Submitted URL: https://kunde.vnrag.de/vnr
Effective URL: https://kunde.vnrag.de/login
Submission: On April 05 via manual from DE — Scanned from DE

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 16 HTTP transactions. The main IP is 35.156.243.233, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is kunde.vnrag.de.
TLS certificate: Issued by Amazon RSA 2048 M03 on April 5th 2024. Valid for: a year.
This is the only time kunde.vnrag.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 11 35.156.243.233 16509 (AMAZON-02)
6 148.251.5.29 24940 (HETZNER-AS)
1 35.158.1.45 16509 (AMAZON-02)
16 4
Apex Domain
Subdomains
Transfer
10 vnrag.de
kunde.vnrag.de
562 KB
6 ccm19.de
5f3c395.ccm19.de — Cisco Umbrella Rank: 311278
63 KB
2 pl-x.cloud
user-frontend.api.pl-x.cloud
17 KB
16 3
Domain Requested by
10 kunde.vnrag.de 2 redirects kunde.vnrag.de
6 5f3c395.ccm19.de kunde.vnrag.de
5f3c395.ccm19.de
2 user-frontend.api.pl-x.cloud kunde.vnrag.de
5f3c395.ccm19.de
16 3

This site contains links to these domains. Also see Links.

Domain
www.vnrag.de
Subject Issuer Validity Valid
kunde.vnrag.de
Amazon RSA 2048 M03
2024-04-05 -
2025-05-04
a year crt.sh
cloud.ccm19.de
R3
2024-03-12 -
2024-06-10
3 months crt.sh
api.pl-x.cloud
Amazon RSA 2048 M02
2023-07-19 -
2024-08-16
a year crt.sh

This page contains 2 frames:

Primary Page: https://kunde.vnrag.de/login
Frame ID: 7242F324F8CDEC9C7CEB0EE3B0FC870C
Requests: 15 HTTP requests in this frame

Frame: https://user-frontend.api.pl-x.cloud/widget/login/?fallbackTargetUrl=https%3A%2F%2Fwww.example.com%2Flogin&fallbackButtonText=Login!&labels=%7B%22buttonText%22%3A%22Anmelden%22%2C%22username%22%3A%22E-Mail-Adresse%22%2C%22password%22%3A%22Passwort%22%7D&onSuccess=(data)%20%3D%3E%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20const%20hiddenFields%20%3D%20%5B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7B%20name%3A%20%27access_token%27%2C%20value%3A%20data.response.access_token%20%7D%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7B%20name%3A%20%27access_token_expiration_utc%27%2C%20value%3A%20data.response.access_token_expiration_utc%20%7D%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7B%20name%3A%20%27refresh_token%27%2C%20value%3A%20data.response.refresh_token%20%7D%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7B%20name%3A%20%27refresh_token_expiration_utc%27%2C%20value%3A%20data.response.refresh_token_expiration_utc%20%7D%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%5D%3B%0A%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20hiddenFields.forEach((field)%20%3D%3E%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20const%20input%20%3D%20document.createElement(%27input%27)%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20input.type%20%3D%20%27hidden%27%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20input.name%20%3D%20field.name%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20input.value%20%3D%20field.value%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20loginForm.appendChild(input)%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7D)%3B%0A%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20loginForm.submit()%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20loginFormSubmitted%20%3D%20true%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%7D&onError=(error)%20%3D%3E%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20errorMessage.textContent%20%3D%20error%3F.message%20%7C%7C%20%27%27%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20errorMessage.classList.remove(%27d-none%27)%3B%0A%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20if%20(loginFormSubmitted)%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20window.location.href%20%3D%20%27%2Fhome%27%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7D%0A%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20loginFormSubmitted%20%3D%20false%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%7D&domain=css&tenant=vnr&language=de&origin=https%3A%2F%2Fkunde.vnrag.de&tokenType=&cssUrl=https%3A%2F%2Fkunde.vnrag.de%2Fcss%2Fwidgets.css
Frame ID: 820B6C681D2409D247AA4EB4129F21D9
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Self-Service

Page URL History Show full URLs

  1. https://kunde.vnrag.de/vnr HTTP 302
    https://kunde.vnrag.de/home HTTP 302
    https://kunde.vnrag.de/login Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/ns\.html[^>]+></iframe>
  • <!-- (?:End )?Google Tag Manager -->

