f4d68883424d8bcf3c15f6ec7c665694b214ff04f1cb6a570da843c517d363c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 111 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 98b4c724b0cc41e5106fc4d32b48bcce768085d277853c7aadbc2acc81ac4b59

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 v1 Show response
suche.guenstiger.de/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/ 38 KB
14 KB 53ms
53ms Script
text/javascript 2606:4700::6812:18c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://suche.guenstiger.de/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=6d7d98b86e2e5a19
Requested by: Host: suche.guenstiger.de
URL: https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18c3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e36653eab2e131f87b7ce299fa514e56472ca155b6113a696c62a08a13d84aa

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719&__cf_chl_rt_tk=gQJFG.o8iJ.YJ2u30g1GmbnThjoQsz.C3snkln7wsIY-1643911622-0-gaNycGzNCD0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 03 Feb 2022 18:07:02 GMT
content-encoding: br
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=0, must-revalidate
cf-ray: 6d7d98b8cf775a19-MXP

GET
H2 200 transparent.gif
suche.guenstiger.de/cdn-cgi/images/trace/jschal/js/ 42 B
125 B 21ms
21ms Image
image/gif 2606:4700::6812:18c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://suche.guenstiger.de/cdn-cgi/images/trace/jschal/js/transparent.gif?ray=6d7d98b86e2e5a19

Requested by

Host: suche.guenstiger.de
URL: https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719&__cf_chl_rt_tk=gQJFG.o8iJ.YJ2u30g1GmbnThjoQsz.C3snkln7wsIY-1643911622-0-gaNycGzNCD0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:18c3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719&__cf_chl_rt_tk=gQJFG.o8iJ.YJ2u30g1GmbnThjoQsz.C3snkln7wsIY-1643911622-0-gaNycGzNCD0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 03 Feb 2022 18:07:02 GMT
x-content-type-options: nosniff
last-modified: Wed, 26 Jan 2022 18:50:31 GMT
server: cloudflare
etag: "61f197f7-2a"
x-frame-options: DENY
content-type: image/gif
cache-control: max-age=7200, public
accept-ranges: bytes
cf-ray: 6d7d98b8cf785a19-MXP
vary: Accept-Encoding
content-length: 42
expires: Thu, 03 Feb 2022 20:07:02 GMT

POST
H2 200 2740a369845844b Show response
suche.guenstiger.de/cdn-cgi/challenge-platform/h/g/flow/ov1/0.37383295349839346:1643911361:531d131c15c5cefbf8ed5e77f6a57329ebbbcdb0af0f3b7b1a195d7d3964a139/6d7d98b86e2e5a19/ 114 KB
62 KB 212ms
212ms XHR
text/plain 2606:4700::6812:18c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://suche.guenstiger.de/cdn-cgi/challenge-platform/h/g/flow/ov1/0.37383295349839346:1643911361:531d131c15c5cefbf8ed5e77f6a57329ebbbcdb0af0f3b7b1a195d7d3964a139/6d7d98b86e2e5a19/2740a369845844b
Requested by: Host: suche.guenstiger.de
URL: https://suche.guenstiger.de/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=6d7d98b86e2e5a19
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18c3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 110f5bdb9f0b88b612418e3b4712385be3d57fb86ba8bdb79f00bcba97afdb33

Request headers

Referer: https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
CF-Challenge: 2740a369845844b
Content-type: application/x-www-form-urlencoded

Response headers

date: Thu, 03 Feb 2022 18:07:02 GMT
content-encoding: br
server: cloudflare
cf-ray: 6d7d98b9da945a19-MXP
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/plain;charset=UTF-8

