www.geldheinz.de
85.13.147.105 Public Scan Open in urlscan Pro

Go To Rescan
Add Verdict Report

URL:
https://www.geldheinz.de/ 8yr old
Submission: On August 22 via automatic, source certstream-suspicious (August 22nd 2026, 12:50:22 am UTC) — Scanned from DE Go Pro

Only in urlscan Pro

Select different country locations for Private Scans.
Use a global network of additional scanning locations and residential IPs for scanning.
Interact with pages while you are scanning them.
Download files from remote websites.
Scan websites on the Tor Network.

Click for more information

Free trials of urlscan Pro are available.

Summary HTTP 13 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 13 HTTP transactions. The main IP is 85.13.147.105, located in Germany and belongs to NMM-AS Neue Medien Muennich GmbH, DE. The main domain is www.geldheinz.de. 8yr old
TLS certificate: Issued by YE2 on June 23rd 2026. Valid for: 3mo.

This is the only time www.geldheinz.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Go Pro

Only in urlscan Pro

Use our Phishing URL feed to retrieve phishing pages targeting 3000+ brands in real-time. Set up monitoring and alerts. Use maliciousness scores and AI-powered brand name recognition to hunt for brand impersonation.

Click for more information

Free trials of urlscan Pro are available.

Domain & IP information

	IP Address	AS Autonomous System
5	85.13.147.105 85.13.147.105	34788 (NMM-AS Ne...) (NMM-AS Neue Medien Muennich GmbH)
7	148.251.5.29 148.251.5.29	24940 (HETZNER-A...) (HETZNER-AS Hetzner Online GmbH)
1 1	212.237.244.233 212.237.244.233	205411 (BOREUS WI...) (BOREUS WIIT AG)
1	45.60.197.69 45.60.197.69	19551 (INCAPSULA) (INCAPSULA - Incapsula Inc)
13	4

5 85.13.147.105 (Germany)

ASN34788 (NMM-AS Neue Medien Muennich GmbH, DE)
PTR: dd20516.kasserver.com

www.geldheinz.de 8yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

7 148.251.5.29 (Falkenstein, Germany)

ASN24940 (HETZNER-AS Hetzner Online GmbH, DE)
PTR: cloud.ccm19.de

cloud.ccm19.de 5yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 212.237.244.233 (Germany) 1 redirects

ASN205411 (BOREUS WIIT AG, DE)
PTR: fin-lamp-new.dns.boreus.de

www.financeads.net 14yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 45.60.197.69 (United States)

ASN19551 (INCAPSULA - Incapsula Inc, US)

www.santander.de 14yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

	Apex Domain Subdomains	Transfer
7	ccm19.de cloud.ccm19.de — Cisco Umbrella Rank: 102164 5yr old	49 KB
5	geldheinz.de www.geldheinz.de 8yr old	8 KB
1	santander.de www.santander.de 14yr old	56 KB
1	financeads.net 1 redirects www.financeads.net — Cisco Umbrella Rank: 998341 14yr old	389 B
13	4

	Domain	Requested by
7	cloud.ccm19.de	www.geldheinz.de cloud.ccm19.de
5	www.geldheinz.de	www.geldheinz.de
1	www.santander.de	www.geldheinz.de
1	www.financeads.net	1 redirects
13	4

This site contains links to these domains. Also see Links.

Domain
www.financeads.net
geldheinz.de
www.ccm19.de

Subject Issuer	Validity	Valid
geldheinz.de YE2	`2026-06-23` - `2026-09-21`	3mo	crt.sh
cloud.ccm19.de YR2	`2026-07-05` - `2026-10-03`	3mo	crt.sh

This page contains 1 frames:

Primary Page: https://www.geldheinz.de/
Frame ID: 14E13376D14112F685EF4BD8FC2E5C66
Requests: 13 HTTP requests in this frame

Screenshot Go Pro
Only in urlscan Pro

Use the Visual Search feature to find pages with visually similar screenshots.

Click for more information

Free trials of urlscan Pro are available.

Full Image

Page Title

Geld verdienen Kostenlose SMS im Internet

Page Statistics

13
Requests

92 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

113 kB
Transfer

263 kB
Size

3
Cookies

4 Outgoing links Go Pro
Only in urlscan Pro

Effortlessly use any on-page link as a pivot to discover other pages pointing to the exact same destination. Seamlessly trace both specific URLs and broader domains to uncover hidden connection networks and map out backlink relationships with ease.

Click for more information

Free trials of urlscan Pro are available.

