menbaidauone-k.ddicorp.com Open in urlscan Pro
65.158.88.132 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://menbaidauone-k.ddicorp.com/index.php
Effective URL:
http://menbaidauone-k.ddicorp.com/
Submission Tags: phishtake
Submission: On January 15 via api (January 15th 2021, 3:49:09 pm UTC) from JP

Summary HTTP 25 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 25 HTTP transactions. The main IP is 65.158.88.132, located in Dubuque, United States and belongs to CENTURYLINK-US-LEGACY-QWEST, US. The main domain is menbaidauone-k.ddicorp.com.

This is the only time menbaidauone-k.ddicorp.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	65.158.88.132 65.158.88.132	209 (CENTURYLI...) (CENTURYLINK-US-LEGACY-QWEST)
20 20	184.168.131.241 184.168.131.241	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
20 40	2606:4700::68... 2606:4700::6810:dc2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:817::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81d::2003	15169 (GOOGLE) (GOOGLE)
25	4

2 65.158.88.132 (Dubuque, United States) 1 redirects

ASN209 (CENTURYLINK-US-LEGACY-QWEST, US)
PTR: 65-158-88-132.dia.static.qwest.net

menbaidauone-k.ddicorp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 184.168.131.241 (Scottsdale, United States) 20 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-184-168-131-241.ip.secureserver.net

bevipclub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

40 2606:4700::6810:dc2 (United States) 20 redirects

ASN13335 (CLOUDFLARENET, US)

www.bevipclub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:817::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
60	bevipclub.com 40 redirects bevipclub.com www.bevipclub.com	9 KB
3	googleapis.com fonts.googleapis.com	3 KB
2	ddicorp.com 1 redirects menbaidauone-k.ddicorp.com	14 KB
1	gstatic.com fonts.gstatic.com	12 KB
25	4

	Domain	Requested by
40	www.bevipclub.com	20 redirects menbaidauone-k.ddicorp.com
20	bevipclub.com	20 redirects
3	fonts.googleapis.com	menbaidauone-k.ddicorp.com
2	menbaidauone-k.ddicorp.com	1 redirects
1	fonts.gstatic.com	fonts.googleapis.com
25	5

This site contains links to these domains. Also see Links.

Domain
bevipclub.com
www.backyard-expressions.com
wordpress.org
www.akithemes.com

Subject Issuer	Validity	Valid
www.bevipclub.com Cloudflare Inc ECC CA-3	`2020-07-02` - `2021-07-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://menbaidauone-k.ddicorp.com/
Frame ID: 2940FEA33FC5FBF235D771F582B54500
Requests: 25 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://menbaidauone-k.ddicorp.com/index.php HTTP 301
http://menbaidauone-k.ddicorp.com/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i
headers server /php\/?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

Python (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:^|\s)Python(?:\/([\d.]+))?/i
headers server /mod_python(?:\/([\d.]+))?/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

CentOS (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /CentOS/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_python (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_python(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
headers server /mod_python(?:\/([\d.]+))?/i

Page Statistics

25
Requests

80 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

29 kB
Transfer

30 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: http://bevipclub.com/wordpress/

Search URL Search Domain Scan URL

URL: https://www.backyard-expressions.com/
Title: Backyard-Expressions.com

Search URL Search Domain Scan URL

URL: https://wordpress.org/
Title: Proudly powered by WordPress

Search URL Search Domain Scan URL

URL: https://www.akithemes.com/
Title: Aki Themes

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://menbaidauone-k.ddicorp.com/index.php HTTP 301
http://menbaidauone-k.ddicorp.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://bevipclub.com/wordpress/wp-includes/css/dist/block-library/style.min.css?ver=5.0.3 HTTP 301
https://www.bevipclub.com/optin25413609?ver=5.0.3 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 1

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/css/bootstrap.min.css?ver=5.0.3 HTTP 301
https://www.bevipclub.com/optin25413609?ver=5.0.3 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 2

http://bevipclub.com/wordpress/wp-content/themes/free-blog/style.css?ver=5.0.3 HTTP 301
https://www.bevipclub.com/optin25413609?ver=5.0.3 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 3

http://bevipclub.com/wordpress/wp-content/themes/aki-blog/style.css?ver=1.0.1 HTTP 301
https://www.bevipclub.com/optin25413609?ver=1.0.1 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 7

http://bevipclub.com/wordpress/wp-content/themes/free-blog/css/font-awesome.min.css?ver=4.5.0 HTTP 301
https://www.bevipclub.com/optin25413609?ver=4.5.0 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 8

