www.drugscreencorp.com Open in urlscan Pro
80.208.252.166 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.drugscreencorp.com/review/IHWLDGMAMVRTIA/validation?testid=76AG1212-574954
Effective URL:
https://www.drugscreencorp.com/badphish_notice.jspx?ident=IHWLDGMAMVRTIA&oto=104D497C17C66AAB366884F0DC80CF22AD8FD29A
Submission: On September 19 via manual (September 19th 2024, 11:47:33 pm UTC) from US — Scanned from GB

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 6 domains to perform 15 HTTP transactions. The main IP is 80.208.252.166, located in United Kingdom and belongs to HYVE-MANAGED-HOSTING, US. The main domain is www.drugscreencorp.com.
TLS certificate: Issued by Thawte TLS RSA CA G1 on January 19th 2024. Valid for: a year.

This is the only time www.drugscreencorp.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
11	80.208.252.166 80.208.252.166	397964 (HYVE-MANA...) (HYVE-MANAGED-HOSTING)
1	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
2	172.217.18.4 172.217.18.4	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
15	4

11 80.208.252.166 (United Kingdom)

ASN397964 (HYVE-MANAGED-HOSTING, US)

www.drugscreencorp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.stickleyonsecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.xlvut12po99xdpqw.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.18.4 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s22-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	drugscreencorp.com www.drugscreencorp.com	243 KB
4	xlvut12po99xdpqw.com www.xlvut12po99xdpqw.com	243 KB
2	google.com www.google.com — Cisco Umbrella Rank: 3	991 B
2	stickleyonsecurity.com www.stickleyonsecurity.com	136 KB
1	gstatic.com www.gstatic.com	213 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 407	30 KB
15	6

	Domain	Requested by
5	www.drugscreencorp.com	www.drugscreencorp.com www.xlvut12po99xdpqw.com
4	www.xlvut12po99xdpqw.com	www.xlvut12po99xdpqw.com ajax.googleapis.com
2	www.google.com	www.xlvut12po99xdpqw.com www.gstatic.com
2	www.stickleyonsecurity.com	www.drugscreencorp.com www.xlvut12po99xdpqw.com
1	www.gstatic.com	www.google.com
1	ajax.googleapis.com	www.xlvut12po99xdpqw.com
15	6

This site contains no links.

Subject Issuer	Validity	Valid
stickleyonsecurity.com Thawte TLS RSA CA G1	`2024-01-19` - `2025-02-05`	a year	crt.sh
www.xlvut12po99xdpqw.com RapidSSL TLS RSA CA G1	`2024-04-29` - `2025-04-28`	a year	crt.sh
upload.video.google.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.google.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.gstatic.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://www.drugscreencorp.com/badphish_notice.jspx?ident=IHWLDGMAMVRTIA&oto=104D497C17C66AAB366884F0DC80CF22AD8FD29A
Frame ID: B5DFA519EF1944DCDDB09A628D56F0A7
Requests: 14 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LepteEUAAAAAJwgAAo1eqAlarlFFpeO1O36hted&co=aHR0cHM6Ly93d3cueGx2dXQxMnBvOTl4ZHBxdy5jb206NDQz&hl=en&v=EGbODne6buzpTnWrrBprcfAY&size=invisible&cb=xufzv7hd9cn0
Frame ID: 002E4E037B5D6202E82828B33F53AC75
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.drugscreencorp.com/review/IHWLDGMAMVRTIA/validation?testid=76AG1212-574954 HTTP 307
https://www.drugscreencorp.com/review/IHWLDGMAMVRTIA/validation?testid=76AG1212-574954 Page URL
https://www.drugscreencorp.com/index2.jspx?/review/IHWLDGMAMVRTIA/validation&testid=76AG1212-574954 Page URL
https://www.xlvut12po99xdpqw.com/cc-index.jspx Page URL
https://www.drugscreencorp.com/badphish_notice.jspx?ident=IHWLDGMAMVRTIA&oto=104D497C17C66AAB366884F0DC80CF... Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

