www.drugscreencorp.com Open in urlscan Pro
80.208.252.166 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.drugscreencorp.com/appointment/59EFW5S44AH2E6/validation?testid=76AG1212-574954
Effective URL:
https://www.drugscreencorp.com/badphish_notice.jspx?ident=59EFW5S44AH2E6&oto=4CD5770F101A3BACC549ABB95AE3F145BCC4A1F3
Submission: On April 16 via manual (April 16th 2024, 9:13:09 pm UTC) from US — Scanned from GB

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 6 domains to perform 15 HTTP transactions. The main IP is 80.208.252.166, located in United Kingdom and belongs to HYVE-MANAGED-HOSTING, US. The main domain is www.drugscreencorp.com.
TLS certificate: Issued by Thawte TLS RSA CA G1 on January 19th 2024. Valid for: a year.

This is the only time www.drugscreencorp.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
11	80.208.252.166 80.208.252.166	397964 (HYVE-MANA...) (HYVE-MANAGED-HOSTING)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
2	142.250.186.36 142.250.186.36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:806::2003	15169 (GOOGLE) (GOOGLE)
15	4

11 80.208.252.166 (United Kingdom)

ASN397964 (HYVE-MANAGED-HOSTING, US)

www.drugscreencorp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.stickleyonsecurity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.xlvut12po99xdpqw.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.36 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	drugscreencorp.com www.drugscreencorp.com	243 KB
4	xlvut12po99xdpqw.com www.xlvut12po99xdpqw.com	243 KB
2	google.com www.google.com — Cisco Umbrella Rank: 2	881 B
2	stickleyonsecurity.com www.stickleyonsecurity.com — Cisco Umbrella Rank: 589027	136 KB
1	gstatic.com www.gstatic.com	199 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 376	30 KB
15	6

	Domain	Requested by
5	www.drugscreencorp.com	www.drugscreencorp.com www.xlvut12po99xdpqw.com
4	www.xlvut12po99xdpqw.com	www.xlvut12po99xdpqw.com ajax.googleapis.com
2	www.google.com	www.xlvut12po99xdpqw.com www.gstatic.com
2	www.stickleyonsecurity.com	www.drugscreencorp.com www.xlvut12po99xdpqw.com
1	www.gstatic.com	www.google.com
1	ajax.googleapis.com	www.xlvut12po99xdpqw.com
15	6

This site contains no links.

Subject Issuer	Validity	Valid
stickleyonsecurity.com Thawte TLS RSA CA G1	`2024-01-19` - `2025-02-05`	a year	crt.sh
xlvut12po99xdpqw.com Thawte TLS RSA CA G1	`2023-03-29` - `2024-04-28`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
*.google.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://www.drugscreencorp.com/badphish_notice.jspx?ident=59EFW5S44AH2E6&oto=4CD5770F101A3BACC549ABB95AE3F145BCC4A1F3
Frame ID: 3C1B6544DA330C0774EAFDE256861E23
Requests: 14 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LepteEUAAAAAJwgAAo1eqAlarlFFpeO1O36hted&co=aHR0cHM6Ly93d3cueGx2dXQxMnBvOTl4ZHBxdy5jb206NDQz&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=invisible&cb=9qfef1v9emvf
Frame ID: 7E38D617648446C4EDED577FC47D63CA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.drugscreencorp.com/appointment/59EFW5S44AH2E6/validation?testid=76AG1212-574954 HTTP 307
https://www.drugscreencorp.com/appointment/59EFW5S44AH2E6/validation?testid=76AG1212-574954 Page URL
https://www.drugscreencorp.com/index2.jspx?/appointment/59EFW5S44AH2E6/validation&testid=76AG1212-574954 Page URL
https://www.xlvut12po99xdpqw.com/cc-index.jspx Page URL
https://www.drugscreencorp.com/badphish_notice.jspx?ident=59EFW5S44AH2E6&oto=4CD5770F101A3BACC549ABB95AE3F1... Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