These are links going to different origins than the main page.

URL: https://www.financeads.net/tc.php?t=16657C19318412B

Search URL Search Domain Scan URL

URL: https://geldheinz.de/impressum.htm
Title: Impressum

Search URL Search Domain Scan URL

URL: https://geldheinz.de/datenschutz.php
Title: Datenschutzhinweis

Search URL Search Domain Scan URL

URL: https://www.ccm19.de/
Title: Made & Hosted in Germany by CCM19

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://www.financeads.net/tb.php?t=16657V19318412B HTTP 302
https://www.santander.de/static/img/santander-bestcredit-motiv-pooljump-120x600.gif

13 HTTP transactions Go Pro
Only in urlscan Pro

Inspect WebSocket connections, examine POST data effortlessly, and track overlap counts in real time. Features live search and filtering across all HTTP output, complete with full response metadata for deep analysis.

Click for more information

Free trials of urlscan Pro are available.

1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.geldheinz.de/ 13 KB
4 KB 95ms
24ms Document
text/html 85.13.147.105
NMM-AS Neue Medie...

General

Check archive.org

Download Go to

Full URL: https://www.geldheinz.de/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 85.13.147.105 , Germany, ASN34788 (NMM-AS Neue Medien Muennich GmbH, DE),
Reverse DNS: dd20516.kasserver.com
Software: Apache /
Resource Hash: e458e7317a9701dba337345430dda19f224f9041b3845ccc5c1f09c038375b2d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Response headers

content-encoding: br
content-length: 4452
content-type: text/html
date: Sat, 22 Aug 2026 00:50:22 GMT
server: Apache
vary: Accept-Encoding,User-Agent

GET
H2 200 app.js Show response
cloud.ccm19.de/ 125 KB
33 KB 352ms
323ms Script
application/javascript 148.251.5.29
HETZNER-AS Hetzne...

General

Check archive.org

Download Go to

Full URL

https://cloud.ccm19.de/app.js?apiKey=cb956a35c4256e94d080bce03e2d1d9a02010a031ed3d13f&domain=64fdaa1b1c44df894f080cf5&lang=de_DE

Requested by

Host: www.geldheinz.de
URL: https://www.geldheinz.de/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

148.251.5.29 Falkenstein, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),

Reverse DNS

cloud.ccm19.de

Software

Apache/2.4.67 (Ubuntu) / PHP/8.2.31

Resource Hash

051735dafba1886ba7a18979fe92cbf2b04ca6a0f6cb33464fe6a4721ad799c4

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self'; form-action 'self'
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.geldheinz.de/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex, nofollow
access-control-max-age: 3600
content-encoding: gzip
etag: "N55T4s90rZv4oR37FhFLk3Y+gjeceko3-gzip"
access-control-allow-methods: GET,POST,PUT
x-content-type-options: nosniff
date: Sat, 22 Aug 2026 00:50:22 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: Content-Type,X-Requested-With,X-CCM19State,Signature,Signature-Input,Signature-Agent
x-frame-options: sameorigin
strict-transport-security: max-age=16000000; includeSubDomains; preload
link: <https://cloud.ccm19.de/app.css?apiKey=cb956a35c4256e94d080bce03e2d1d9a02010a031ed3d13f&domain=64fdaa1b1c44df894f080cf5&gen=2&theme=64fdaa1b1c44df894f080d04&v=1786715820>;rel="preload";as="style";nopush, <https://cloud.ccm19.de/widget?apiKey=cb956a35c4256e94d080bce03e2d1d9a02010a031ed3d13f&domain=64fdaa1b1c44df894f080cf5&gen=2&theme=64fdaa1b1c44df894f080d04&lang=de_DE&v=1786715820>;rel="preload";as="fetch";crossorigin="anonymous";nopush
content-security-policy: default-src 'self'; connect-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self'; form-action 'self'
cache-control: max-age=900, public, stale-if-error=3600, stale-while-revalidate=3600
access-control-allow-credentials: true
permissions-policy: interest-cohort=(), geolocation=(), encrypted-media=(), camera=(), microphone=()
access-control-allow-origin: *
content-length: 32186
x-powered-by: PHP/8.2.31
server: Apache/2.4.67 (Ubuntu)

GET
H2 200 geld-verdienen.css
www.geldheinz.de/ 5 KB
1 KB 47ms
44ms Stylesheet
text/css 85.13.147.105
NMM-AS Neue Medie...