15
Requests

67 %
HTTPS

50 %
IPv6

6
Domains

6
Subdomains

4
IPs

3
Countries

866 kB
Transfer

1604 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.drugscreencorp.com/review/IHWLDGMAMVRTIA/validation?testid=76AG1212-574954 HTTP 307
https://www.drugscreencorp.com/review/IHWLDGMAMVRTIA/validation?testid=76AG1212-574954 Page URL
https://www.drugscreencorp.com/index2.jspx?/review/IHWLDGMAMVRTIA/validation&testid=76AG1212-574954 Page URL
https://www.xlvut12po99xdpqw.com/cc-index.jspx Page URL
https://www.drugscreencorp.com/badphish_notice.jspx?ident=IHWLDGMAMVRTIA&oto=104D497C17C66AAB366884F0DC80CF22AD8FD29A Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://www.drugscreencorp.com/review/IHWLDGMAMVRTIA/validation?testid=76AG1212-574954 HTTP 307
https://www.drugscreencorp.com/review/IHWLDGMAMVRTIA/validation?testid=76AG1212-574954

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

404
Not Found

validation
www.drugscreencorp.com/review/IHWLDGMAMVRTIA/
Redirect Chain

http://www.drugscreencorp.com/review/IHWLDGMAMVRTIA/validation?testid=76AG1212-574954
https://www.drugscreencorp.com/review/IHWLDGMAMVRTIA/validation?testid=76AG1212-574954

162 B
544 B

409ms
92ms

Document
text/html

80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://www.drugscreencorp.com/review/IHWLDGMAMVRTIA/validation?testid=76AG1212-574954

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),

Reverse DNS

Software

Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 162
Content-Type: text/html
Date: Thu, 19 Sep 2024 23:47:27 GMT
ETag: "a2-5f73267a75bc0"
Keep-Alive: timeout=5, max=100
Last-Modified: Sat, 18 Mar 2023 20:19:03 GMT
Server: Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46
Strict-Transport-Security: max-age=31536000; includeSubDomains

Redirect headers

Location: https://www.drugscreencorp.com/review/IHWLDGMAMVRTIA/validation?testid=76AG1212-574954
Non-Authoritative-Reason: HttpsUpgrades

GET
H/1.1 200
OK index2.jspx Show response
www.drugscreencorp.com/ 605 B
723 B 109ms
108ms Document
text/html 80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://www.drugscreencorp.com/index2.jspx?/review/IHWLDGMAMVRTIA/validation&testid=76AG1212-574954

Requested by

Host: www.drugscreencorp.com
URL: https://www.drugscreencorp.com/review/IHWLDGMAMVRTIA/validation?testid=76AG1212-574954

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),

Reverse DNS

Software

Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /

Resource Hash

0cbd00bb9c49dd703f17c79cd6e01d1cd07aff489494a95011f53d8c8b1375ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.drugscreencorp.com/review/IHWLDGMAMVRTIA/validation?testid=76AG1212-574954
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Thu, 19 Sep 2024 23:47:27 GMT
Keep-Alive: timeout=5, max=99
Server: Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46
Strict-Transport-Security: max-age=31536000; includeSubDomains
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H/1.1 200
OK jquery-1.6-v2.js Show response
www.stickleyonsecurity.com/js/ 403 KB
106 KB 308ms
101ms Script
application/javascript 80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://www.stickleyonsecurity.com/js/jquery-1.6-v2.js

Requested by

Host: www.drugscreencorp.com
URL: https://www.drugscreencorp.com/index2.jspx?/review/IHWLDGMAMVRTIA/validation&testid=76AG1212-574954

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),

Reverse DNS

Software

Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /

Resource Hash

dc07c71a852f1a075ce4f1a3c82608d541b8f453161e6926ef28dde572410787

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.drugscreencorp.com/

Response headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
ETag: "64d87-5d4c3a7e3f900-gzip"
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Date: Thu, 19 Sep 2024 23:47:28 GMT
Last-Modified: Tue, 04 Jan 2022 15:54:44 GMT
Vary: Accept-Encoding
Server: Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46
Content-Type: application/javascript

POST
H/1.1 200
OK cc-index.jspx Show response
www.xlvut12po99xdpqw.com/ 7 KB
3 KB 426ms
103ms Document
text/html 80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to