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/css/slick.css?ver=4.5.0 HTTP 301
https://www.bevipclub.com/optin25413609?ver=4.5.0 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 9

http://bevipclub.com/wordpress/wp-includes/js/jquery/jquery.js?ver=1.12.4 HTTP 301
https://www.bevipclub.com/optin25413609?ver=1.12.4 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 10

http://bevipclub.com/wordpress/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1 HTTP 301
https://www.bevipclub.com/optin25413609?ver=1.4.1 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 11

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/bootstrap.min.js?ver=4.6.0 HTTP 301
https://www.bevipclub.com/optin25413609?ver=4.6.0 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 12

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/slick.js?ver=4.6.0 HTTP 301
https://www.bevipclub.com/optin25413609?ver=4.6.0 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 13

http://bevipclub.com/wordpress/?wordfence_syncAttackData=1610725594.1757 HTTP 301
https://www.bevipclub.com/optin25413609?wordfence_syncAttackData=1610725594.1757 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 14

http://bevipclub.com/wordpress/wp-content/uploads/2019/01/Backyard-Logo-all-black.png HTTP 301
https://www.bevipclub.com/optin25413609 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 15

http://bevipclub.com/wordpress/wp-includes/js/wp-emoji-release.min.js?ver=5.0.3 HTTP 301
https://www.bevipclub.com/optin25413609?ver=5.0.3 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 16

http://bevipclub.com/wordpress/wp-content/uploads/2019/01/Backyard-Logo-all-white-300x92.png HTTP 301
https://www.bevipclub.com/optin25413609 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 17

http://bevipclub.com/wordpress/wp-content/themes/free-blog/js/navigation.js?ver=20151215 HTTP 301
https://www.bevipclub.com/optin25413609?ver=20151215 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 18

http://bevipclub.com/wordpress/wp-content/themes/free-blog/js/script.js?ver=20151215 HTTP 301
https://www.bevipclub.com/optin25413609?ver=20151215 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 19

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/custom.js?ver=20151215 HTTP 301
https://www.bevipclub.com/optin25413609?ver=20151215 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 20

http://bevipclub.com/wordpress/wp-content/themes/free-blog/js/skip-link-focus-fix.js?ver=20151215 HTTP 301
https://www.bevipclub.com/optin25413609?ver=20151215 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 21

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/theia-sticky-sidebar.js?ver=20151215 HTTP 301
https://www.bevipclub.com/optin25413609?ver=20151215 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 22

http://bevipclub.com/wordpress/wp-includes/js/wp-embed.min.js?ver=5.0.3 HTTP 301
https://www.bevipclub.com/optin25413609?ver=5.0.3 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

25 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
menbaidauone-k.ddicorp.com/
Redirect Chain

http://menbaidauone-k.ddicorp.com/index.php
http://menbaidauone-k.ddicorp.com/

13 KB
14 KB

591ms
590ms

Document
text/html

65.158.88.132
CENTURYLINK-US-LE...

General

Check archive.org

Show headers Download Go to

Full URL: http://menbaidauone-k.ddicorp.com/
Protocol: HTTP/1.1
Server: 65.158.88.132 Dubuque, United States, ASN209 (CENTURYLINK-US-LEGACY-QWEST, US),
Reverse DNS: 65-158-88-132.dia.static.qwest.net
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 mod_python/3.5.0- Python/2.7.5 PHP/7.2.34 / PHP/7.2.34
Resource Hash: 52912be22bc2f001eb945e990fbcc25470bfd8af91e63259aaa21f1870f8c604