General

Check archive.org

Download Go to

Full URL: https://www.geldheinz.de/geld-verdienen.css
Requested by: Host: www.geldheinz.de
URL: https://www.geldheinz.de/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 85.13.147.105 , Germany, ASN34788 (NMM-AS Neue Medien Muennich GmbH, DE),
Reverse DNS: dd20516.kasserver.com
Software: Apache /
Resource Hash: a47589b3791bb69663b8d43d99a8a7a3ab15660f473feff29a071ce3fc6079a5

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.geldheinz.de/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: "147b-46b6657294000-br"
accept-ranges: bytes
content-length: 1179
date: Sat, 22 Aug 2026 00:50:22 GMT
last-modified: Wed, 03 Jun 2009 00:00:00 GMT
vary: Accept-Encoding,User-Agent
server: Apache
content-type: text/css

GET
H2 200 5erstyle.css
www.geldheinz.de/ 1 KB
507 B 46ms
44ms Stylesheet
text/css 85.13.147.105
NMM-AS Neue Medie...

General

Check archive.org

Download Go to

Full URL: https://www.geldheinz.de/5erstyle.css
Requested by: Host: www.geldheinz.de
URL: https://www.geldheinz.de/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 85.13.147.105 , Germany, ASN34788 (NMM-AS Neue Medien Muennich GmbH, DE),
Reverse DNS: dd20516.kasserver.com
Software: Apache /
Resource Hash: b94068aa073e4ad6e17566096c7cff59e20720c9f257ebdaa22f630be9d9efa6

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.geldheinz.de/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: "5bb-41f699e9da000-br"
accept-ranges: bytes
content-length: 432
date: Sat, 22 Aug 2026 00:50:22 GMT
last-modified: Tue, 10 Oct 2006 00:00:00 GMT
vary: Accept-Encoding,User-Agent
server: Apache
content-type: text/css

GET
H2 200 geldheinz.de.gif
www.geldheinz.de/bilder/ 2 KB
2 KB 44ms
42ms Image
image/gif 85.13.147.105
NMM-AS Neue Medie...

General

Check archive.org

Download Go to Show image

Full URL: https://www.geldheinz.de/bilder/geldheinz.de.gif
Requested by: Host: www.geldheinz.de
URL: https://www.geldheinz.de/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 85.13.147.105 , Germany, ASN34788 (NMM-AS Neue Medien Muennich GmbH, DE),
Reverse DNS: dd20516.kasserver.com
Software: Apache /
Resource Hash: 7bf10a7ae66ba92d2eada0bd6ae836eb5476784685836d63f13da4bdc1f92454

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.geldheinz.de/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99"
sec-ch-ua-mobile: ?0

Response headers

etag: "835-4b48bb0697e00"
accept-ranges: bytes
content-length: 2101
date: Sat, 22 Aug 2026 00:50:22 GMT
last-modified: Tue, 20 Dec 2011 20:12:40 GMT
content-type: image/gif
server: Apache
content-language: de

GET
H2

200

santander-bestcredit-motiv-pooljump-120x600.gif
www.santander.de/static/img/
Redirect Chain

https://www.financeads.net/tb.php?t=16657V19318412B
https://www.santander.de/static/img/santander-bestcredit-motiv-pooljump-120x600.gif

54 KB
56 KB

109ms
79ms

Image
image/gif

45.60.197.69
Incapsula Inc

General

Check archive.org

Download Go to Show image

Full URL

https://www.santander.de/static/img/santander-bestcredit-motiv-pooljump-120x600.gif

