xip.labcorp.com Open in urlscan Pro
162.134.132.22  Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login Show response xip.labcorp.com/	4 KB 3 KB	629ms 133ms	Document text/html	162.134.132.22 LABCORP-DRUG-DEVE...
General Check archive.org Show headers Download Go to Full URL https://xip.labcorp.com/login?returnUrl=%2F Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.134.132.22 , United States, ASN18994 (LABCORP-DRUG-DEVELOPMENT-COVANCE, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash 7ae3e3e479e8ae864d849f285145ab7023b7521e69bacf798a5814ce9b9ea901 Security Headers Name Value Content-Security-Policy default-src *; script-src * 'self' data: 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; font-src * data: ; style-src 'self' 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; img-src * 'self' data:; upgrade-insecure-requests Strict-Transport-Security max-age=31536000; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0; Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control public, max-age=0,no-cache, no-store, must-revalidate Content-Encoding gzip Content-Length 1738 Content-Security-Policy default-src *; script-src * 'self' data: 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; font-src * data: ; style-src 'self' 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; img-src * 'self' data:; upgrade-insecure-requests Content-Type text/html; charset=utf-8 Date Wed, 05 Apr 2023 13:38:56 GMT Expires Wed, 05 Apr 2023 13:38:56 GMT,0 Last-Modified Wed, 05 Apr 2023 13:38:56 GMT Permissions-Policy geolocation=(self) Pragma no-cache Referrer-Policy no-referrer Server Microsoft-IIS/8.5 Strict-Transport-Security max-age=31536000; includeSubdomains Vary * X-Content-Type-Options nosniff X-Frame-Options DENY X-Permitted-Cross-Domain-Policies none X-UA-Compatible IE=edge X-XSS-Protection 0;
GET H/1.1	200 OK	vendor.js Show response xip.labcorp.com/build/	7 MB 2 MB	543ms 543ms	Script application/javascript	162.134.132.22 LABCORP-DRUG-DEVE...
General Check archive.org Show headers Download Go to Full URL https://xip.labcorp.com/build/vendor.js?v=maGBzMlfAAdybqF-i-9MyMAI3D6PorwEjPPpDeYQ_ao1 Requested by Host: xip.labcorp.com URL: https://xip.labcorp.com/login?returnUrl=%2F Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.134.132.22 , United States, ASN18994 (LABCORP-DRUG-DEVELOPMENT-COVANCE, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash 2a964bd846ec99f24ba0b7da53cabd6adc2dedfdd59c96513be4f2b1bb952358 Security Headers Name Value Content-Security-Policy default-src *; script-src * 'self' data: 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; font-src * data: ; style-src 'self' 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; img-src * 'self' data:; upgrade-insecure-requests Strict-Transport-Security max-age=31536000; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0; Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubdomains Content-Encoding gzip X-Content-Type-Options nosniff Content-Security-Policy default-src *; script-src * 'self' data: 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; font-src * data: ; style-src 'self' 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; img-src * 'self' data:; upgrade-insecure-requests X-Permitted-Cross-Domain-Policies none Date Wed, 05 Apr 2023 13:38:56 GMT Content-Length 1906926 X-XSS-Protection 0; X-UA-Compatible IE=edge Pragma no-cache Referrer-Policy no-referrer Last-Modified Tue, 01 Nov 2022 15:24:56 GMT Server Microsoft-IIS/8.5 ETag "0d4c1186eed81:0" Vary Accept-Encoding X-Frame-Options DENY Content-Type application/javascript Cache-Control no-cache, no-store, must-revalidate Permissions-Policy geolocation=(self) Accept-Ranges bytes Expires 0
GET H/1.1	200 OK	app.js Show response xip.labcorp.com/build/	2 MB 299 KB	390ms 132ms	Script application/javascript	162.134.132.22 LABCORP-DRUG-DEVE...