Request headers

Host: menbaidauone-k.ddicorp.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 15 Jan 2021 15:46:33 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 mod_python/3.5.0- Python/2.7.5 PHP/7.2.34
X-Powered-By: PHP/7.2.34
Link: <http://bevipclub.com/wordpress/index.php?rest_route=/>; rel="https://api.w.org/", <http://bevipclub.com/wordpress/>; rel=shortlink
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Fri, 15 Jan 2021 15:46:32 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 mod_python/3.5.0- Python/2.7.5 PHP/7.2.34
X-Powered-By: PHP/7.2.34
Location: http://menbaidauone-k.ddicorp.com/
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-includes/css/dist/block-library/style.min.css?ver=5.0.3
https://www.bevipclub.com/optin25413609?ver=5.0.3
https://www.bevipclub.com/bf-vip-club-welcome

0
0

32ms
32ms

Stylesheet
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 15:48:40 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a8551872000005f59a08c000000001
x-request-id: e454c91ce5d34621c823c443fae6e0c0
x-runtime: 0.103645
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6120be071f6c05f5-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/css/bootstrap.min.css?ver=5.0.3
https://www.bevipclub.com/optin25413609?ver=5.0.3
https://www.bevipclub.com/bf-vip-club-welcome

0
0

31ms
31ms

Stylesheet
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 15:48:40 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a8551863000005f593b09000000001
x-request-id: bd20eb9c4eb8e8a3e5bb90a502606d36
x-runtime: 0.075002
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6120be070f0f05f5-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/style.css?ver=5.0.3
https://www.bevipclub.com/optin25413609?ver=5.0.3
https://www.bevipclub.com/bf-vip-club-welcome

0
0

244ms
244ms

Stylesheet
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 15:48:39 GMT
cf-cache-status: MISS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a855151e000005f54b9a2000000001
x-request-id: 6eb3107e70765906ef870de5edf598be
x-runtime: 0.081065
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 6120be01cf9e05f5-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/aki-blog/style.css?ver=1.0.1
https://www.bevipclub.com/optin25413609?ver=1.0.1
https://www.bevipclub.com/bf-vip-club-welcome

0
0

23ms
23ms

Stylesheet
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 15:48:40 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a8551867000005f5538fc000000001
x-request-id: c10a0bddda9a4c2a4c21b90e748920c7
x-runtime: 0.115376
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6120be070f2205f5-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H/1.1 200
OK css
fonts.googleapis.com/ 2 KB
1 KB 22ms
14ms Stylesheet
text/css 2a00:1450:4001:817::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Oswald&ver=5.0.3

Requested by

Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/

Protocol

HTTP/1.1

Server

2a00:1450:4001:817::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6994926563db9f34ee2dbd99aac6a322e72930feace95fccd5329f08a0689a4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 15 Jan 2021 15:48:38 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 15 Jan 2021 15:48:38 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Fri, 15 Jan 2021 15:48:38 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 2 KB
1 KB 24ms
17ms Stylesheet
text/css 2a00:1450:4001:817::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Merriweather&ver=5.0.3

Requested by

Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/

Protocol

HTTP/1.1

Server

2a00:1450:4001:817::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d861c078e249dfc3b63ef8af7a5c78e8a756fd7fed5284100672d5e5f9185f8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 15 Jan 2021 15:48:38 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 15 Jan 2021 15:48:38 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Fri, 15 Jan 2021 15:48:38 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 1 KB
982 B 23ms
15ms Stylesheet
text/css 2a00:1450:4001:817::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Italianno|Niconne

Requested by

Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/

Protocol

HTTP/1.1

Server

2a00:1450:4001:817::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d503eb7e2282c346b59e2df1fc74b5e3ea9eb8e2e030e9c0d5c936d20eb78a56

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 15 Jan 2021 15:48:38 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 15 Jan 2021 15:48:38 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Fri, 15 Jan 2021 15:48:38 GMT

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/css/font-awesome.min.css?ver=4.5.0
https://www.bevipclub.com/optin25413609?ver=4.5.0
https://www.bevipclub.com/bf-vip-club-welcome

0
0

39ms
38ms

Stylesheet
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 15:48:40 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a8551872000005f5013cc000000001
x-request-id: 756781de6860f56d76925b37c30fae57
x-runtime: 0.082562
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6120be071f6805f5-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/css/slick.css?ver=4.5.0
https://www.bevipclub.com/optin25413609?ver=4.5.0
https://www.bevipclub.com/bf-vip-club-welcome