Requested by

Host: www.geldheinz.de
URL: https://www.geldheinz.de/

Protocol

Server

45.60.197.69 , United States, ASN19551 (INCAPSULA - Incapsula Inc, US),

Reverse DNS

Software

Resource Hash

0be30dc6713c8faf134a1f4cbf866877d1665d35af5f0b22828ae664fa5d77aa

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' .santander.de;script-src 'self' 'unsafe-inline' 'unsafe-eval' .adform.net .adsrvr.org .aklamio.com .bing.com .doubleclick.net .dwin1.com .dotomi.com .facebook.com .facebook.net .google.com .google.de .googleanalytics.com .googleadservices.com .googletagmanager.com .google-analytics.com .hotjar.com .hotjar.io .usercentrics.eu .youtube.com api.financingservices.de santander-de.financingservices.de data:;style-src 'self' 'unsafe-inline' 'unsafe-eval' .googleapis.com .google.com .google.de santander-de.financingservices.de;img-src 'self' .adsrvr.org .aklamio.com .awin1.com .bing.com .doubleclick.net .facebook.com .facebook.net .financeads.net .google.com .google.de .googletagmanager.com .google-analytics.com .hotjar.com .hotjar.io .usercentrics.eu * santander-de.financingservices.de service.santander.de data:;font-src 'self' data: .gstatic.com .hotjar.com .hotjar.io cloud.email.santander.de;connect-src .adform.net .adsrvr.org .bing.com .bing.net .doubleclick.net .facebook.com .facebook.net .google.com .google.de .google-analytics.com .googleadservices.com .googlesyndication.com .hotjar.com .hotjar.io .santander.de .usercentrics.eu api.financingservices.de;frame-src .aklamio.com .adsrvr.org .doubleclick.net .facebook.com .facebook.net .google.com .googletagmanager.com .hotjar.com .hotjar.io .usercentrics.eu .youtube.com .youtube-nocookie.com .zenaps.com;
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Referer: https://www.geldheinz.de/

Response headers

x-ms-access-tier: Hot
x-vhost: publish
etag: "0x8DE25CEB7520251"
age: 1
x-ms-access-tier-inferred: true
x-content-type-options: nosniff
x-cache: MISS
date: Sat, 22 Aug 2026 00:50:21 GMT
last-modified: Mon, 17 Nov 2025 11:44:50 GMT
content-type: image/gif
x-served-by: cache-fra-eddf8230098-FRA
content-disposition: attachment; filename="santander-bestcredit-motiv-pooljump-120x600.gif"; filename*=UTF-8''santander-bestcredit-motiv-pooljump-120x600.gif
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31557600
x-iinfo: 53-258163853-258163858 2VNN RT(1787359822345 8) q(0 0 0 0) r(1 1) U18
content-security-policy: default-src 'self' *.santander.de;script-src 'self' 'unsafe-inline' 'unsafe-eval' *.adform.net *.adsrvr.org *.aklamio.com *.bing.com *.doubleclick.net *.dwin1.com *.dotomi.com *.facebook.com *.facebook.net *.google.com *.google.de *.googleanalytics.com *.googleadservices.com *.googletagmanager.com *.google-analytics.com *.hotjar.com *.hotjar.io *.usercentrics.eu *.youtube.com api.financingservices.de santander-de.financingservices.de data:;style-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleapis.com *.google.com *.google.de santander-de.financingservices.de;img-src 'self' *.adsrvr.org *.aklamio.com *.awin1.com *.bing.com *.doubleclick.net *.facebook.com *.facebook.net *.financeads.net *.google.com *.google.de *.googletagmanager.com *.google-analytics.com *.hotjar.com *.hotjar.io *.usercentrics.eu * santander-de.financingservices.de service.santander.de data:;font-src 'self' data: *.gstatic.com *.hotjar.com *.hotjar.io cloud.email.santander.de;connect-src *.adform.net *.adsrvr.org *.bing.com *.bing.net *.doubleclick.net *.facebook.com *.facebook.net *.google.com *.google.de *.google-analytics.com *.googleadservices.com *.googlesyndication.com *.hotjar.com *.hotjar.io *.santander.de *.usercentrics.eu api.financingservices.de;frame-src *.aklamio.com *.adsrvr.org *.doubleclick.net *.facebook.com *.facebook.net *.google.com *.googletagmanager.com *.hotjar.com *.hotjar.io *.usercentrics.eu *.youtube.com *.youtube-nocookie.com *.zenaps.com;
cache-control: max-age=3600, public
x-timer: S1786560611.657832,VS0,VS0,VE98
x-cdn: Imperva
referrer-policy: no-referrer-when-downgrade
accept-ranges: bytes
access-control-allow-origin: *
content-length: 55200
x-xss-protection: 1;mode=block

Redirect headers

Cache-Control: max-age=0, private, no-store, no-cache, must-revalidate
Location: https://www.santander.de/static/img/santander-bestcredit-motiv-pooljump-120x600.gif
Connection: Keep-Alive
Access-Control-Allow-Origin: *
Content-Length: 0
Keep-Alive: timeout=5, max=100
Date: Sat, 22 Aug 2026 00:50:22 GMT
Content-Type: text/html; charset=UTF-8
Server: Apache

GET
H2 200 app.css
cloud.ccm19.de/ 51 KB
8 KB 11ms
11ms Stylesheet
text/css 148.251.5.29
HETZNER-AS Hetzne...

