healthcareservices.top Open in urlscan Pro
91.234.99.78  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response healthcareservices.top/PDF/	3 KB 4 KB	205ms 50ms	Document text/html	91.234.99.78 PIHL-AS
General Check archive.org Show headers Download Go to Full URL https://healthcareservices.top/PDF/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.234.99.78 , Netherlands, ASN213058 (PIHL-AS, RU), Reverse DNS Software Apache / Resource Hash d9e766c75e48f6bdbb1b12b0eb9ea5fa9b2524b00b1c3d8373d74fa9c4ec1012 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Tue, 31 May 2022 23:24:48 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked
GET		image.png s24.postimg.org/wlcz4rhyd/	0 0
GET H/1.1	200 OK	destination_6459423e6d3287c0279b9a95fd98206b.jpg healthcareservices.top/PDF/images/	17 KB 17 KB	50ms 50ms	Image image/jpeg	91.234.99.78 PIHL-AS
General Check archive.org Show headers Download Go to Show image Full URL https://healthcareservices.top/PDF/images/destination_6459423e6d3287c0279b9a95fd98206b.jpg Requested by Host: healthcareservices.top URL: https://healthcareservices.top/PDF/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.234.99.78 , Netherlands, ASN213058 (PIHL-AS, RU), Reverse DNS Software Apache / Resource Hash 30191280dc4c3a43f3f3fefa3698eef441974c66cea0f977debb335ec12255d8 Request headers accept-language nl-NL,nl;q=0.9 Referer https://healthcareservices.top/PDF/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Tue, 31 May 2022 23:24:48 GMT Last-Modified Sat, 24 Aug 2013 05:02:50 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 17117
GET H2	200	ga.js Show response ssl.google-analytics.com/	45 KB 17 KB	93ms 19ms	Script text/javascript	2a00:1450:4001:812::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ssl.google-analytics.com/ga.js Requested by Host: healthcareservices.top URL: https://healthcareservices.top/PDF/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://healthcareservices.top/ accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Wed, 13 Apr 2022 21:02:38 GMT server Golfe2 age 31 date Tue, 31 May 2022 23:24:17 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 17168 expires Wed, 01 Jun 2022 01:24:17 GMT
GET H/1.1	200 OK	background.jpg healthcareservices.top/PDF/	24 KB 25 KB	131ms 49ms	Image image/jpeg	91.234.99.78 PIHL-AS
General Check archive.org Show headers Download Go to Show image Full URL https://healthcareservices.top/PDF/background.jpg Requested by Host: healthcareservices.top URL: https://healthcareservices.top/PDF/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.234.99.78 , Netherlands, ASN213058 (PIHL-AS, RU), Reverse DNS Software Apache / Resource Hash bb99cb65cdd4674719ae21b0e6102e6cc8308ac2507d52c6465b75d5b2c00625 Request headers accept-language nl-NL,nl;q=0.9 Referer https://healthcareservices.top/PDF/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Tue, 31 May 2022 23:24:48 GMT Last-Modified Sat, 24 Aug 2013 04:45:40 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 24990
GET H/1.1	404 Not Found	grayBars.gif healthcareservices.top/images/	315 B 315 B	147ms 49ms	Image text/html	91.234.99.78 PIHL-AS
General Check archive.org Show headers Download Go to Show image Full URL https://healthcareservices.top/images/grayBars.gif Requested by Host: healthcareservices.top URL: https://healthcareservices.top/PDF/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.234.99.78 , Netherlands, ASN213058 (PIHL-AS, RU), Reverse DNS Software Apache / Resource Hash d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3 Request headers accept-language nl-NL,nl;q=0.9 Referer https://healthcareservices.top/PDF/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Date Tue, 31 May 2022 23:24:48 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 315 Content-Type text/html; charset=iso-8859-1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

s24.postimg.org

URL

https://s24.postimg.org/wlcz4rhyd/image.png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation function| email_Submit function| password_Submit string| gaJsHost object| _gat object| _gaq

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://healthcareservices.top/PDF/ Message: Mixed Content: The page at 'https://healthcareservices.top/PDF/' was loaded over HTTPS, but requested an insecure element 'http://s24.postimg.org/wlcz4rhyd/image.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
network	error	URL: https://s24.postimg.org/wlcz4rhyd/image.png Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
security	warning	URL: https://healthcareservices.top/PDF/(Line 35) Message: Mixed Content: The page at 'https://healthcareservices.top/PDF/' was loaded over HTTPS, but requested an insecure element 'http://s24.postimg.org/wlcz4rhyd/image.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
javascript	warning	URL: https://healthcareservices.top/PDF/(Line 126) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ssl.google-analytics.com/ga.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://healthcareservices.top/PDF/(Line 126) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ssl.google-analytics.com/ga.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://healthcareservices.top/images/grayBars.gif Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

healthcareservices.top
s24.postimg.org
ssl.google-analytics.com
s24.postimg.org
2a00:1450:4001:812::2008
91.234.99.78
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
30191280dc4c3a43f3f3fefa3698eef441974c66cea0f977debb335ec12255d8
bb99cb65cdd4674719ae21b0e6102e6cc8308ac2507d52c6465b75d5b2c00625
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d9e766c75e48f6bdbb1b12b0eb9ea5fa9b2524b00b1c3d8373d74fa9c4ec1012