15
Requests

67 %
HTTPS

50 %
IPv6

6
Domains

6
Subdomains

4
IPs

3
Countries

853 kB
Transfer

1565 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.drugscreencorp.com/appointment/59EFW5S44AH2E6/validation?testid=76AG1212-574954 HTTP 307
https://www.drugscreencorp.com/appointment/59EFW5S44AH2E6/validation?testid=76AG1212-574954 Page URL
https://www.drugscreencorp.com/index2.jspx?/appointment/59EFW5S44AH2E6/validation&testid=76AG1212-574954 Page URL
https://www.xlvut12po99xdpqw.com/cc-index.jspx Page URL
https://www.drugscreencorp.com/badphish_notice.jspx?ident=59EFW5S44AH2E6&oto=4CD5770F101A3BACC549ABB95AE3F145BCC4A1F3 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://www.drugscreencorp.com/appointment/59EFW5S44AH2E6/validation?testid=76AG1212-574954 HTTP 307
https://www.drugscreencorp.com/appointment/59EFW5S44AH2E6/validation?testid=76AG1212-574954

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

404
Not Found

validation
www.drugscreencorp.com/appointment/59EFW5S44AH2E6/
Redirect Chain

http://www.drugscreencorp.com/appointment/59EFW5S44AH2E6/validation?testid=76AG1212-574954
https://www.drugscreencorp.com/appointment/59EFW5S44AH2E6/validation?testid=76AG1212-574954

162 B
544 B

388ms
100ms

Document
text/html

80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://www.drugscreencorp.com/appointment/59EFW5S44AH2E6/validation?testid=76AG1212-574954

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),

Reverse DNS

Software

Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-GB,en;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 162
Content-Type: text/html
Date: Tue, 16 Apr 2024 21:13:04 GMT
ETag: "a2-5f73267a75bc0"
Keep-Alive: timeout=5, max=100
Last-Modified: Sat, 18 Mar 2023 20:19:03 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46
Strict-Transport-Security: max-age=31536000; includeSubDomains

Redirect headers

Location: https://www.drugscreencorp.com/appointment/59EFW5S44AH2E6/validation?testid=76AG1212-574954
Non-Authoritative-Reason: HttpsUpgrades

GET
H/1.1 200
OK index2.jspx Show response
www.drugscreencorp.com/ 605 B
720 B 113ms
113ms Document
text/html 80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://www.drugscreencorp.com/index2.jspx?/appointment/59EFW5S44AH2E6/validation&testid=76AG1212-574954

Requested by

Host: www.drugscreencorp.com
URL: https://www.drugscreencorp.com/appointment/59EFW5S44AH2E6/validation?testid=76AG1212-574954

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),

Reverse DNS

Software

Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /

Resource Hash

f874ea1704d00d17ee4965a669a33a27de91e90d5a2fe107f727b7cf1454597d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-GB,en;q=0.9;q=0.9
Referer: https://www.drugscreencorp.com/appointment/59EFW5S44AH2E6/validation?testid=76AG1212-574954
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Tue, 16 Apr 2024 21:13:04 GMT
Keep-Alive: timeout=5, max=99
Server: Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46
Strict-Transport-Security: max-age=31536000; includeSubDomains
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H/1.1 200
OK jquery-1.6-v2.js Show response
www.stickleyonsecurity.com/js/ 403 KB
106 KB 359ms
120ms Script
application/javascript 80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://www.stickleyonsecurity.com/js/jquery-1.6-v2.js

Requested by

Host: www.drugscreencorp.com
URL: https://www.drugscreencorp.com/index2.jspx?/appointment/59EFW5S44AH2E6/validation&testid=76AG1212-574954

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),

Reverse DNS

Software

Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /

Resource Hash

dc07c71a852f1a075ce4f1a3c82608d541b8f453161e6926ef28dde572410787

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.drugscreencorp.com/
Accept-Language: en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 16 Apr 2024 21:13:04 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Last-Modified: Tue, 04 Jan 2022 15:54:44 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46
ETag: "64d87-5d4c3a7e3f900-gzip"
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100