0
0

21ms
20ms

Stylesheet
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 15:48:40 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a855186e000005f5f5844000000001
x-request-id: 5973d403529e8c757d656061f15985fc
x-runtime: 0.082298
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6120be071f5805f5-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-includes/js/jquery/jquery.js?ver=1.12.4
https://www.bevipclub.com/optin25413609?ver=1.12.4
https://www.bevipclub.com/bf-vip-club-welcome

0
0

33ms
33ms

Script
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 15:48:40 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a8551633000005f58804e000000001
x-request-id: 2b0e4785b8482a9df6eebd0ab34f2f03
x-runtime: 0.090793
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6120be038c7705f5-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
https://www.bevipclub.com/optin25413609?ver=1.4.1
https://www.bevipclub.com/bf-vip-club-welcome

0
0

63ms
62ms

Script
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 15:48:40 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a855175e000005f5f5823000000001
x-request-id: 43f8c31ddc4ff9825d52ccb6fec0295e
x-runtime: 0.086467
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6120be05696c05f5-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/bootstrap.min.js?ver=4.6.0
https://www.bevipclub.com/optin25413609?ver=4.6.0
https://www.bevipclub.com/bf-vip-club-welcome

0
0

22ms
21ms

Script
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 15:48:40 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a855188e000005f50e0c3000000001
x-request-id: 203fd8b1ddbb0237189ee57118e4d53b
x-runtime: 0.077294
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6120be074ffb05f5-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/slick.js?ver=4.6.0
https://www.bevipclub.com/optin25413609?ver=4.6.0
https://www.bevipclub.com/bf-vip-club-welcome

0
0

26ms
26ms

Script
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 15:48:40 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a85519b4000005f56634d000000001
x-request-id: 28138d9ee590a3afc17c2d7995371032
x-runtime: 0.099889
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6120be091cee05f5-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/?wordfence_syncAttackData=1610725594.1757
https://www.bevipclub.com/optin25413609?wordfence_syncAttackData=1610725594.1757
https://www.bevipclub.com/bf-vip-club-welcome

0
0

41ms
41ms

Script
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 15:48:42 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a8551f16000005f59a155000000001
x-request-id: 7e86c09c0927b84df2caf7e99ae48283
x-runtime: 0.084321
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6120be11be8505f5-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/uploads/2019/01/Backyard-Logo-all-black.png
https://www.bevipclub.com/optin25413609
https://www.bevipclub.com/bf-vip-club-welcome

0
0

35ms
35ms

Image
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 15:48:41 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a8551d55000005f5e932e000000001
x-request-id: 750bb0d1f8242dd2732fced85a5e065f
x-runtime: 0.096141
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6120be0eedfe05f5-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-includes/js/wp-emoji-release.min.js?ver=5.0.3
https://www.bevipclub.com/optin25413609?ver=5.0.3
https://www.bevipclub.com/bf-vip-club-welcome

0
0

27ms
27ms

Script
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 15:48:42 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a8551f22000005f54bad5000000001
x-request-id: ed78be8d29d01a2abf07202d68c695e7
x-runtime: 0.097238
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6120be11debe05f5-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/uploads/2019/01/Backyard-Logo-all-white-300x92.png
https://www.bevipclub.com/optin25413609
https://www.bevipclub.com/bf-vip-club-welcome

0
0

25ms
25ms

Image
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 15:48:41 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a8551e25000005f5048d5000000001
x-request-id: 1f416bdd52cd04ef3c1c039463c5b766
x-runtime: 0.102338
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6120be103a1505f5-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/js/navigation.js?ver=20151215
https://www.bevipclub.com/optin25413609?ver=20151215
https://www.bevipclub.com/bf-vip-club-welcome

0
0

26ms
25ms

Script
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 15:48:41 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a8551c29000005f54ab91000000001
x-request-id: 479bc06b84ce9f907e81f398b291ee9e
x-runtime: 0.076797
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6120be0d083305f5-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/js/script.js?ver=20151215
https://www.bevipclub.com/optin25413609?ver=20151215
https://www.bevipclub.com/bf-vip-club-welcome