General Check archive.org Show headers Download Go to Full URL https://xip.labcorp.com/build/app.js?v=4yZsxzULDJupdslq1DHmtR8qC74sQ51m8vU0sPtK-pQ1 Requested by Host: xip.labcorp.com URL: https://xip.labcorp.com/login?returnUrl=%2F Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.134.132.22 , United States, ASN18994 (LABCORP-DRUG-DEVELOPMENT-COVANCE, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash ea0aa901aaca02d02aadaa0ee78dc06dcd2d94faf6959d4c49cb277c130355b1 Security Headers Name Value Content-Security-Policy default-src *; script-src * 'self' data: 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; font-src * data: ; style-src 'self' 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; img-src * 'self' data:; upgrade-insecure-requests Strict-Transport-Security max-age=31536000; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0; Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubdomains Content-Encoding gzip X-Content-Type-Options nosniff Content-Security-Policy default-src *; script-src * 'self' data: 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; font-src * data: ; style-src 'self' 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; img-src * 'self' data:; upgrade-insecure-requests X-Permitted-Cross-Domain-Policies none Date Wed, 05 Apr 2023 13:38:56 GMT Content-Length 305527 X-XSS-Protection 0; X-UA-Compatible IE=edge Pragma no-cache Referrer-Policy no-referrer Last-Modified Tue, 01 Nov 2022 15:24:56 GMT Server Microsoft-IIS/8.5 ETag "0d4c1186eed81:0" Vary Accept-Encoding X-Frame-Options DENY Content-Type application/javascript Cache-Control no-cache, no-store, must-revalidate Permissions-Policy geolocation=(self) Accept-Ranges bytes Expires 0
OPTIONS H2	200	me covance.okta.com/api/v1/sessions/	0 0	356ms 128ms	Preflight	15.197.242.105 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://covance.okta.com/api/v1/sessions/me Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 15.197.242.105 , United States, ASN16509 (AMAZON-02, US), Reverse DNS a89c2f8ab8ab01436.awsglobalaccelerator.com Software nginx / Resource Hash Security Headers Name Value Content-Security-Policy default-src 'self' covance.okta.com *.oktacdn.com; connect-src 'self' covance.okta.com covance-admin.okta.com *.oktacdn.com *.mixpanel.com *.mapbox.com app.pendo.io data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com *.mtls.okta.com covance.kerberos.okta.com https://oinmanager.okta.com data:; script-src 'unsafe-inline' 'unsafe-eval' 'self' covance.okta.com *.oktacdn.com; style-src 'unsafe-inline' 'self' covance.okta.com *.oktacdn.com app.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; frame-src 'self' covance.okta.com covance-admin.okta.com login.okta.com; img-src 'self' covance.okta.com *.oktacdn.com *.tiles.mapbox.com *.mapbox.com app.pendo.io data.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com data: blob:; font-src 'self' covance.okta.com data: *.oktacdn.com fonts.gstatic.com Strict-Transport-Security max-age=315360000; includeSubDomains X-Xss-Protection 0 Request headers Accept */* Access-Control-Request-Headers content-type,x-okta-user-agent-extended Access-Control-Request-Method GET Origin https://xip.labcorp.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-okta-user-agent-extended,Content-Type access-control-allow-methods DELETE, GET, OPTIONS access-control-allow-origin https://xip.labcorp.com access-control-max-age 3600 allow GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH cache-control no-cache, no-store content-length 0 content-security-policy default-src 'self' covance.okta.com *.oktacdn.com; connect-src 'self' covance.okta.com covance-admin.okta.com *.oktacdn.com *.mixpanel.com *.mapbox.com app.pendo.io data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com *.mtls.okta.com covance.kerberos.okta.com https://oinmanager.okta.com data:; script-src 'unsafe-inline' 'unsafe-eval' 'self' covance.okta.com *.oktacdn.com; style-src 'unsafe-inline' 'self' covance.okta.com *.oktacdn.com app.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; frame-src 'self' covance.okta.com covance-admin.okta.com login.okta.com; img-src 'self' covance.okta.com *.oktacdn.com *.tiles.mapbox.com *.mapbox.com app.pendo.io data.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com data: blob:; font-src 'self' covance.okta.com data: *.oktacdn.com fonts.gstatic.com content-security-policy-report-only default-src 'self' covance.okta.com *.oktacdn.com; connect-src 'self' covance.okta.com covance-admin.okta.com *.oktacdn.com *.mixpanel.com *.mapbox.com app.pendo.io data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com *.mtls.okta.com covance.kerberos.okta.com https://oinmanager.okta.com data:; script-src 'unsafe-inline' 'unsafe-eval' 'self' covance.okta.com *.oktacdn.com; style-src 'unsafe-inline' 'self' covance.okta.com *.oktacdn.com app.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; frame-src 'self' covance.okta.com covance-admin.okta.com login.okta.com; img-src 'self' covance.okta.com *.oktacdn.com *.tiles.mapbox.com *.mapbox.com app.pendo.io data.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com data: blob:; font-src 'self' covance.okta.com data: *.oktacdn.com fonts.gstatic.com; frame-ancestors 'self' date Wed, 05 Apr 2023 13:39:03 GMT expires 0 p3p CP="HONK" pragma no-cache public-key-pins-report-only pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly" server nginx strict-transport-security max-age=315360000; includeSubDomains vary Origin x-okta-request-id ZC1596FSxYFeLLKkJZBIegAADdc x-rate-limit-limit 50000 x-rate-limit-remaining 49997 x-rate-limit-reset 1680702003 x-xss-protection 0