POST
H/1.1 200
OK cc-index.jspx Show response
www.xlvut12po99xdpqw.com/ 7 KB
3 KB 338ms
123ms Document
text/html 80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to

Full URL: https://www.xlvut12po99xdpqw.com/cc-index.jspx
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),
Reverse DNS
Software: Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /
Resource Hash: 4859bc57febfbe9ea7d6fb093ee4d558b5e995ba8035187ab99dad137e9654b7

Request headers

Accept-Language: en-GB,en;q=0.9;q=0.9
Content-Type: application/x-www-form-urlencoded
Origin: https://www.drugscreencorp.com
Referer: https://www.drugscreencorp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Tue, 16 Apr 2024 21:13:05 GMT
Keep-Alive: timeout=5, max=100
Server: Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H/1.1 200
OK jquery-compressed.js Show response
www.stickleyonsecurity.com/js/ 86 KB
30 KB 307ms
105ms Script
application/javascript 80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://www.stickleyonsecurity.com/js/jquery-compressed.js

Requested by

Host: www.xlvut12po99xdpqw.com
URL: https://www.xlvut12po99xdpqw.com/cc-index.jspx

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),

Reverse DNS

Software

Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.xlvut12po99xdpqw.com/
Accept-Language: en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 16 Apr 2024 21:13:05 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Last-Modified: Wed, 26 Aug 2020 17:07:05 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46
ETag: "15851-5adcad9586040-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 30677

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 85 KB
30 KB 148ms
45ms Script
text/javascript 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

Requested by

Host: www.xlvut12po99xdpqw.com
URL: https://www.xlvut12po99xdpqw.com/cc-index.jspx

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.xlvut12po99xdpqw.com/
Accept-Language: en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 15 Apr 2024 00:14:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 161930
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30399
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 15 Apr 2025 00:14:15 GMT

GET
H3 200 api.js Show response
www.google.com/recaptcha/ 1 KB
881 B 145ms
55ms Script
text/javascript 142.250.186.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?render=6LepteEUAAAAAJwgAAo1eqAlarlFFpeO1O36hted

Requested by

Host: www.xlvut12po99xdpqw.com
URL: https://www.xlvut12po99xdpqw.com/cc-index.jspx

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.36 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f4.1e100.net

Software

GSE /

Resource Hash

da01afe3232340037766250723779be270f475e2d986cda5dd969207e0a4a94f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.xlvut12po99xdpqw.com/
Accept-Language: en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 21:13:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Tue, 16 Apr 2024 21:13:05 GMT

GET
H/1.1 200
OK badphish-logo-lantern2.png
www.xlvut12po99xdpqw.com/images/ 238 KB
238 KB 100ms
100ms Image
image/png 80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.xlvut12po99xdpqw.com/images/badphish-logo-lantern2.png
Requested by: Host: www.xlvut12po99xdpqw.com
URL: https://www.xlvut12po99xdpqw.com/cc-index.jspx
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),
Reverse DNS
Software: Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /
Resource Hash: fb5a0aa1ead4b42aeabafe089ce9c3aa03e45eef43f2b629f8f2dfea2a1e3a6f

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.xlvut12po99xdpqw.com/cc-index.jspx
Accept-Language: en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 16 Apr 2024 21:13:05 GMT
Last-Modified: Wed, 18 Nov 2015 18:20:12 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46
ETag: "3b71b-524d4b16e0f00"
Content-Type: image/png
Cache-Control: max-age=5184000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 243483
Expires: Sat, 15 Jun 2024 21:13:05 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/ 499 KB
199 KB 146ms
45ms Script
text/javascript 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6LepteEUAAAAAJwgAAo1eqAlarlFFpeO1O36hted

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f2c6777c7ccc01ab67290fa8acd5a4c4866be64129f39dfaeb9197dfa15e137

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.xlvut12po99xdpqw.com/
Origin: https://www.xlvut12po99xdpqw.com
Accept-Language: en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 20:35:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2284
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 203369
x-xss-protection: 0
last-modified: Fri, 29 Mar 2024 04:30:36 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 16 Apr 2025 20:35:02 GMT