General

Check archive.org

Download Go to

Full URL

https://cloud.ccm19.de/app.css?apiKey=cb956a35c4256e94d080bce03e2d1d9a02010a031ed3d13f&domain=64fdaa1b1c44df894f080cf5&gen=2&theme=64fdaa1b1c44df894f080d04&v=1786715820

Requested by

Host: www.geldheinz.de
URL: https://www.geldheinz.de/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

148.251.5.29 Falkenstein, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),

Reverse DNS

cloud.ccm19.de

Software

Apache/2.4.67 (Ubuntu) / PHP/8.2.31

Resource Hash

468e9be354143b8b409ed50d25ac837a7eea42a88ce9011fc39797ae9a4e6542

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' ; script-src 'none'; connect-src 'none'; form-action 'none'
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua-platform: "Linux"
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99"
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 3600
content-encoding: br
etag: "N55T4qhH9R55EKWAI9C0j6SqgRM6O9S+-br"
age: 147640
access-control-allow-methods: GET,POST,PUT
x-content-type-options: nosniff
date: Sat, 22 Aug 2026 00:50:22 GMT
last-modified: Fri, 14 Aug 2026 13:57:00 GMT
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
access-control-allow-headers: Content-Type,X-Requested-With,X-CCM19State,Signature,Signature-Input,Signature-Agent
strict-transport-security: max-age=16000000; includeSubDomains; preload
content-security-policy: default-src 'self' ; script-src 'none'; connect-src 'none'; form-action 'none'
cache-control: immutable, max-age=31536000, public
access-control-allow-credentials: true
permissions-policy: interest-cohort=(), geolocation=(), encrypted-media=(), camera=(), microphone=()
access-control-allow-origin: *
content-length: 7854
x-powered-by: PHP/8.2.31
server: Apache/2.4.67 (Ubuntu)

GET
H2 200 widget
cloud.ccm19.de/ 6 KB
3 KB 35ms
12ms Other
text/html 148.251.5.29
HETZNER-AS Hetzne...

General

Check archive.org

Download Go to

Full URL

https://cloud.ccm19.de/widget?apiKey=cb956a35c4256e94d080bce03e2d1d9a02010a031ed3d13f&domain=64fdaa1b1c44df894f080cf5&gen=2&theme=64fdaa1b1c44df894f080d04&lang=de_DE&v=1786715820

Requested by

Host: www.geldheinz.de
URL: https://www.geldheinz.de/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

148.251.5.29 Falkenstein, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),

Reverse DNS

cloud.ccm19.de

Software

Apache/2.4.67 (Ubuntu) / PHP/8.2.31

Resource Hash

6e01c59f3414a1c7bfad8c32afb565770be868568f4a49b74432a4596d610867

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self'; form-action 'self'
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

Origin: https://www.geldheinz.de
sec-ch-ua-platform: "Linux"
Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99"
sec-ch-ua-mobile: ?0

Response headers

x-robots-tag: noindex
access-control-max-age: 3600
content-encoding: br
etag: "N55T4uufw+7SI3U+s+Pj2u7QlvSvZ34v-br"
age: 147640
access-control-allow-methods: GET,POST,PUT
x-content-type-options: nosniff
date: Sat, 22 Aug 2026 00:50:22 GMT
content-type: text/html; charset=utf-8; fragment=yes
vary: Accept-Encoding
x-frame-options: sameorigin
access-control-allow-headers: Content-Type,X-Requested-With,X-CCM19State,Signature,Signature-Input,Signature-Agent
strict-transport-security: max-age=16000000; includeSubDomains; preload
content-security-policy: default-src 'self'; connect-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self'; form-action 'self'
cache-control: immutable, max-age=2592000, public
access-control-allow-credentials: true
permissions-policy: interest-cohort=(), geolocation=(), encrypted-media=(), camera=(), microphone=()
access-control-allow-origin: *
content-length: 1712
content-language: de-DE
x-powered-by: PHP/8.2.31
server: Apache/2.4.67 (Ubuntu)

POST
H2 204 call Show response
cloud.ccm19.de/statistics/ 0
745 B 56ms
38ms XHR
text/plain 148.251.5.29
HETZNER-AS Hetzne...