0
0

37ms
36ms

Script
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 15:48:41 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a8551cf4000005f51c376000000001
x-request-id: 62f0a0822f3aff895d13def83847de13
x-runtime: 0.073379
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6120be0e5c0905f5-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/custom.js?ver=20151215
https://www.bevipclub.com/optin25413609?ver=20151215
https://www.bevipclub.com/bf-vip-club-welcome

0
0

27ms
27ms

Script
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 15:48:41 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a8551ced000005f50e144000000001
x-request-id: 0bf3bed92ebb2e71b44bbd4c74d48a19
x-runtime: 0.077297
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6120be0e4bdf05f5-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/js/skip-link-focus-fix.js?ver=20151215
https://www.bevipclub.com/optin25413609?ver=20151215
https://www.bevipclub.com/bf-vip-club-welcome

0
0

37ms
37ms

Script
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 15:48:41 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a8551cf3000005f5ae91d000000001
x-request-id: f4ea1a8f7a7e0470066d6b8a5f1a3a32
x-runtime: 0.108876
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6120be0e5c0305f5-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/theia-sticky-sidebar.js?ver=20151215
https://www.bevipclub.com/optin25413609?ver=20151215
https://www.bevipclub.com/bf-vip-club-welcome

0
0

29ms
29ms

Script
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 15:48:41 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a8551cda000005f543a14000000001
x-request-id: 0e1a6f176ca2c5d26131f07dbb81b696
x-runtime: 0.090787
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6120be0e2b7605f5-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-includes/js/wp-embed.min.js?ver=5.0.3
https://www.bevipclub.com/optin25413609?ver=5.0.3
https://www.bevipclub.com/bf-vip-club-welcome

0
0

40ms
37ms

Script
text/html

2606:4700::6810:dc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 15:48:41 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a8551d26000005f5663ae000000001
x-request-id: 6a83440d9368caaf770d47c8b6c2cc69
x-runtime: 0.078180
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6120be0e9cf505f5-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H/1.1 200
OK u-440qyriQwlOrhSvowK_l5-fCZMdeX3rg.woff2
fonts.gstatic.com/s/merriweather/v22/ 12 KB
12 KB 13ms
7ms Font
font/woff2 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/merriweather/v22/u-440qyriQwlOrhSvowK_l5-fCZMdeX3rg.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Merriweather&ver=5.0.3

Protocol

HTTP/1.1

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4fa437e044d3f739bd5e4aa2d1bd94e3952e888baec655763cd7969576001da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://menbaidauone-k.ddicorp.com
Referer: http://fonts.googleapis.com/css?family=Merriweather&ver=5.0.3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 15 Jan 2021 09:30:16 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 10 Sep 2020 17:10:13 GMT
Server: sffe
Age: 22705
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 12256
X-XSS-Protection: 0
Expires: Sat, 15 Jan 2022 09:30:16 GMT

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bevipclub.com
fonts.googleapis.com
fonts.gstatic.com
menbaidauone-k.ddicorp.com
www.bevipclub.com
184.168.131.241
2606:4700::6810:dc2
2a00:1450:4001:817::200a
2a00:1450:4001:81d::2003
65.158.88.132
52912be22bc2f001eb945e990fbcc25470bfd8af91e63259aaa21f1870f8c604
6994926563db9f34ee2dbd99aac6a322e72930feace95fccd5329f08a0689a4e
d503eb7e2282c346b59e2df1fc74b5e3ea9eb8e2e030e9c0d5c936d20eb78a56
d861c078e249dfc3b63ef8af7a5c78e8a756fd7fed5284100672d5e5f9185f8b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4fa437e044d3f739bd5e4aa2d1bd94e3952e888baec655763cd7969576001da

menbaidauone-k.ddicorp.com Open in urlscan Pro 65.158.88.132 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

25 Requests

80 %HTTPS

60 %IPv6

4 Domains

5 Subdomains

4 IPs

2 Countries

29 kBTransfer

30 kBSize

0 Cookies

4 Outgoing links

Page URL History

Redirected requests

25 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

menbaidauone-k.ddicorp.com Open in urlscan Pro
65.158.88.132 Public Scan

Screenshot
Live screenshot

Full Image

25
Requests

80 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

29 kB
Transfer

30 kB
Size

0
Cookies

25 HTTP transactions
0 data transactions