GET
H3 200 anchor
www.google.com/recaptcha/api2/ Frame 7E38 0
0 158ms
72ms Document
text/html 142.250.186.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LepteEUAAAAAJwgAAo1eqAlarlFFpeO1O36hted&co=aHR0cHM6Ly93d3cueGx2dXQxMnBvOTl4ZHBxdy5jb206NDQz&hl=en&v=rz4DvU-cY2JYCwHSTck0_qm-&size=invisible&cb=9qfef1v9emvf

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/rz4DvU-cY2JYCwHSTck0_qm-/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.36 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f4.1e100.net

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-I0atDOM6ts7-HKhLVd5maw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-GB,en;q=0.9;q=0.9
Referer: https://www.xlvut12po99xdpqw.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-I0atDOM6ts7-HKhLVd5maw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 16 Apr 2024 21:13:06 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK favicon.ico
www.xlvut12po99xdpqw.com/ 1 KB
1 KB 99ms
99ms Other
image/x-icon 80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to

Full URL: https://www.xlvut12po99xdpqw.com/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),
Reverse DNS
Software: Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /
Resource Hash: c6940305f3091aff172b121d30e319cb8b3f5560f82c46740ad9f37ca12c5e21

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.xlvut12po99xdpqw.com/cc-index.jspx
Accept-Language: en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 16 Apr 2024 21:13:07 GMT
Content-Encoding: gzip
Last-Modified: Wed, 08 Feb 2017 15:11:46 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46
ETag: "47e-5480648723080-gzip"
Vary: Accept-Encoding
Content-Type: image/x-icon
Cache-Control: max-age=31104000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 747
Expires: Fri, 11 Apr 2025 21:13:07 GMT

POST
H/1.1 200
OK bp_end.jspx Show response
www.xlvut12po99xdpqw.com/ 0
324 B 240ms
240ms XHR
text/html 80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to

Full URL: https://www.xlvut12po99xdpqw.com/bp_end.jspx
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),
Reverse DNS
Software: Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept-Language: en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: */*
Referer: https://www.xlvut12po99xdpqw.com/cc-index.jspx
X-Requested-With: XMLHttpRequest
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 16 Apr 2024 21:13:07 GMT
Content-Encoding: gzip
Server: Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/html;charset=UTF-8
Connection: Keep-Alive
Keep-Alive: timeout=5, max=97

GET
H/1.1 200
OK Primary Request badphish_notice.jspx Show response
www.drugscreencorp.com/ 5 KB
2 KB 108ms
108ms Document
text/html 80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://www.drugscreencorp.com/badphish_notice.jspx?ident=59EFW5S44AH2E6&oto=4CD5770F101A3BACC549ABB95AE3F145BCC4A1F3

Requested by

Host: www.xlvut12po99xdpqw.com
URL: https://www.xlvut12po99xdpqw.com/cc-index.jspx

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),

Reverse DNS

Software

Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /

Resource Hash

ef5a6e4fa75a0aa17d9cbb3ecf39bf184667192af66b1f5d25acbf6534649bc6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-GB,en;q=0.9;q=0.9
Referer: https://www.xlvut12po99xdpqw.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Tue, 16 Apr 2024 21:13:07 GMT
Keep-Alive: timeout=5, max=98
Server: Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46
Strict-Transport-Security: max-age=31536000; includeSubDomains
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H/1.1 200
OK badphish-logo-lantern2.png
www.drugscreencorp.com/images/ 238 KB
238 KB 109ms
100ms Image
image/png 80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.drugscreencorp.com/images/badphish-logo-lantern2.png

Requested by

Host: www.drugscreencorp.com
URL: https://www.drugscreencorp.com/badphish_notice.jspx?ident=59EFW5S44AH2E6&oto=4CD5770F101A3BACC549ABB95AE3F145BCC4A1F3

