urlscan.io logo urlscan.io
SecurityTrails logo

www.vguf.de Open in urlscan Pro
2a00:1158:400:407::416  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://www.vguf.de/
Effective URL: https://www.vguf.de/
Submission Tags: falconsandbox
Submission: On June 16 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 2 HTTP transactions. The main IP is 2a00:1158:400:407::416, located in Strasbourg, France and belongs to GD-EMEA-DC-SXB1, DE. The main domain is www.vguf.de.
TLS certificate: Issued by Starfield Secure Certificate Authorit... on March 25th 2022. Valid for: a year.
This is the only time www.vguf.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 2a00:1158:400... 8972 (GD-EMEA-D...)
1 1 80.67.16.73 8972 (GD-EMEA-D...)
1 2 2a02:fe80:101... 30148 (SUCURI-SEC)
2 2
Apex Domain
Subdomains		 Transfer
2 df.eu
www.df.eu — Cisco Umbrella Rank: 686692
2 KB
2 vguf.de
www.vguf.de
2 KB
1 domainfactory.de
www.domainfactory.de — Cisco Umbrella Rank: 966790
2 KB
2 3
Domain Requested by
2 www.df.eu 1 redirects www.vguf.de
2 www.vguf.de 1 redirects
1 www.domainfactory.de 1 redirects
2 3

This site contains no links.

Subject Issuer Validity Valid
*.vguf.de
Starfield Secure Certificate Authority - G2		 2022-03-25 -
2023-04-08		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www.vguf.de/
Frame ID: 8D8865A0FA9C915951D0768F858F6BDE
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sehr geehrter Besucher

Page URL History Show full URLs

  1. http://www.vguf.de/ HTTP 301
    https://www.vguf.de/ Page URL

Page Statistics

2
Requests

50 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

2 kB
Transfer

2 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www.vguf.de/ HTTP 301
    https://www.vguf.de/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://www.domainfactory.de/pics/403.gif HTTP 301
  • https://www.df.eu/pics/403.gif HTTP 301
  • https://www.df.eu/de/pics/403.gif

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.vguf.de/
Redirect Chain
  • http://www.vguf.de/
  • https://www.vguf.de/
2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.vguf.de/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1158:400:407::416 Strasbourg, France, ASN8972 (GD-EMEA-DC-SXB1, DE),
Reverse DNS
Software
Apache /
Resource Hash
a8b01b70709616966e06a376bd48e5893fff93698d93c89efbe6c66c69029318

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
1643
Content-Type
text/html
Date
Thu, 16 Jun 2022 17:57:56 GMT
ETag
"66b-541660129f75f"
Keep-Alive
timeout=5, max=100
Last-Modified
Wed, 16 Nov 2016 07:27:25 GMT
Server
Apache

Redirect headers

Connection
Keep-Alive
Content-Length
228
Content-Type
text/html; charset=iso-8859-1
Date
Thu, 16 Jun 2022 17:57:56 GMT
Keep-Alive
timeout=5, max=100
Location
https://www.vguf.de/
Server
Apache
403.gif
www.df.eu/de/pics/
Redirect Chain
  • https://www.domainfactory.de/pics/403.gif
  • https://www.df.eu/pics/403.gif
  • https://www.df.eu/de/pics/403.gif
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.df.eu/de/pics/403.gif
Requested by
Host: www.vguf.de
URL: https://www.vguf.de/
Protocol
H2
Server
2a02:fe80:1010::3:7 , United States, ASN30148 (SUCURI-SEC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.vguf.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Redirect headers

date
Thu, 16 Jun 2022 17:57:56 GMT
x-sucuri-cache
HIT
content-length
241
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
nginx
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15768000
content-type
text/html; charset=iso-8859-1
location
https://www.df.eu/de/pics/403.gif
cache-control
max-age=315360000
feature-policy
geolocation 'self'; midi 'self'; payment 'self'; camera 'self'; usb 'self'; fullscreen 'self'; magnetometer 'self'; picture-in-picture *; accelerometer 'self'; encrypted-media 'self'; autoplay 'self'; gyroscope 'self'; sync-xhr 'self'; microphone 'self'
x-sucuri-id
15003
content-security-policy
default-src 'self' https://*.clarity.ms https://bat.bing.com https://admin.df.eu/ https://analytics.aklamio.com https://*.ampproject.org https://*.lpsnmedia.net https://*.tealiumiq.com https://*.google.com https://*.google.de https://*.doubleclick.net https://*.optimizely.com https://www.google-analytics.com https://*.facebook.com; style-src 'self' 'unsafe-inline' https://github.githubassets.com https://fonts.googleapis.com https://s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://gist.github.com http://tags.tiqcdn.com https://*.clarity.ms https://*.omnitagjs.com https://*.adnxs.com https://*.aklamio.com https://*.doubleclick.net https://java.com https://optimizely.s3.amazonaws.com https://tags.tiqcdn.com https://n3pprd001.cloudstorage.secureserver.net https://static-artifact.heg-cp.com https://cdn.polyfill.io https://www.google.com https://www.gstatic.com https://*.optimizely.com https://www.googleadservices.com https://bat.bing.com https://www.dwin1.com https://connect.facebook.net https://www.google-analytics.com ajax.googleapis.com https://*.twitter.com https://static.ads-twitter.com https://*.ampproject.org https://*.wsimg.com https://*.liveperson.net https://*.lpsnmedia.net; font-src 'self' https://fonts.gstatic.com https://optimizely.github.io; object-src 'self'; img-src 'self' 'unsafe-inline' https://analytics.twitter.com https://paintbrush.heg-cp.com https://*.clarity.ms https://*.bing.com https://irp.cdn-website.com https://*.atdmt.com https://*.zemanta.com https://*.trustpilot.com https://*.aklamio.com https://img1.wsimg.com https://*.lpsnmedia.net https://java.com https://www.df.eu/ data: https://i.ytimg.com https://*.g.doubleclick.net https://bat.bing.com https://www.google-analytics.com https://www.facebook.com https://www.google.com https://www.google.de https://t.co https://*.multiscreensite.com; frame-src 'self' https://www.youtube-nocookie.com https://*.aklamio.com https://lo.tokenizer.liveperson.net https://pixel.bsmartdata.com https://www.google.com https://*.optimizely.com https://*.facebook.com https://*.facebook.net www.youtube.com *.vimeo.com *.vimeocdn.com https://*.fls.doubleclick.net https://*.lpsnmedia.net https://server.lon.liveperson.net/;
expires
Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation

0 Cookies

4 Console Messages

Source Level URL
Text
network error URL: https://www.vguf.de/
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)
security warning URL: https://www.vguf.de/
Message:
Mixed Content: The page at 'https://www.vguf.de/' was loaded over HTTPS, but requested an insecure element 'http://www.domainfactory.de/pics/403.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://www.vguf.de/(Line 36)
Message:
Mixed Content: The page at 'https://www.vguf.de/' was loaded over HTTPS, but requested an insecure element 'http://www.domainfactory.de/pics/403.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
network error URL: https://www.df.eu/de/pics/403.gif
Message:
Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.df.eu
www.domainfactory.de
www.vguf.de
2a00:1158:400:407::416
2a02:fe80:1010::3:7
80.67.16.73
a8b01b70709616966e06a376bd48e5893fff93698d93c89efbe6c66c69029318
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855