Full URL: https://www.xlvut12po99xdpqw.com/cc-index.jspx
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),
Reverse DNS
Software: Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /
Resource Hash: c490eb752593f18b81749c2963d48e4b5ddfeb3e7b954bd1cb9cd24d9384960c

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.drugscreencorp.com
Referer: https://www.drugscreencorp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Thu, 19 Sep 2024 23:47:28 GMT
Keep-Alive: timeout=5, max=100
Server: Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H/1.1 200
OK jquery-compressed.js Show response
www.stickleyonsecurity.com/js/ 86 KB
30 KB 285ms
97ms Script
application/javascript 80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://www.stickleyonsecurity.com/js/jquery-compressed.js

Requested by

Host: www.xlvut12po99xdpqw.com
URL: https://www.xlvut12po99xdpqw.com/cc-index.jspx

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),

Reverse DNS

Software

Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.xlvut12po99xdpqw.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
ETag: "15851-5adcad9586040-gzip"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 30677
Keep-Alive: timeout=5, max=100
Date: Thu, 19 Sep 2024 23:47:29 GMT
Last-Modified: Wed, 26 Aug 2020 17:07:05 GMT
Vary: Accept-Encoding
Server: Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46
Content-Type: application/javascript

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 85 KB
30 KB 115ms
35ms Script
text/javascript 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

Requested by

Host: www.xlvut12po99xdpqw.com
URL: https://www.xlvut12po99xdpqw.com/cc-index.jspx

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.xlvut12po99xdpqw.com/

Response headers

content-encoding: gzip
age: 292027
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Tue, 16 Sep 2025 14:40:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 16 Sep 2024 14:40:21 GMT
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30399
x-xss-protection: 0
server: sffe

GET
H3 200 api.js Show response
www.google.com/recaptcha/ 1 KB
991 B 152ms
80ms Script
text/javascript 172.217.18.4
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?render=6LepteEUAAAAAJwgAAo1eqAlarlFFpeO1O36hted

Requested by

Host: www.xlvut12po99xdpqw.com
URL: https://www.xlvut12po99xdpqw.com/cc-index.jspx

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.4 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f4.1e100.net

Software

ESF /

Resource Hash

b11094dd430a10783877e73b6aca41421ebc437a0fd34a3367206c1e9d5ee66e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.xlvut12po99xdpqw.com/

Response headers

cache-control: private, max-age=300
content-encoding: gzip
cross-origin-resource-policy: cross-origin
report-to: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
x-content-type-options: nosniff
expires: Thu, 19 Sep 2024 23:47:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
date: Thu, 19 Sep 2024 23:47:28 GMT
x-xss-protection: 0
content-type: text/javascript; charset=utf-8
server: ESF
x-frame-options: SAMEORIGIN

GET
H/1.1 200
OK badphish-logo-lantern2.png
www.xlvut12po99xdpqw.com/images/ 238 KB
238 KB 94ms
92ms Image
image/png 80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.xlvut12po99xdpqw.com/images/badphish-logo-lantern2.png
Requested by: Host: www.xlvut12po99xdpqw.com
URL: https://www.xlvut12po99xdpqw.com/cc-index.jspx
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),
Reverse DNS
Software: Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /
Resource Hash: fb5a0aa1ead4b42aeabafe089ce9c3aa03e45eef43f2b629f8f2dfea2a1e3a6f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.xlvut12po99xdpqw.com/cc-index.jspx

Response headers

Cache-Control: max-age=5184000
ETag: "3b71b-524d4b16e0f00"
Connection: Keep-Alive
Expires: Mon, 18 Nov 2024 23:47:28 GMT
Accept-Ranges: bytes
Content-Length: 243483
Keep-Alive: timeout=5, max=99
Date: Thu, 19 Sep 2024 23:47:28 GMT
Last-Modified: Wed, 18 Nov 2015 18:20:12 GMT
Content-Type: image/png
Server: Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/EGbODne6buzpTnWrrBprcfAY/ 538 KB
213 KB 117ms
34ms Script
text/javascript 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/EGbODne6buzpTnWrrBprcfAY/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6LepteEUAAAAAJwgAAo1eqAlarlFFpeO1O36hted