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),

Reverse DNS

Software

Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /

Resource Hash

fb5a0aa1ead4b42aeabafe089ce9c3aa03e45eef43f2b629f8f2dfea2a1e3a6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.drugscreencorp.com/badphish_notice.jspx?ident=59EFW5S44AH2E6&oto=4CD5770F101A3BACC549ABB95AE3F145BCC4A1F3
Accept-Language: en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 16 Apr 2024 21:13:07 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Wed, 18 Nov 2015 18:20:12 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46
ETag: "3b71b-524d4b16e0f00"
Content-Type: image/png
Cache-Control: max-age=5184000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 243483
Expires: Sat, 15 Jun 2024 21:13:07 GMT

GET
H/1.1 200
OK favicon.ico
www.drugscreencorp.com/ 1 KB
1 KB 101ms
100ms Other
image/x-icon 80.208.252.166
HYVE-MANAGED-HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://www.drugscreencorp.com/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

80.208.252.166 , United Kingdom, ASN397964 (HYVE-MANAGED-HOSTING, US),

Reverse DNS

Software

Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46 /

Resource Hash

c6940305f3091aff172b121d30e319cb8b3f5560f82c46740ad9f37ca12c5e21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.drugscreencorp.com/badphish_notice.jspx?ident=59EFW5S44AH2E6&oto=4CD5770F101A3BACC549ABB95AE3F145BCC4A1F3
Accept-Language: en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 16 Apr 2024 21:13:08 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Last-Modified: Wed, 08 Feb 2017 15:11:46 GMT
Server: Apache/2.4.58 (Unix) OpenSSL/3.0.13 mod_jk/1.2.46
ETag: "47e-5480648723080-gzip"
Vary: Accept-Encoding
Content-Type: image/x-icon
Cache-Control: max-age=31104000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 747
Expires: Fri, 11 Apr 2025 21:13:08 GMT

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.google.com/recaptcha	1970-01-21 00:14:13	Name: _GRECAPTCHA Value: 09AH0dGfTlSBXJlZNEEtU5wZlcV0_oR4X_MAY4ZZY7O39VIzl5l5Ftok8BpbAJVtAIa_4QJ_dIrZcV_OyU8I_Mu8U

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.drugscreencorp.com/appointment/59EFW5S44AH2E6/validation?testid=76AG1212-574954 Message: Failed to load resource: the server responded with a status of 404 (Not Found)
other	warning	URL: https://www.xlvut12po99xdpqw.com/cc-index.jspx Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.xlvut12po99xdpqw.com/cc-index.jspx Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
www.drugscreencorp.com
www.google.com
www.gstatic.com
www.stickleyonsecurity.com
www.xlvut12po99xdpqw.com
142.250.186.36
2a00:1450:4001:806::2003
2a00:1450:4001:80b::200a
80.208.252.166
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
4859bc57febfbe9ea7d6fb093ee4d558b5e995ba8035187ab99dad137e9654b7
8f2c6777c7ccc01ab67290fa8acd5a4c4866be64129f39dfaeb9197dfa15e137
c6940305f3091aff172b121d30e319cb8b3f5560f82c46740ad9f37ca12c5e21
da01afe3232340037766250723779be270f475e2d986cda5dd969207e0a4a94f
dc07c71a852f1a075ce4f1a3c82608d541b8f453161e6926ef28dde572410787
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef5a6e4fa75a0aa17d9cbb3ecf39bf184667192af66b1f5d25acbf6534649bc6
f874ea1704d00d17ee4965a669a33a27de91e90d5a2fe107f727b7cf1454597d
fb5a0aa1ead4b42aeabafe089ce9c3aa03e45eef43f2b629f8f2dfea2a1e3a6f

www.drugscreencorp.com Open in urlscan Pro 80.208.252.166 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

67 %HTTPS

50 %IPv6

6 Domains

6 Subdomains

4 IPs

3 Countries

853 kBTransfer

1565 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

1 Cookies

3 Console Messages

Security Headers

Indicators

www.drugscreencorp.com Open in urlscan Pro
80.208.252.166 Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

67 %
HTTPS

50 %
IPv6

6
Domains

6
Subdomains

4
IPs

3
Countries

853 kB
Transfer

1565 kB
Size

1
Cookies

15 HTTP transactions
0 data transactions