GET H2	404	me Show response covance.okta.com/api/v1/sessions/	168 B 3 KB	316ms 126ms	Fetch application/json	15.197.242.105 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://covance.okta.com/api/v1/sessions/me Requested by Host: xip.labcorp.com URL: https://xip.labcorp.com/build/vendor.js?v=maGBzMlfAAdybqF-i-9MyMAI3D6PorwEjPPpDeYQ_ao1 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 15.197.242.105 , United States, ASN16509 (AMAZON-02, US), Reverse DNS a89c2f8ab8ab01436.awsglobalaccelerator.com Software nginx / Resource Hash 0badd9ab8bf5edd707e91be687011bac2b8f80297fe36d58f40cc1631fa2cc24 Security Headers Name Value Content-Security-Policy default-src 'self' covance.okta.com *.oktacdn.com; connect-src 'self' covance.okta.com covance-admin.okta.com *.oktacdn.com *.mixpanel.com *.mapbox.com app.pendo.io data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com *.mtls.okta.com covance.kerberos.okta.com https://oinmanager.okta.com data:; script-src 'unsafe-inline' 'unsafe-eval' 'self' covance.okta.com *.oktacdn.com; style-src 'unsafe-inline' 'self' covance.okta.com *.oktacdn.com app.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; frame-src 'self' covance.okta.com covance-admin.okta.com login.okta.com; img-src 'self' covance.okta.com *.oktacdn.com *.tiles.mapbox.com *.mapbox.com app.pendo.io data.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com data: blob:; font-src 'self' covance.okta.com data: *.oktacdn.com fonts.gstatic.com Strict-Transport-Security max-age=315360000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept application/json Referer X-Okta-User-Agent-Extended okta-auth-js/5.0.1 accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Content-Type application/json Response headers x-okta-request-id ZC15-CCOqZRNZLf_JopGEgAADCg date Wed, 05 Apr 2023 13:39:04 GMT content-security-policy default-src 'self' covance.okta.com *.oktacdn.com; connect-src 'self' covance.okta.com covance-admin.okta.com *.oktacdn.com *.mixpanel.com *.mapbox.com app.pendo.io data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com *.mtls.okta.com covance.kerberos.okta.com https://oinmanager.okta.com data:; script-src 'unsafe-inline' 'unsafe-eval' 'self' covance.okta.com *.oktacdn.com; style-src 'unsafe-inline' 'self' covance.okta.com *.oktacdn.com app.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; frame-src 'self' covance.okta.com covance-admin.okta.com login.okta.com; img-src 'self' covance.okta.com *.oktacdn.com *.tiles.mapbox.com *.mapbox.com app.pendo.io data.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com data: blob:; font-src 'self' covance.okta.com data: *.oktacdn.com fonts.gstatic.com x-rate-limit-limit 3750 x-content-type-options nosniff content-encoding gzip x-rate-limit-remaining 3720 strict-transport-security max-age=315360000; includeSubDomains content-security-policy-report-only default-src 'self' covance.okta.com *.oktacdn.com; connect-src 'self' covance.okta.com covance-admin.okta.com *.oktacdn.com *.mixpanel.com *.mapbox.com app.pendo.io data.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com *.mtls.okta.com covance.kerberos.okta.com https://oinmanager.okta.com data:; script-src 'unsafe-inline' 'unsafe-eval' 'self' covance.okta.com *.oktacdn.com; style-src 'unsafe-inline' 'self' covance.okta.com *.oktacdn.com app.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com; frame-src 'self' covance.okta.com covance-admin.okta.com login.okta.com; img-src 'self' covance.okta.com *.oktacdn.com *.tiles.mapbox.com *.mapbox.com app.pendo.io data.pendo.io cdn.pendo.io pendo-static-5634101834153984.storage.googleapis.com pendo-static-5391521872216064.storage.googleapis.com data: blob:; font-src 'self' covance.okta.com data: *.oktacdn.com fonts.gstatic.com; frame-ancestors 'self' p3p CP="HONK" x-xss-protection 0 pragma no-cache server nginx vary Accept-Encoding,Origin content-type application/json access-control-allow-origin https://xip.labcorp.com public-key-pins-report-only pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly" x-rate-limit-reset 1680701962 access-control-allow-credentials true cache-control no-cache, no-store access-control-allow-headers Content-Type expires 0
GET H/1.1	200 OK	OpenSans-Regular.woff xip.labcorp.com/build/fonts/	62 KB 63 KB	137ms 136ms	Font application/font-woff	162.134.132.22 LABCORP-DRUG-DEVE...