Page Statistics

16
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

641 kB
Transfer

783 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://kunde.vnrag.de/vnr HTTP 302
    https://kunde.vnrag.de/home HTTP 302
    https://kunde.vnrag.de/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login
kunde.vnrag.de/
Redirect Chain
  • https://kunde.vnrag.de/vnr
  • https://kunde.vnrag.de/home
  • https://kunde.vnrag.de/login
7 KB
8 KB
Document
General
Full URL
https://kunde.vnrag.de/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.156.243.233 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-156-243-233.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
b93b71d8ff3c78c00c7de046d100506370178258ebc13f00eb469ddd88239847
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
de-DE,de;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-credentials
true
access-control-allow-headers
*
access-control-allow-methods
GET,HEAD,PUT,POST,DELETE,PATCH,OPTIONS
access-control-allow-origin
*
cache-control
no-cache, private
content-type
text/html; charset=UTF-8
date
Fri, 05 Apr 2024 11:13:57 GMT
server
nginx
strict-transport-security
max-age=2592000; includeSubDomains

Redirect headers

access-control-allow-credentials
true
access-control-allow-headers
*
access-control-allow-methods
GET,HEAD,PUT,POST,DELETE,PATCH,OPTIONS
access-control-allow-origin
*
cache-control
no-cache, private
content-type
text/html; charset=UTF-8
date
Fri, 05 Apr 2024 11:13:57 GMT
location
https://kunde.vnrag.de/login
server
nginx
strict-transport-security
max-age=2592000; includeSubDomains
ccm19.js
5f3c395.ccm19.de/app/public/
150 KB
27 KB
Script
General
Full URL
https://5f3c395.ccm19.de/app/public/ccm19.js?apiKey=5d8c70493d06c746b56b4dfc2d0c01dafe9a1e0721f44a6d
Requested by
Host: kunde.vnrag.de
URL: https://kunde.vnrag.de/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
148.251.5.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.29.5.251.148.clients.your-server.de
Software
Apache/2.4.58 (Ubuntu) / PHP/8.1.27, PHP/8.1.27
Resource Hash
4b29402cf1b4668025c67535456d5252cd7eae735541964cd51c69c0eabfcbf6
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://kunde.vnrag.de/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Apr 2024 11:13:57 GMT
content-encoding
br
strict-transport-security
max-age=16000000; includeSubDomains; preload
server
Apache/2.4.58 (Ubuntu)
age
527
x-powered-by
PHP/8.1.27, PHP/8.1.27
etag
"N55T4rRHnWy2VJDhqCqYmfcD9+LKHlVr-br"
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
max-age=0, public, stale-if-error=3600, stale-while-revalidate=3600, max-age=0, public, stale-if-error=3600, stale-while-revalidate=3600
x-robots-tag
noindex, nofollow
link
<https://5f3c395.ccm19.de/app.css?apiKey=5d8c70493d06c746b56b4dfc2d0c01dafe9a1e0721f44a6d&domain=63ff880f1f2975561aeaec7d&gen=2&theme=63ff89611f2975560003cdca&v=1712235844>;rel="preload";as="style";nopush, <https://5f3c395.ccm19.de/widget?apiKey=5d8c70493d06c746b56b4dfc2d0c01dafe9a1e0721f44a6d&domain=63ff880f1f2975561aeaec7d&gen=2&theme=63ff89611f2975560003cdca&lang=de_DE&v=1712235844>;rel="preload";as="fetch";crossorigin="anonymous";nopush
content-length
27146
vnr.css
kunde.vnrag.de/css/
211 KB
211 KB
Stylesheet
General
Full URL
https://kunde.vnrag.de/css/vnr.css?id=e755fd9357b5cf6030980b8475b8a883
Requested by
Host: kunde.vnrag.de
URL: https://kunde.vnrag.de/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.156.243.233 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-156-243-233.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
250c86daaccc5e57f66c9298f12415702b69793abdbaf65d4b63cb50f1cf7c7b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://kunde.vnrag.de/login
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Apr 2024 11:13:57 GMT
strict-transport-security
max-age=2592000; includeSubDomains
last-modified
Wed, 03 Apr 2024 08:27:19 GMT
server
nginx
etag
"660d12e7-34c45"
content-type
text/css
accept-ranges
bytes
content-length
216133
logo-vnr.svg
kunde.vnrag.de/img/
10 KB
10 KB
Image
General
Full URL
https://kunde.vnrag.de/img/logo-vnr.svg
Requested by
Host: kunde.vnrag.de
URL: https://kunde.vnrag.de/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.156.243.233 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-156-243-233.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
ec1b54c270f73bf781d3397ea2619a2be4c5d0b54f0ae146bf2efb629e622f3f
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://kunde.vnrag.de/login
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Apr 2024 11:13:57 GMT
strict-transport-security
max-age=2592000; includeSubDomains
last-modified
Thu, 04 Apr 2024 00:04:23 GMT
server
nginx
etag
"660dee87-26d6"
content-type
image/svg+xml
accept-ranges
bytes
content-length
9942
verlagslogos-vnr.svg
kunde.vnrag.de/img/
94 KB
94 KB
Image
General
Full URL
https://kunde.vnrag.de/img/verlagslogos-vnr.svg
Requested by
Host: kunde.vnrag.de
URL: https://kunde.vnrag.de/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.156.243.233 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-156-243-233.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
78b5072b013e8665cdfe940eb667d1195d2dd34df1132cc633ee135d36c753c2
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://kunde.vnrag.de/login
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Apr 2024 11:13:57 GMT
strict-transport-security
max-age=2592000; includeSubDomains
last-modified
Tue, 02 Apr 2024 02:39:37 GMT
server
nginx
etag
"660b6fe9-17720"
content-type
image/svg+xml
accept-ranges
bytes
content-length
96032
widget.js
user-frontend.api.pl-x.cloud/js/
17 KB
17 KB
Script
General
Full URL
https://user-frontend.api.pl-x.cloud/js/widget.js
Requested by
Host: kunde.vnrag.de
URL: https://kunde.vnrag.de/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.156.243.233 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-156-243-233.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
3a037bcaf7902cef9ac98fd0096737591f04ed604e3edbbfda52567da897413f
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://kunde.vnrag.de/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Apr 2024 11:13:57 GMT
strict-transport-security
max-age=2592000; includeSubDomains
last-modified
Wed, 03 Apr 2024 08:28:14 GMT
server
nginx
etag
"660d131e-4326"
content-type
application/javascript
accept-ranges
bytes
content-length
17190
app.js
kunde.vnrag.de/js/
208 KB
209 KB
Script
General
Full URL
https://kunde.vnrag.de/js/app.js?id=5c3e31afc45391a798d5fe6f13b149e1
Requested by
Host: kunde.vnrag.de
URL: https://kunde.vnrag.de/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.156.243.233 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-156-243-233.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
17fbc25e8aa1974ec7976a108ad84ea2bd060306fcb32fd7ea0d83910632c125
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://kunde.vnrag.de/login
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Apr 2024 11:13:57 GMT
strict-transport-security
max-age=2592000; includeSubDomains
last-modified
Wed, 03 Apr 2024 08:27:19 GMT
server
nginx
etag
"660d12e7-340c7"
content-type
application/javascript
accept-ranges
bytes
content-length
213191
app.css
5f3c395.ccm19.de/
49 KB
9 KB
Stylesheet
General
Full URL
https://5f3c395.ccm19.de/app.css?apiKey=5d8c70493d06c746b56b4dfc2d0c01dafe9a1e0721f44a6d&domain=63ff880f1f2975561aeaec7d&gen=2&theme=63ff89611f2975560003cdca&v=1712235844
Requested by
Host: kunde.vnrag.de
URL: https://kunde.vnrag.de/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
148.251.5.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.29.5.251.148.clients.your-server.de
Software
Apache/2.4.58 (Ubuntu) / PHP/8.1.27, PHP/8.1.27
Resource Hash
128d085d8385f1d62497ae49013e6581c15b37fb579cf8cf77baaf8491df1332
Security Headers
Name Value
Content-Security-Policy default-src 'self' ; script-src 'none'; connect-src 'none'; form-action 'none'
Strict-Transport-Security max-age=16000000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://kunde.vnrag.de/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self' ; script-src 'none'; connect-src 'none'; form-action 'none'
date
Fri, 05 Apr 2024 11:13:57 GMT
content-encoding
br
strict-transport-security
max-age=16000000; includeSubDomains; preload
age
352
x-powered-by
PHP/8.1.27, PHP/8.1.27
content-length
8064
last-modified
Thu, 04 Apr 2024 13:04:04 GMT
server
Apache/2.4.58 (Ubuntu)
etag
"N55T4sWoRiWgN8yk16MQTOAHgMfpZRIs-br"
vary
Accept-Encoding
access-control-allow-methods
GET,POST,PUT
content-type
text/css;charset=UTF-8
access-control-allow-origin
*
cache-control
immutable, max-age=31536000, public, immutable, max-age=31536000, public
access-control-allow-credentials
true
access-control-max-age
3600
access-control-allow-headers
Content-Type,X-Requested-With,X-CCM19State
widget
5f3c395.ccm19.de/
9 KB
3 KB
Other
General
Full URL
https://5f3c395.ccm19.de/widget?apiKey=5d8c70493d06c746b56b4dfc2d0c01dafe9a1e0721f44a6d&domain=63ff880f1f2975561aeaec7d&gen=2&theme=63ff89611f2975560003cdca&lang=de_DE&v=1712235844
Requested by
Host: kunde.vnrag.de
URL: https://kunde.vnrag.de/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
148.251.5.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.29.5.251.148.clients.your-server.de
Software
Apache/2.4.58 (Ubuntu) / PHP/8.1.27, PHP/8.1.27
Resource Hash
ca9b81f8e9c5ac6a82753e70eafe0a927be1e73f8e57581275afd7327495aa97
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://kunde.vnrag.de/
Origin
https://kunde.vnrag.de
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Apr 2024 11:13:57 GMT
content-encoding
br
strict-transport-security
max-age=16000000; includeSubDomains; preload
age
735
x-powered-by
PHP/8.1.27, PHP/8.1.27
content-length
2121
server
Apache/2.4.58 (Ubuntu)
etag
"N55T4t8INix9ht5ETWlro+1sLh5aQJOq-br"
vary
Accept-Encoding
access-control-allow-methods
GET,POST,PUT
content-language
de-DE
access-control-allow-origin
*
content-type
text/x-html-fragment; charset=utf-8
cache-control
immutable, max-age=2592000, public, immutable, max-age=2592000, public
access-control-allow-credentials
true
access-control-max-age
3600
x-robots-tag
noindex
access-control-allow-headers
Content-Type,X-Requested-With,X-CCM19State
/
user-frontend.api.pl-x.cloud/widget/login/ Frame 820B
0
0
Document
General
Full URL
https://user-frontend.api.pl-x.cloud/widget/login/?fallbackTargetUrl=https%3A%2F%2Fwww.example.com%2Flogin&fallbackButtonText=Login!&labels=%7B%22buttonText%22%3A%22Anmelden%22%2C%22username%22%3A%22E-Mail-Adresse%22%2C%22password%22%3A%22Passwort%22%7D&onSuccess=(data)%20%3D%3E%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20const%20hiddenFields%20%3D%20%5B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7B%20name%3A%20%27access_token%27%2C%20value%3A%20data.response.access_token%20%7D%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7B%20name%3A%20%27access_token_expiration_utc%27%2C%20value%3A%20data.response.access_token_expiration_utc%20%7D%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7B%20name%3A%20%27refresh_token%27%2C%20value%3A%20data.response.refresh_token%20%7D%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7B%20name%3A%20%27refresh_token_expiration_utc%27%2C%20value%3A%20data.response.refresh_token_expiration_utc%20%7D%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%5D%3B%0A%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20hiddenFields.forEach((field)%20%3D%3E%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20const%20input%20%3D%20document.createElement(%27input%27)%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20input.type%20%3D%20%27hidden%27%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20input.name%20%3D%20field.name%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20input.value%20%3D%20field.value%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20loginForm.appendChild(input)%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7D)%3B%0A%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20loginForm.submit()%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20loginFormSubmitted%20%3D%20true%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%7D&onError=(error)%20%3D%3E%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20errorMessage.textContent%20%3D%20error%3F.message%20%7C%7C%20%27%27%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20errorMessage.classList.remove(%27d-none%27)%3B%0A%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20if%20(loginFormSubmitted)%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20window.location.href%20%3D%20%27%2Fhome%27%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7D%0A%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20loginFormSubmitted%20%3D%20false%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%7D&domain=css&tenant=vnr&language=de&origin=https%3A%2F%2Fkunde.vnrag.de&tokenType=&cssUrl=https%3A%2F%2Fkunde.vnrag.de%2Fcss%2Fwidgets.css
Requested by
Host: 5f3c395.ccm19.de
URL: https://5f3c395.ccm19.de/app/public/ccm19.js?apiKey=5d8c70493d06c746b56b4dfc2d0c01dafe9a1e0721f44a6d
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.158.1.45 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-158-1-45.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

Referer
https://kunde.vnrag.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
de-DE,de;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
no-cache, private
content-type
text/html; charset=UTF-8
date
Fri, 05 Apr 2024 11:13:57 GMT
server
nginx
strict-transport-security
max-age=2592000; includeSubDomains
open-sans-v18-latin-regular.woff2
kunde.vnrag.de/fonts/
14 KB
14 KB
Font
General
Full URL
https://kunde.vnrag.de/fonts/open-sans-v18-latin-regular.woff2?f57a62e9efddf6ace18b15572f81905b
Requested by
Host: kunde.vnrag.de
URL: https://kunde.vnrag.de/css/vnr.css?id=e755fd9357b5cf6030980b8475b8a883
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.156.243.233 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-156-243-233.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://kunde.vnrag.de/css/vnr.css?id=e755fd9357b5cf6030980b8475b8a883
Origin
https://kunde.vnrag.de
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Apr 2024 11:13:57 GMT
strict-transport-security
max-age=2592000; includeSubDomains
last-modified
Thu, 04 Apr 2024 00:04:23 GMT
server
nginx
etag
"660dee87-382c"
content-type
font/woff2
accept-ranges
bytes
content-length
14380
open-sans-v18-latin-600.woff2
kunde.vnrag.de/fonts/
15 KB
15 KB
Font
General
Full URL
https://kunde.vnrag.de/fonts/open-sans-v18-latin-600.woff2?9526470852428b4340ed994462821463
Requested by
Host: kunde.vnrag.de
URL: https://kunde.vnrag.de/css/vnr.css?id=e755fd9357b5cf6030980b8475b8a883
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.156.243.233 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-156-243-233.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1491de1b31182d38593bcf660c99bc6018af8e192d91663f67ec9d045a3b5ccc
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://kunde.vnrag.de/css/vnr.css?id=e755fd9357b5cf6030980b8475b8a883
Origin
https://kunde.vnrag.de
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Apr 2024 11:13:57 GMT
strict-transport-security
max-age=2592000; includeSubDomains
last-modified
Tue, 02 Apr 2024 02:39:37 GMT
server
nginx
etag
"660b6fe9-3a20"
content-type
font/woff2
accept-ranges
bytes
content-length
14880
details
5f3c395.ccm19.de/widget/
0
24 KB
Other
General
Full URL
https://5f3c395.ccm19.de/widget/details?apiKey=5d8c70493d06c746b56b4dfc2d0c01dafe9a1e0721f44a6d&domain=63ff880f1f2975561aeaec7d&gen=2&theme=63ff89611f2975560003cdca&lang=de_DE&v=1712235844
Requested by
Host: 5f3c395.ccm19.de
URL: https://5f3c395.ccm19.de/app/public/ccm19.js?apiKey=5d8c70493d06c746b56b4dfc2d0c01dafe9a1e0721f44a6d
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
148.251.5.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.29.5.251.148.clients.your-server.de
Software
Apache/2.4.58 (Ubuntu) / PHP/8.1.27, PHP/8.1.27
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://kunde.vnrag.de/
Origin
https://kunde.vnrag.de
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Apr 2024 11:13:57 GMT
content-encoding
br
strict-transport-security
max-age=16000000; includeSubDomains; preload
age
735
x-powered-by
PHP/8.1.27, PHP/8.1.27
content-length
23640
server
Apache/2.4.58 (Ubuntu)
etag
"N55T4rmIzdo0uvhP6o9+WfqRAGoW8HQQ-br"
vary
Accept-Encoding
access-control-allow-methods
GET,POST,PUT
content-language
de-DE
access-control-allow-origin
*
content-type
text/x-html-fragment; charset=utf-8
cache-control
immutable, max-age=31536000, public, immutable, max-age=31536000, public
access-control-allow-credentials
true
access-control-max-age
3600
x-robots-tag
noindex
access-control-allow-headers
Content-Type,X-Requested-With,X-CCM19State
consent
5f3c395.ccm19.de/statistics/
16 B
793 B
XHR
General
Full URL
https://5f3c395.ccm19.de/statistics/consent?apiKey=5d8c70493d06c746b56b4dfc2d0c01dafe9a1e0721f44a6d&domain=63ff880f1f2975561aeaec7d&gen=2&theme=63ff89611f2975560003cdca
Requested by
Host: 5f3c395.ccm19.de
URL: https://5f3c395.ccm19.de/app/public/ccm19.js?apiKey=5d8c70493d06c746b56b4dfc2d0c01dafe9a1e0721f44a6d
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
148.251.5.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.29.5.251.148.clients.your-server.de
Software
Apache/2.4.58 (Ubuntu) / PHP/8.1.27
Resource Hash
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
Security Headers
Name Value
Content-Security-Policy default-src 'self'; connect-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self'; form-action 'self'
Strict-Transport-Security max-age=16000000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform
"Win32"
Referer
https://kunde.vnrag.de/
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
application/json

Response headers

date
Fri, 05 Apr 2024 11:13:57 GMT
content-security-policy
default-src 'self'; connect-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self'; form-action 'self'
x-content-type-options
nosniff
strict-transport-security
max-age=16000000; includeSubDomains; preload
content-encoding
gzip
x-powered-by
PHP/8.1.27
content-length
36
server
Apache/2.4.58 (Ubuntu)
access-control-max-age
3600
access-control-allow-methods
GET,POST,PUT
content-type
application/json
access-control-allow-origin
*
cache-control
no-cache, private
access-control-allow-credentials
true
permissions-policy
interest-cohort=(), geolocation=(), encrypted-media=(), camera=(), microphone=()
x-frame-options
sameorigin
access-control-allow-headers
Content-Type,X-Requested-With,X-CCM19State
vary
Accept-Encoding
truncated
/
43 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type
image/gif
consent
5f3c395.ccm19.de/statistics/ Frame
0
0
Preflight
General
Full URL
https://5f3c395.ccm19.de/statistics/consent?apiKey=5d8c70493d06c746b56b4dfc2d0c01dafe9a1e0721f44a6d&domain=63ff880f1f2975561aeaec7d&gen=2&theme=63ff89611f2975560003cdca
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
148.251.5.29 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.29.5.251.148.clients.your-server.de
Software
Apache/2.4.58 (Ubuntu) / PHP/8.1.27
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; connect-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self'; form-action 'self'
Strict-Transport-Security max-age=16000000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://kunde.vnrag.de
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,X-Requested-With,X-CCM19State
access-control-allow-methods
GET,POST,PUT
access-control-allow-origin
*
access-control-max-age
3600
content-security-policy
default-src 'self'; connect-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self'; form-action 'self'
date
Fri, 05 Apr 2024 11:13:57 GMT
permissions-policy
interest-cohort=(), geolocation=(), encrypted-media=(), camera=(), microphone=()
server
Apache/2.4.58 (Ubuntu)
strict-transport-security
max-age=16000000; includeSubDomains; preload
x-content-type-options
nosniff
x-frame-options
sameorigin
x-powered-by
PHP/8.1.27
favicon.ico
kunde.vnrag.de/
0
171 B
Other
General
Full URL
https://kunde.vnrag.de/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.156.243.233 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-156-243-233.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://kunde.vnrag.de/login
accept-language
de-DE,de;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Apr 2024 11:13:57 GMT
strict-transport-security
max-age=2592000; includeSubDomains
last-modified
Wed, 03 Apr 2024 08:27:19 GMT
server
nginx
etag
"660d12e7-0"
content-type
image/x-icon
accept-ranges
bytes
content-length
0

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| dataLayer object| Ccm19Plugins object| CCM object| webpackChunk object| regeneratorRuntime function| PxModUser

1 Cookies

Domain/Path Name / Value
kunde.vnrag.de/ Name: self_service_prod_session
Value: eyJpdiI6Im9LNE9FTSthRjNoQ1hWWDk0a04veEE9PSIsInZhbHVlIjoiWmVvaDRXMmU2eWVrY3ZRZnR6b3hPeHhyeUpuMnRyMldsL3VFampINTBKNVVxSWhkT0NMbGpQZldtbjIzcVFFZFpZM0ZvQzd5dE8zOTZmeFc1L3pQZ2pBZEljeHFwVlV1enNjUmF3OWN6OWk5bEJnN2tBZWdCVXVjYlBxbGtLNWQiLCJtYWMiOiI2MWY0NjEzZGY0OTM3NjBlMmZhYTQzM2Y3NTYzM2NiMTg2MDgyM2QyZjRmOGViODU4ODNjMDQ2M2JmNTU5MzU0IiwidGFnIjoiIn0%3D

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=2592000; includeSubDomains