General

Check archive.org

Download Go to

Full URL

https://cloud.ccm19.de/statistics/call?apiKey=cb956a35c4256e94d080bce03e2d1d9a02010a031ed3d13f&domain=64fdaa1b1c44df894f080cf5

Requested by

Host: cloud.ccm19.de
URL: https://cloud.ccm19.de/app.js?apiKey=cb956a35c4256e94d080bce03e2d1d9a02010a031ed3d13f&domain=64fdaa1b1c44df894f080cf5&lang=de_DE

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

148.251.5.29 Falkenstein, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),

Reverse DNS

cloud.ccm19.de

Software

Apache/2.4.67 (Ubuntu) / PHP/8.2.31

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self'; form-action 'self'
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.geldheinz.de/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99"
Content-Type: application/x-www-form-urlencoded
sec-ch-ua-mobile: ?0

Response headers

x-frame-options: sameorigin
strict-transport-security: max-age=16000000; includeSubDomains; preload
access-control-max-age: 3600
content-security-policy: default-src 'self'; connect-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self'; form-action 'self'
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-methods: GET,POST,PUT
x-content-type-options: nosniff
permissions-policy: interest-cohort=(), geolocation=(), encrypted-media=(), camera=(), microphone=()
access-control-allow-origin: *
date: Sat, 22 Aug 2026 00:50:22 GMT
x-powered-by: PHP/8.2.31
server: Apache/2.4.67 (Ubuntu)
access-control-allow-headers: Content-Type,X-Requested-With,X-CCM19State,Signature,Signature-Input,Signature-Agent

GET
H2 200 favicon.ico
www.geldheinz.de/bilder/ 0
83 B 23ms
22ms Other
image/x-icon 85.13.147.105
NMM-AS Neue Medie...

General

Check archive.org

Download Go to

Full URL: https://www.geldheinz.de/bilder/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 85.13.147.105 , Germany, ASN34788 (NMM-AS Neue Medien Muennich GmbH, DE),
Reverse DNS: dd20516.kasserver.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.geldheinz.de/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99"
sec-ch-ua-mobile: ?0

Response headers

content-encoding: br
etag: "0-4b48bb03bb740-br"
accept-ranges: bytes
content-length: 1
date: Sat, 22 Aug 2026 00:50:22 GMT
last-modified: Tue, 20 Dec 2011 20:12:37 GMT
vary: Accept-Encoding,User-Agent
server: Apache
content-type: image/x-icon

OPTIONS
H2 204 consent
cloud.ccm19.de/statistics/ 0
0 94ms
94ms Preflight 148.251.5.29
HETZNER-AS Hetzne...

General

Check archive.org

Download Go to

Full URL

https://cloud.ccm19.de/statistics/consent?apiKey=cb956a35c4256e94d080bce03e2d1d9a02010a031ed3d13f&domain=64fdaa1b1c44df894f080cf5&gen=2&theme=64fdaa1b1c44df894f080d04

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

148.251.5.29 Falkenstein, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),

Reverse DNS

cloud.ccm19.de

Software

Apache/2.4.67 (Ubuntu) / PHP/8.2.31

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self'; form-action 'self'
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.geldheinz.de
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,X-Requested-With,X-CCM19State,Signature,Signature-Input,Signature-Agent
access-control-allow-methods: GET,POST,PUT
access-control-allow-origin: *
access-control-max-age: 3600
content-security-policy: default-src 'self'; connect-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self'; form-action 'self'
date: Sat, 22 Aug 2026 00:50:22 GMT
permissions-policy: interest-cohort=(), geolocation=(), encrypted-media=(), camera=(), microphone=()
server: Apache/2.4.67 (Ubuntu)
strict-transport-security: max-age=16000000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: sameorigin
x-powered-by: PHP/8.2.31

POST
H2 200 consent Show response
cloud.ccm19.de/statistics/ 16 B
835 B 75ms
74ms XHR
application/json 148.251.5.29
HETZNER-AS Hetzne...

General

Check archive.org

Download Go to

Full URL

https://cloud.ccm19.de/statistics/consent?apiKey=cb956a35c4256e94d080bce03e2d1d9a02010a031ed3d13f&domain=64fdaa1b1c44df894f080cf5&gen=2&theme=64fdaa1b1c44df894f080d04

Requested by

Host: cloud.ccm19.de
URL: https://cloud.ccm19.de/app.js?apiKey=cb956a35c4256e94d080bce03e2d1d9a02010a031ed3d13f&domain=64fdaa1b1c44df894f080cf5&lang=de_DE

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

148.251.5.29 Falkenstein, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),

Reverse DNS

cloud.ccm19.de

Software

Apache/2.4.67 (Ubuntu) / PHP/8.2.31

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self'; form-action 'self'
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.geldheinz.de/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99"
Content-Type: application/json
sec-ch-ua-mobile: ?0

Response headers

access-control-max-age: 3600
content-encoding: gzip
access-control-allow-methods: GET,POST,PUT
x-content-type-options: nosniff
date: Sat, 22 Aug 2026 00:50:22 GMT
content-type: application/json
vary: Accept-Encoding
x-frame-options: sameorigin
access-control-allow-headers: Content-Type,X-Requested-With,X-CCM19State,Signature,Signature-Input,Signature-Agent
strict-transport-security: max-age=16000000; includeSubDomains; preload
content-security-policy: default-src 'self'; connect-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self'; form-action 'self'
cache-control: no-cache, private
access-control-allow-credentials: true
permissions-policy: interest-cohort=(), geolocation=(), encrypted-media=(), camera=(), microphone=()
access-control-allow-origin: *
content-length: 36
x-powered-by: PHP/8.2.31
server: Apache/2.4.67 (Ubuntu)

GET
DATA 200
OK truncated
/ 553 B
0 Image
image/svg+xml

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4b58c6b5ec9eef122ca75c7dfe676d17afd801d3fe7a5f87769a7190c8410252

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 settings-icon
cloud.ccm19.de/ 5 KB
3 KB 99ms
98ms Image
image/svg+xml 148.251.5.29
HETZNER-AS Hetzne...

General

Check archive.org

Download Go to Show image

Full URL

https://cloud.ccm19.de/settings-icon?user=64fda9d6eae7aa511201a8c2&domain=64fdaa1b1c44df894f080cf5&theme=64fdaa1b1c44df894f080d04&v=1751011276

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

148.251.5.29 Falkenstein, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),

Reverse DNS

cloud.ccm19.de

Software

Apache/2.4.67 (Ubuntu) / PHP/8.2.31

Resource Hash

659b1940da82b530b1fa81ec8ac150548454f26605b95b7321b5dcabdc05fa6e

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://update.ccm19.de wss://issues.papoo-service.de https://issues.papoo-service.de https://de.trustpilot.com https://en.trustpilot.com https://omr.com https://reviews.capterra.com https://g.page; script-src 'self' 'unsafe-inline' wss://issues.papoo-service.de https://issues.papoo-service.de https://de.trustpilot.com https://en.trustpilot.com https://omr.com https://reviews.capterra.com https://g.page; style-src 'self' 'unsafe-eval' 'unsafe-inline' wss://issues.papoo-service.de https://issues.papoo-service.de https://de.trustpilot.com https://en.trustpilot.com https://omr.com https://reviews.capterra.com https://g.page; font-src 'self' wss://issues.papoo-service.de https://issues.papoo-service.de https://de.trustpilot.com https://en.trustpilot.com https://omr.com https://reviews.capterra.com https://g.page; img-src 'self' data: https://www.ccm19.de wss://issues.papoo-service.de https://issues.papoo-service.de https://de.trustpilot.com https://en.trustpilot.com https://omr.com https://reviews.capterra.com https://g.page; frame-ancestors 'self'; form-action 'self' https:
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

sec-ch-ua-platform: "Linux"
Referer: https://www.geldheinz.de/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua: "Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99"
sec-ch-ua-mobile: ?0

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload
vary: Accept-Encoding
content-security-policy: default-src 'self'; connect-src 'self' https://update.ccm19.de wss://issues.papoo-service.de https://issues.papoo-service.de https://de.trustpilot.com https://en.trustpilot.com https://omr.com https://reviews.capterra.com https://g.page; script-src 'self' 'unsafe-inline' wss://issues.papoo-service.de https://issues.papoo-service.de https://de.trustpilot.com https://en.trustpilot.com https://omr.com https://reviews.capterra.com https://g.page; style-src 'self' 'unsafe-eval' 'unsafe-inline' wss://issues.papoo-service.de https://issues.papoo-service.de https://de.trustpilot.com https://en.trustpilot.com https://omr.com https://reviews.capterra.com https://g.page; font-src 'self' wss://issues.papoo-service.de https://issues.papoo-service.de https://de.trustpilot.com https://en.trustpilot.com https://omr.com https://reviews.capterra.com https://g.page; img-src 'self' data: https://www.ccm19.de wss://issues.papoo-service.de https://issues.papoo-service.de https://de.trustpilot.com https://en.trustpilot.com https://omr.com https://reviews.capterra.com https://g.page; frame-ancestors 'self'; form-action 'self' https:
cache-control: immutable, max-age=15552000, public
content-encoding: gzip
x-content-type-options: nosniff
permissions-policy: interest-cohort=(), geolocation=(), encrypted-media=(), camera=(), microphone=()
content-length: 1995
date: Sat, 22 Aug 2026 00:50:22 GMT
content-type: image/svg+xml
x-powered-by: PHP/8.2.31
server: Apache/2.4.67 (Ubuntu)
x-frame-options: sameorigin

Verdicts & Comments Add Verdict or Comment

3 JavaScript Window variables Go Pro
Only in urlscan Pro

Inspect and pivot on JavaScript variables, identifiers, and other key site metadata data with urlscan Pro. Reveal and search on client-side frameworks, runtime variables, and custom values.

Click for more information

Free trials of urlscan Pro are available.

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| Ccm19Plugins object| CCM object| dataLayer

3 Cookies Go Pro
Only in urlscan Pro

Review, search, and pivot on browser cookies and persistence site data to see how a site tracks users and keeps sessions alive across visits.

Click for more information

Free trials of urlscan Pro are available.

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.santander.de/	1969-12-31 23:59:59	Name: nlbi_3277841 Value: edl6VIMZ8T6lbm556ANe2AAAAAD5AAJ7DlqJrQ3t6fHsKlgj
.santander.de/	1970-01-22 01:14:47	Name: visid_incap_3277841 Value: p+dT6OWSTaWix5XCRa2j7k3yiGoAAAAAQUIPAAAAAACzCyBdjvAN5QaLGbNyXhrq
.santander.de/	1969-12-31 23:59:59	Name: incap_ses_648_3277841 Value: bnQVV2QLrj7jrQIGpCj+CE7yiGoAAAAA4NOZMUG7QzpnFYKutxDmLg==

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cloud.ccm19.de
www.financeads.net
www.geldheinz.de
www.santander.de
148.251.5.29
212.237.244.233
45.60.197.69
85.13.147.105
051735dafba1886ba7a18979fe92cbf2b04ca6a0f6cb33464fe6a4721ad799c4
0be30dc6713c8faf134a1f4cbf866877d1665d35af5f0b22828ae664fa5d77aa
468e9be354143b8b409ed50d25ac837a7eea42a88ce9011fc39797ae9a4e6542
4b58c6b5ec9eef122ca75c7dfe676d17afd801d3fe7a5f87769a7190c8410252
659b1940da82b530b1fa81ec8ac150548454f26605b95b7321b5dcabdc05fa6e
6e01c59f3414a1c7bfad8c32afb565770be868568f4a49b74432a4596d610867
7bf10a7ae66ba92d2eada0bd6ae836eb5476784685836d63f13da4bdc1f92454
a47589b3791bb69663b8d43d99a8a7a3ab15660f473feff29a071ce3fc6079a5
b94068aa073e4ad6e17566096c7cff59e20720c9f257ebdaa22f630be9d9efa6
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e458e7317a9701dba337345430dda19f224f9041b3845ccc5c1f09c038375b2d

www.geldheinz.de 85.13.147.105 Public Scan Open in urlscan Pro

Internal

Effective Hostname

Submitted URL

Effective IP

Only in urlscan Pro

Summary

urlscan.io Verdict: No classification

Only in urlscan Pro

Domain & IP information

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

IP Lookup

ASN Lookup

Screenshot Go Pro Only in urlscan Pro Use the Visual Search feature to find pages with visually similar screenshots. Click for more information Free trials of urlscan Pro are available. Full Image

Only in urlscan Pro

Page Title

Page Statistics

13 Requests

92 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

113 kBTransfer

263 kBSize

3 Cookies

Only in urlscan Pro

Redirected requests

Only in urlscan Pro

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Only in urlscan Pro

3 Cookies Go Pro Only in urlscan Pro Review, search, and pivot on browser cookies and persistence site data to see how a site tracks users and keeps sessions alive across visits. Click for more information Free trials of urlscan Pro are available.

Only in urlscan Pro

Indicators

www.geldheinz.de
85.13.147.105 Public Scan Open in urlscan Pro

Screenshot Go Pro
Only in urlscan Pro

Use the Visual Search feature to find pages with visually similar screenshots.

Click for more information

Free trials of urlscan Pro are available.

Full Image

13
Requests

92 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

113 kB
Transfer

263 kB
Size

3
Cookies

3 Cookies Go Pro
Only in urlscan Pro

Review, search, and pivot on browser cookies and persistence site data to see how a site tracks users and keeps sessions alive across visits.

Click for more information

Free trials of urlscan Pro are available.