General Check archive.org Show headers Download Go to Full URL https://xip.labcorp.com/build/fonts/OpenSans-Regular.woff Requested by Host: xip.labcorp.com URL: https://xip.labcorp.com/login?returnUrl=%2F Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.134.132.22 , United States, ASN18994 (LABCORP-DRUG-DEVELOPMENT-COVANCE, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash 2e1587380141daff4e10a8e3db8f7ae5887102ab7576bff43049590f637ac20b Security Headers Name Value Content-Security-Policy default-src *; script-src * 'self' data: 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; font-src * data: ; style-src 'self' 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; img-src * 'self' data:; upgrade-insecure-requests Strict-Transport-Security max-age=31536000; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0; Request headers Referer https://xip.labcorp.com/login?returnUrl=%2F Origin https://xip.labcorp.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubdomains Content-Security-Policy default-src *; script-src * 'self' data: 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; font-src * data: ; style-src 'self' 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; img-src * 'self' data:; upgrade-insecure-requests X-Content-Type-Options nosniff Date Wed, 05 Apr 2023 13:39:02 GMT X-Permitted-Cross-Domain-Policies none Content-Length 63712 X-XSS-Protection 0; X-UA-Compatible IE=edge Pragma no-cache Referrer-Policy no-referrer Last-Modified Tue, 01 Nov 2022 15:24:58 GMT Server Microsoft-IIS/8.5 ETag "01f3196eed81:0" X-Frame-Options DENY Content-Type application/font-woff Cache-Control no-cache, no-store, must-revalidate Permissions-Policy geolocation=(self) Accept-Ranges bytes Expires 0
GET H/1.1	200 OK	logo.png xip.labcorp.com/images/	4 KB 5 KB	131ms 131ms	Image image/png	162.134.132.22 LABCORP-DRUG-DEVE...
General Check archive.org Show headers Download Go to Show image Full URL https://xip.labcorp.com/images/logo.png Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.134.132.22 , United States, ASN18994 (LABCORP-DRUG-DEVELOPMENT-COVANCE, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash 3408962ce8469a8bc9cf77a36f313682248746b4e76e9ecd18dca4ae1f354cf3 Security Headers Name Value Content-Security-Policy default-src *; script-src * 'self' data: 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; font-src * data: ; style-src 'self' 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; img-src * 'self' data:; upgrade-insecure-requests Strict-Transport-Security max-age=31536000; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0; Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubdomains Content-Security-Policy default-src *; script-src * 'self' data: 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; font-src * data: ; style-src 'self' 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; img-src * 'self' data:; upgrade-insecure-requests X-Content-Type-Options nosniff Date Wed, 05 Apr 2023 13:39:04 GMT X-Permitted-Cross-Domain-Policies none Content-Length 4430 X-XSS-Protection 0; X-UA-Compatible IE=edge Pragma no-cache Referrer-Policy no-referrer Last-Modified Tue, 01 Nov 2022 15:12:22 GMT Server Microsoft-IIS/8.5 ETag "08f56574eed81:0" X-Frame-Options DENY Content-Type image/png Cache-Control no-cache, no-store, must-revalidate Permissions-Policy geolocation=(self) Accept-Ranges bytes Expires 0
GET H/1.1	200 OK	checkbox-sign-in-widget.png xip.labcorp.com/build/fonts/	3 KB 4 KB	130ms 130ms	Image image/png	162.134.132.22 LABCORP-DRUG-DEVE...