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

9 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.pauramountplus.com/	1970-02-13 21:09:55	Name: sid Value: 136bc810-851c-11ec-9967-4e6e7ca9c31b
clever-redirect.com/	1970-01-20 00:39:58	Name: 2b1cd42e7c4e9df33c00e4025cd013d9 Value: f2730bdf10a3ddb7a4e304a310fda7cbfe04ee1e083755bcda742ebebf865f65a%3A2%3A%7Bi%3A0%3Bs%3A32%3A%222b1cd42e7c4e9df33c00e4025cd013d9%22%3Bi%3A1%3Bs%3A1%3A%221%22%3B%7D
lookandfind.me/	1970-01-20 00:39:58	Name: 7bb11bcdb7943249aaff75142282d257 Value: c507746aa8e7d612c39a2a7ee5e9562440559e5c5831b6cdac0db60575de7781a%3A2%3A%7Bi%3A0%3Bs%3A32%3A%227bb11bcdb7943249aaff75142282d257%22%3Bi%3A1%3Bs%3A1%3A%221%22%3B%7D
.s24.com/	1970-01-20 00:38:33	Name: co-session Value: ymVUWNaiYYbmp5P47BORhYM350UNnVka
.s24.com/	1970-01-20 09:24:07	Name: s24uid Value: d6e479a1-91b4-405a-a075-b18210545e4a
.guenstiger.de/	1970-01-20 00:38:33	Name: __cf_bm Value: C_3.mvegsZpLesjAVmhNb4HB6ZR5x2vbP8kKFvLL5qk-1643911618-0-AXzHIfPsLsOZeew7sODmahL7XJy1Q7V+0AIFKLpol+c7okwHNjsmf9ZXPQOy7+uYx3Ihl5a97zMf5+oKZ1qO7VM=
suche.guenstiger.de/	1970-01-20 00:38:35	Name: cf_chl_rc_ni Value: 1
suche.guenstiger.de/	1970-01-20 00:38:35	Name: cf_chl_2 Value: 2740a369845844b
suche.guenstiger.de/	1970-01-20 00:38:35	Name: cf_chl_prog Value: e

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
network	error	URL: https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719 Message: Failed to load resource: the server responded with a status of 503 ()
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
network	error	URL: https://suche.guenstiger.de/norob/ClickTracker.jsp?ds=p&tag=21611594268&origin=Shopping24de_nextag_traffic&p=360719 Message: Failed to load resource: the server responded with a status of 503 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4773.booknower.com
clever-redirect.com
lookandfind.me
pauramountplus.com
suche.guenstiger.de
tracking.s24.com
104.206.252.90
157.90.169.168
2606:4700::6812:18c3
2a00:12c0:101b:200::19
78.46.197.88
81.17.29.150
110f5bdb9f0b88b612418e3b4712385be3d57fb86ba8bdb79f00bcba97afdb33
17e5656a4b47c67c5fc50544d6d453625dacdee93be81090980868087fd4ad27
2e6f88974a56f191329ded73ff06e7307c0668fff3b4b1c68c29e9922fea9248
6a7cdc3707c7505ae1dde83296be4626db66a16c1aafd3240835b4ead50fe45d
7cd060dfcea00a9eee609e339fed37065a6ed942d8269262308918a92117fe9f
8f4d68883424d8bcf3c15f6ec7c665694b214ff04f1cb6a570da843c517d363c
98b4c724b0cc41e5106fc4d32b48bcce768085d277853c7aadbc2acc81ac4b59
9e36653eab2e131f87b7ce299fa514e56472ca155b6113a696c62a08a13d84aa
ce6a2b261bfbc1b194e2f1e8e378366d1a2aa9486d3b3235d9dda422c6590eff
d55a575bf9e128fdee5957c8c9f446399ccb5aaf46b05f1df4044d558f3c1e65
edcc5d6e42ba8381decba487187c4708f23a0cabe18b4229e7a9c7c248f04bbf
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fe693cc4c546a6e5e066eaa723d760b8623f6551210230a772db293cb28c1a5f

suche.guenstiger.de Open in urlscan Pro 2606:4700::6812:18c3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

87 %HTTPS

33 %IPv6

6 Domains

6 Subdomains

6 IPs

3 Countries

496 kBTransfer

883 kBSize

9 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

9 Cookies

4 Console Messages

Indicators

suche.guenstiger.de Open in urlscan Pro
2606:4700::6812:18c3 Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

87 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

496 kB
Transfer

883 kB
Size

9
Cookies

15 HTTP transactions
4 data transactions