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4943e91f7f53318d481ca07297395abbc52541c2be55d7276ecda152cd7ad9c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.xlvut12po99xdpqw.com
Referer: https://www.xlvut12po99xdpqw.com/

Response headers

content-encoding: gzip
age: 18439
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
x-content-type-options: nosniff
expires: Fri, 19 Sep 2025 18:40:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 18:40:10 GMT
last-modified: Tue, 03 Sep 2024 02:00:38 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
accept-ranges: bytes
access-control-allow-origin: *
content-length: 217247
x-xss-protection: 0
server: sffe

GET
H3 200 anchor
www.google.com/recaptcha/api2/ Frame 002E 0
0 131ms
65ms Document
text/html 172.217.18.4
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LepteEUAAAAAJwgAAo1eqAlarlFFpeO1O36hted&co=aHR0cHM6Ly93d3cueGx2dXQxMnBvOTl4ZHBxdy5jb206NDQz&hl=en&v=EGbODne6buzpTnWrrBprcfAY&size=invisible&cb=xufzv7hd9cn0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/EGbODne6buzpTnWrrBprcfAY/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.4 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f4.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-KSrriYj_s0Dp42byVQZb2w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.xlvut12po99xdpqw.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-KSrriYj_s0Dp42byVQZb2w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Thu, 19 Sep 2024 23:47:29 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK favicon.ico
www.xlvut12po99xdpqw.com/ 1 KB
1 KB 92ms
92ms Other
image/x-icon 80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to

Full URL: https://www.xlvut12po99xdpqw.com/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),
Reverse DNS
Software: Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /
Resource Hash: c6940305f3091aff172b121d30e319cb8b3f5560f82c46740ad9f37ca12c5e21

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.xlvut12po99xdpqw.com/cc-index.jspx

Response headers

Cache-Control: max-age=31104000
Content-Encoding: gzip
ETag: "47e-5480648723080-gzip"
Connection: Keep-Alive
Expires: Sun, 14 Sep 2025 23:47:30 GMT
Accept-Ranges: bytes
Content-Length: 747
Keep-Alive: timeout=5, max=98
Date: Thu, 19 Sep 2024 23:47:30 GMT
Last-Modified: Wed, 08 Feb 2017 15:11:46 GMT
Vary: Accept-Encoding
Server: Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46
Content-Type: image/x-icon

POST
H/1.1 200
OK bp_end.jspx Show response
www.xlvut12po99xdpqw.com/ 0
324 B 99ms
97ms XHR
text/html 80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to

Full URL: https://www.xlvut12po99xdpqw.com/bp_end.jspx
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),
Reverse DNS
Software: Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.xlvut12po99xdpqw.com/cc-index.jspx
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Transfer-Encoding: chunked
Content-Encoding: gzip
Connection: Keep-Alive
Keep-Alive: timeout=5, max=97
Date: Thu, 19 Sep 2024 23:47:30 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Server: Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46

GET
H/1.1 200
OK Primary Request badphish_notice.jspx Show response
www.drugscreencorp.com/ 5 KB
2 KB 99ms
98ms Document
text/html 80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://www.drugscreencorp.com/badphish_notice.jspx?ident=IHWLDGMAMVRTIA&oto=104D497C17C66AAB366884F0DC80CF22AD8FD29A

Requested by

Host: www.xlvut12po99xdpqw.com
URL: https://www.xlvut12po99xdpqw.com/cc-index.jspx

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),

Reverse DNS

Software

Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /

Resource Hash

ef5a6e4fa75a0aa17d9cbb3ecf39bf184667192af66b1f5d25acbf6534649bc6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.xlvut12po99xdpqw.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Thu, 19 Sep 2024 23:47:30 GMT
Keep-Alive: timeout=5, max=98
Server: Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46
Strict-Transport-Security: max-age=31536000; includeSubDomains
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H/1.1 200
OK badphish-logo-lantern2.png
www.drugscreencorp.com/images/ 238 KB
238 KB 93ms
92ms Image
image/png 80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.drugscreencorp.com/images/badphish-logo-lantern2.png

Requested by

Host: www.drugscreencorp.com
URL: https://www.drugscreencorp.com/badphish_notice.jspx?ident=IHWLDGMAMVRTIA&oto=104D497C17C66AAB366884F0DC80CF22AD8FD29A

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),

Reverse DNS

Software

Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /

Resource Hash

fb5a0aa1ead4b42aeabafe089ce9c3aa03e45eef43f2b629f8f2dfea2a1e3a6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.drugscreencorp.com/badphish_notice.jspx?ident=IHWLDGMAMVRTIA&oto=104D497C17C66AAB366884F0DC80CF22AD8FD29A

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: max-age=5184000
ETag: "3b71b-524d4b16e0f00"
Connection: Keep-Alive
Expires: Mon, 18 Nov 2024 23:47:30 GMT
Accept-Ranges: bytes
Content-Length: 243483
Keep-Alive: timeout=5, max=97
Date: Thu, 19 Sep 2024 23:47:30 GMT
Last-Modified: Wed, 18 Nov 2015 18:20:12 GMT
Content-Type: image/png
Server: Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46

GET
H/1.1 200
OK favicon.ico
www.drugscreencorp.com/ 1 KB
1 KB 93ms
92ms Other
image/x-icon 80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://www.drugscreencorp.com/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),

Reverse DNS

Software

Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /

Resource Hash

c6940305f3091aff172b121d30e319cb8b3f5560f82c46740ad9f37ca12c5e21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.drugscreencorp.com/badphish_notice.jspx?ident=IHWLDGMAMVRTIA&oto=104D497C17C66AAB366884F0DC80CF22AD8FD29A

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: max-age=31104000
Content-Encoding: gzip
ETag: "47e-5480648723080-gzip"
Connection: Keep-Alive
Expires: Sun, 14 Sep 2025 23:47:31 GMT
Accept-Ranges: bytes
Content-Length: 747
Keep-Alive: timeout=5, max=96
Date: Thu, 19 Sep 2024 23:47:31 GMT
Last-Modified: Wed, 08 Feb 2017 15:11:46 GMT
Vary: Accept-Encoding
Server: Apache/2.4.61 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46
Content-Type: image/x-icon

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.google.com/recaptcha	1970-01-21 03:59:01	Name: _GRECAPTCHA Value: 09AGteOyqnn9-9NgucfS6I9Si7zhqALi0iJbtD7DmK7nvEYYtZXE5CexKzX_bptw85V9ErF4oW-nCkixl7O0g83xY

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.drugscreencorp.com/review/IHWLDGMAMVRTIA/validation?testid=76AG1212-574954 Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
www.drugscreencorp.com
www.google.com
www.gstatic.com
www.stickleyonsecurity.com
www.xlvut12po99xdpqw.com
172.217.18.4
2a00:1450:4001:812::200a
2a00:1450:4001:829::2003
80.208.252.166
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0cbd00bb9c49dd703f17c79cd6e01d1cd07aff489494a95011f53d8c8b1375ba
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
4943e91f7f53318d481ca07297395abbc52541c2be55d7276ecda152cd7ad9c3
b11094dd430a10783877e73b6aca41421ebc437a0fd34a3367206c1e9d5ee66e
c490eb752593f18b81749c2963d48e4b5ddfeb3e7b954bd1cb9cd24d9384960c
c6940305f3091aff172b121d30e319cb8b3f5560f82c46740ad9f37ca12c5e21
dc07c71a852f1a075ce4f1a3c82608d541b8f453161e6926ef28dde572410787
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef5a6e4fa75a0aa17d9cbb3ecf39bf184667192af66b1f5d25acbf6534649bc6
fb5a0aa1ead4b42aeabafe089ce9c3aa03e45eef43f2b629f8f2dfea2a1e3a6f

www.drugscreencorp.com Open in urlscan Pro 80.208.252.166 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

67 %HTTPS

50 %IPv6

6 Domains

6 Subdomains

4 IPs

3 Countries

866 kBTransfer

1604 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

1 Cookies

1 Console Messages

Security Headers

Indicators

www.drugscreencorp.com Open in urlscan Pro
80.208.252.166 Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

67 %
HTTPS

50 %
IPv6

6
Domains

6
Subdomains

4
IPs

3
Countries

866 kB
Transfer

1604 kB
Size

1
Cookies

15 HTTP transactions
0 data transactions