General Check archive.org Show headers Download Go to Show image Full URL https://xip.labcorp.com/build/fonts/checkbox-sign-in-widget.png Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.134.132.22 , United States, ASN18994 (LABCORP-DRUG-DEVELOPMENT-COVANCE, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash 40810b0318131f9ba52c83a17e633a0ac476ade66ea8a914d6c4980571397665 Security Headers Name Value Content-Security-Policy default-src *; script-src * 'self' data: 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; font-src * data: ; style-src 'self' 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; img-src * 'self' data:; upgrade-insecure-requests Strict-Transport-Security max-age=31536000; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0; Request headers accept-language de-DE,de;q=0.9 Referer https://xip.labcorp.com/login?returnUrl=%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubdomains Content-Security-Policy default-src *; script-src * 'self' data: 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; font-src * data: ; style-src 'self' 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; img-src * 'self' data:; upgrade-insecure-requests X-Content-Type-Options nosniff Date Wed, 05 Apr 2023 13:39:03 GMT X-Permitted-Cross-Domain-Policies none Content-Length 3141 X-XSS-Protection 0; X-UA-Compatible IE=edge Pragma no-cache Referrer-Policy no-referrer Last-Modified Tue, 01 Nov 2022 15:24:58 GMT Server Microsoft-IIS/8.5 ETag "01f3196eed81:0" X-Frame-Options DENY Content-Type image/png Cache-Control no-cache, no-store, must-revalidate Permissions-Policy geolocation=(self) Accept-Ranges bytes Expires 0
GET H/1.1	200 OK	montserrat-regular-webfont.woff xip.labcorp.com/build/fonts/	21 KB 22 KB	240ms 130ms	Font application/font-woff	162.134.132.22 LABCORP-DRUG-DEVE...
General Check archive.org Show headers Download Go to Full URL https://xip.labcorp.com/build/fonts/montserrat-regular-webfont.woff Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.134.132.22 , United States, ASN18994 (LABCORP-DRUG-DEVELOPMENT-COVANCE, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash 1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3 Security Headers Name Value Content-Security-Policy default-src *; script-src * 'self' data: 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; font-src * data: ; style-src 'self' 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; img-src * 'self' data:; upgrade-insecure-requests Strict-Transport-Security max-age=31536000; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0; Request headers Referer https://xip.labcorp.com/login?returnUrl=%2F Origin https://xip.labcorp.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubdomains Content-Security-Policy default-src *; script-src * 'self' data: 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; font-src * data: ; style-src 'self' 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; img-src * 'self' data:; upgrade-insecure-requests X-Content-Type-Options nosniff Date Wed, 05 Apr 2023 13:39:03 GMT X-Permitted-Cross-Domain-Policies none Content-Length 21980 X-XSS-Protection 0; X-UA-Compatible IE=edge Pragma no-cache Referrer-Policy no-referrer Last-Modified Tue, 01 Nov 2022 15:24:58 GMT Server Microsoft-IIS/8.5 ETag "01f3196eed81:0" X-Frame-Options DENY Content-Type application/font-woff Cache-Control no-cache, no-store, must-revalidate Permissions-Policy geolocation=(self) Accept-Ranges bytes Expires 0
GET H/1.1	200 OK	montserrat-light-webfont.woff xip.labcorp.com/build/fonts/	22 KB 22 KB	261ms 132ms	Font application/font-woff	162.134.132.22 LABCORP-DRUG-DEVE...
General Check archive.org Show headers Download Go to Full URL https://xip.labcorp.com/build/fonts/montserrat-light-webfont.woff Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.134.132.22 , United States, ASN18994 (LABCORP-DRUG-DEVELOPMENT-COVANCE, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace Security Headers Name Value Content-Security-Policy default-src *; script-src * 'self' data: 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; font-src * data: ; style-src 'self' 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; img-src * 'self' data:; upgrade-insecure-requests Strict-Transport-Security max-age=31536000; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0; Request headers Referer https://xip.labcorp.com/login?returnUrl=%2F Origin https://xip.labcorp.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubdomains Content-Security-Policy default-src *; script-src * 'self' data: 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; font-src * data: ; style-src 'self' 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; img-src * 'self' data:; upgrade-insecure-requests X-Content-Type-Options nosniff Date Wed, 05 Apr 2023 13:39:04 GMT X-Permitted-Cross-Domain-Policies none Content-Length 22112 X-XSS-Protection 0; X-UA-Compatible IE=edge Pragma no-cache Referrer-Policy no-referrer Last-Modified Tue, 01 Nov 2022 15:24:58 GMT Server Microsoft-IIS/8.5 ETag "01f3196eed81:0" X-Frame-Options DENY Content-Type application/font-woff Cache-Control no-cache, no-store, must-revalidate Permissions-Policy geolocation=(self) Accept-Ranges bytes Expires 0

82 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| esaSettings object| webpackJsonp object| core object| __core-js_shared__ object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate function| Dict function| delay function| _ function| Zone function| __zone_symbol__Promise function| __zone_symbol__ZoneAwarePromise function| __zone_symbol__setTimeout function| __zone_symbol__clearTimeout function| __zone_symbol__setInterval function| __zone_symbol__clearInterval function| __zone_symbol__setImmediate function| __zone_symbol__clearImmediate function| __zone_symbol__requestAnimationFrame function| __zone_symbol__cancelAnimationFrame function| __zone_symbol__webkitRequestAnimationFrame function| __zone_symbol__webkitCancelAnimationFrame function| __zone_symbol__alert function| __zone_symbol__prompt function| __zone_symbol__confirm function| __zone_symbol__MutationObserver function| __zone_symbol__WebKitMutationObserver function| __zone_symbol__IntersectionObserver function| __zone_symbol__FileReader object| ng object| ngDevMode object| regeneratorRuntime object| componentHandler object| __zone_symbol__loadfalse function| MaterialButton function| MaterialCheckbox function| MaterialIconToggle function| MaterialMenu function| MaterialProgress function| MaterialRadio function| MaterialSlider function| MaterialSnackbar function| MaterialSpinner function| MaterialSwitch function| MaterialTabs function| MaterialTextfield function| MaterialTooltip function| MaterialLayout function| MaterialLayoutTab function| MaterialDataTable function| MaterialRipple object| d3 object| science number| science_stats_distribution_gaussianConstant object| topojson function| polylabel object| d3Contour object| d3Geo function| requestAnimFrame object| cv object| cptable object| Backbone function| jQueryCourage object| u2f object| __zone_symbol__popstatefalse object| __zone_symbol__hashchangefalse function| getAngularTestability function| getAllAngularTestabilities function| getAllAngularRootElements object| frameworkStabilizers object| __zone_symbol__pageshowfalse function| __zone_symbol__addEventListener function| __zone_symbol__removeEventListener undefined| __zone_symbol__eventListeners undefined| __zone_symbol__removeAllListeners function| eventListeners function| removeAllListeners

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://covance.okta.com/api/v1/sessions/me Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src *; script-src * 'self' data: 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; font-src * data: ; style-src 'self' 'unsafe-eval' 'unsafe-inline' 'unsafe-hashes'; img-src * 'self' data:; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

covance.okta.com
xip.labcorp.com
15.197.242.105
162.134.132.22
0badd9ab8bf5edd707e91be687011bac2b8f80297fe36d58f40cc1631fa2cc24
1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3
2a964bd846ec99f24ba0b7da53cabd6adc2dedfdd59c96513be4f2b1bb952358
2e1587380141daff4e10a8e3db8f7ae5887102ab7576bff43049590f637ac20b
3408962ce8469a8bc9cf77a36f313682248746b4e76e9ecd18dca4ae1f354cf3
40810b0318131f9ba52c83a17e633a0ac476ade66ea8a914d6c4980571397665
7ae3e3e479e8ae864d849f285145ab7023b7521e69bacf798a5814ce9b9ea901
ea0aa901aaca02d02aadaa0ee78dc06dcd2d94faf6959d4c49cb277c130355b1
feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace