menbaidauone-k.ddicorp.com Open in urlscan Pro
65.158.88.132 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://menbaidauone-k.ddicorp.com/index.php
Effective URL:
http://menbaidauone-k.ddicorp.com/
Submission Tags: phishtake
Submission: On January 16 via api (January 16th 2021, 2:39:32 am UTC) from JP

Summary HTTP 25 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 25 HTTP transactions. The main IP is 65.158.88.132, located in Dubuque, United States and belongs to CENTURYLINK-US-LEGACY-QWEST, US. The main domain is menbaidauone-k.ddicorp.com.

This is the only time menbaidauone-k.ddicorp.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	65.158.88.132 65.158.88.132	209 (CENTURYLI...) (CENTURYLINK-US-LEGACY-QWEST)
20 20	184.168.131.241 184.168.131.241	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
20 40	2606:4700::68... 2606:4700::6810:cc2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:824::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81d::2003	15169 (GOOGLE) (GOOGLE)
25	4

2 65.158.88.132 (Dubuque, United States) 1 redirects

ASN209 (CENTURYLINK-US-LEGACY-QWEST, US)
PTR: 65-158-88-132.dia.static.qwest.net

menbaidauone-k.ddicorp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 184.168.131.241 (Scottsdale, United States) 20 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-184-168-131-241.ip.secureserver.net

bevipclub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

40 2606:4700::6810:cc2 (United States) 20 redirects

ASN13335 (CLOUDFLARENET, US)

www.bevipclub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:824::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
60	bevipclub.com 40 redirects bevipclub.com www.bevipclub.com	10 KB
3	googleapis.com fonts.googleapis.com	3 KB
2	ddicorp.com 1 redirects menbaidauone-k.ddicorp.com	14 KB
1	gstatic.com fonts.gstatic.com	12 KB
25	4

	Domain	Requested by
40	www.bevipclub.com	20 redirects menbaidauone-k.ddicorp.com
20	bevipclub.com	20 redirects
3	fonts.googleapis.com	menbaidauone-k.ddicorp.com
2	menbaidauone-k.ddicorp.com	1 redirects
1	fonts.gstatic.com	fonts.googleapis.com
25	5

This site contains links to these domains. Also see Links.

Domain
bevipclub.com
www.backyard-expressions.com
wordpress.org
www.akithemes.com

Subject Issuer	Validity	Valid
www.bevipclub.com Cloudflare Inc ECC CA-3	`2020-07-02` - `2021-07-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://menbaidauone-k.ddicorp.com/
Frame ID: 4DEBDA2C7F2017AE0059395474371889
Requests: 25 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://menbaidauone-k.ddicorp.com/index.php HTTP 301
http://menbaidauone-k.ddicorp.com/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i
headers server /php\/?([\d.]+)?/i
html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

Python (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:^|\s)Python(?:\/([\d.]+))?/i
headers server /mod_python(?:\/([\d.]+))?/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

CentOS (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /CentOS/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_python (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_python(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
headers server /mod_python(?:\/([\d.]+))?/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Slick (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /(?:\/([\d.]+))?\/slick(?:\.min)?\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
script /(?:\/([\d.]+))?\/slick(?:\.min)?\.js/i
script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

Page Statistics

25
Requests

80 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

29 kB
Transfer

30 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: http://bevipclub.com/wordpress/

Search URL Search Domain Scan URL

URL: https://www.backyard-expressions.com/
Title: Backyard-Expressions.com

Search URL Search Domain Scan URL

URL: https://wordpress.org/
Title: Proudly powered by WordPress

Search URL Search Domain Scan URL

URL: https://www.akithemes.com/
Title: Aki Themes

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://menbaidauone-k.ddicorp.com/index.php HTTP 301
http://menbaidauone-k.ddicorp.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://bevipclub.com/wordpress/wp-includes/css/dist/block-library/style.min.css?ver=5.0.3 HTTP 301
https://www.bevipclub.com/optin25413609?ver=5.0.3 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 1

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/css/bootstrap.min.css?ver=5.0.3 HTTP 301
https://www.bevipclub.com/optin25413609?ver=5.0.3 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 2

http://bevipclub.com/wordpress/wp-content/themes/free-blog/style.css?ver=5.0.3 HTTP 301
https://www.bevipclub.com/optin25413609?ver=5.0.3 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 3

http://bevipclub.com/wordpress/wp-content/themes/aki-blog/style.css?ver=1.0.1 HTTP 301
https://www.bevipclub.com/optin25413609?ver=1.0.1 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 7

http://bevipclub.com/wordpress/wp-content/themes/free-blog/css/font-awesome.min.css?ver=4.5.0 HTTP 301
https://www.bevipclub.com/optin25413609?ver=4.5.0 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 8

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/css/slick.css?ver=4.5.0 HTTP 301
https://www.bevipclub.com/optin25413609?ver=4.5.0 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 9

http://bevipclub.com/wordpress/wp-includes/js/jquery/jquery.js?ver=1.12.4 HTTP 301
https://www.bevipclub.com/optin25413609?ver=1.12.4 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 10

http://bevipclub.com/wordpress/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1 HTTP 301
https://www.bevipclub.com/optin25413609?ver=1.4.1 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 11

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/bootstrap.min.js?ver=4.6.0 HTTP 301
https://www.bevipclub.com/optin25413609?ver=4.6.0 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 12

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/slick.js?ver=4.6.0 HTTP 301
https://www.bevipclub.com/optin25413609?ver=4.6.0 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 13

http://bevipclub.com/wordpress/?wordfence_syncAttackData=1610764628.5509 HTTP 301
https://www.bevipclub.com/optin25413609?wordfence_syncAttackData=1610764628.5509 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 14

http://bevipclub.com/wordpress/wp-content/uploads/2019/01/Backyard-Logo-all-black.png HTTP 301
https://www.bevipclub.com/optin25413609 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 15

http://bevipclub.com/wordpress/wp-includes/js/wp-emoji-release.min.js?ver=5.0.3 HTTP 301
https://www.bevipclub.com/optin25413609?ver=5.0.3 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 16

http://bevipclub.com/wordpress/wp-content/uploads/2019/01/Backyard-Logo-all-white-300x92.png HTTP 301
https://www.bevipclub.com/optin25413609 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 17

http://bevipclub.com/wordpress/wp-content/themes/free-blog/js/navigation.js?ver=20151215 HTTP 301
https://www.bevipclub.com/optin25413609?ver=20151215 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 18

http://bevipclub.com/wordpress/wp-content/themes/free-blog/js/script.js?ver=20151215 HTTP 301
https://www.bevipclub.com/optin25413609?ver=20151215 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 19

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/custom.js?ver=20151215 HTTP 301
https://www.bevipclub.com/optin25413609?ver=20151215 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 20

http://bevipclub.com/wordpress/wp-content/themes/free-blog/js/skip-link-focus-fix.js?ver=20151215 HTTP 301
https://www.bevipclub.com/optin25413609?ver=20151215 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 21

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/theia-sticky-sidebar.js?ver=20151215 HTTP 301
https://www.bevipclub.com/optin25413609?ver=20151215 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 22

http://bevipclub.com/wordpress/wp-includes/js/wp-embed.min.js?ver=5.0.3 HTTP 301
https://www.bevipclub.com/optin25413609?ver=5.0.3 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

25 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
menbaidauone-k.ddicorp.com/
Redirect Chain

http://menbaidauone-k.ddicorp.com/index.php
http://menbaidauone-k.ddicorp.com/

13 KB
14 KB

582ms
581ms

Document
text/html

65.158.88.132
CENTURYLINK-US-LE...

General

Check archive.org

Show headers Download Go to

Full URL: http://menbaidauone-k.ddicorp.com/
Protocol: HTTP/1.1
Server: 65.158.88.132 Dubuque, United States, ASN209 (CENTURYLINK-US-LEGACY-QWEST, US),
Reverse DNS: 65-158-88-132.dia.static.qwest.net
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 mod_python/3.5.0- Python/2.7.5 PHP/7.2.34 / PHP/7.2.34
Resource Hash: 3391d25c152ec6ebbcf7aa8aeea676c888ab24a5298e00fc1fde75376a9b43f4

Request headers

Host: menbaidauone-k.ddicorp.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 16 Jan 2021 02:37:08 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 mod_python/3.5.0- Python/2.7.5 PHP/7.2.34
X-Powered-By: PHP/7.2.34
Link: <http://bevipclub.com/wordpress/index.php?rest_route=/>; rel="https://api.w.org/", <http://bevipclub.com/wordpress/>; rel=shortlink
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Sat, 16 Jan 2021 02:37:06 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 mod_python/3.5.0- Python/2.7.5 PHP/7.2.34
X-Powered-By: PHP/7.2.34
Location: http://menbaidauone-k.ddicorp.com/
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-includes/css/dist/block-library/style.min.css?ver=5.0.3
https://www.bevipclub.com/optin25413609?ver=5.0.3
https://www.bevipclub.com/bf-vip-club-welcome

0
0

194ms
194ms

Stylesheet
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Sat, 16 Jan 2021 02:39:13 GMT
cf-cache-status: MISS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07aaa8aff10000c27cbd146000000001
x-request-id: 096d38e3fb4ce793aea8e739ebfddb1d
x-runtime: 0.080941
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 612476f988dcc27c-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/css/bootstrap.min.css?ver=5.0.3
https://www.bevipclub.com/optin25413609?ver=5.0.3
https://www.bevipclub.com/bf-vip-club-welcome

0
0

23ms
23ms

Stylesheet
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Sat, 16 Jan 2021 02:39:14 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07aaa8b38e0000c27c6e184000000001
x-request-id: 7bf51fba7eefd6597ee3e757359b5eef
x-runtime: 0.077635
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 612476ff4d41c27c-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/style.css?ver=5.0.3
https://www.bevipclub.com/optin25413609?ver=5.0.3
https://www.bevipclub.com/bf-vip-club-welcome

0
0

38ms
37ms

Stylesheet
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Sat, 16 Jan 2021 02:39:14 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07aaa8b3920000c27c4b8ca000000001
x-request-id: 7d9fe3c49decb70e5a75cdef9d10cb87
x-runtime: 0.088496
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 612476ff4d4ac27c-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/aki-blog/style.css?ver=1.0.1
https://www.bevipclub.com/optin25413609?ver=1.0.1
https://www.bevipclub.com/bf-vip-club-welcome

0
0

710ms
710ms

Stylesheet
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Sat, 16 Jan 2021 02:39:13 GMT
cf-cache-status: MISS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07aaa8aff30000c27ca08a8000000001
x-request-id: ee02aeac028bb3a93ed3be969796d66f
x-runtime: 0.079769
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 612476f988dfc27c-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H/1.1 200
OK css
fonts.googleapis.com/ 2 KB
1 KB 23ms
16ms Stylesheet
text/css 2a00:1450:4001:824::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Oswald&ver=5.0.3

Requested by

Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/

Protocol

HTTP/1.1

Server

2a00:1450:4001:824::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6994926563db9f34ee2dbd99aac6a322e72930feace95fccd5329f08a0689a4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 16 Jan 2021 02:39:12 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Sat, 16 Jan 2021 01:58:18 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Sat, 16 Jan 2021 02:39:12 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 2 KB
1 KB 23ms
16ms Stylesheet
text/css 2a00:1450:4001:824::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Merriweather&ver=5.0.3

Requested by

Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/

Protocol

HTTP/1.1

Server

2a00:1450:4001:824::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d861c078e249dfc3b63ef8af7a5c78e8a756fd7fed5284100672d5e5f9185f8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 16 Jan 2021 02:39:12 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Sat, 16 Jan 2021 01:32:53 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Sat, 16 Jan 2021 02:39:12 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 1 KB
982 B 22ms
15ms Stylesheet
text/css 2a00:1450:4001:824::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Italianno|Niconne

Requested by

Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/

Protocol

HTTP/1.1

Server

2a00:1450:4001:824::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d503eb7e2282c346b59e2df1fc74b5e3ea9eb8e2e030e9c0d5c936d20eb78a56

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sat, 16 Jan 2021 02:39:12 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Sat, 16 Jan 2021 02:39:12 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Sat, 16 Jan 2021 02:39:12 GMT

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/css/font-awesome.min.css?ver=4.5.0
https://www.bevipclub.com/optin25413609?ver=4.5.0
https://www.bevipclub.com/bf-vip-club-welcome

0
0

32ms
32ms

Stylesheet
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Sat, 16 Jan 2021 02:39:13 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07aaa8b36a0000c27c72a88000000001
x-request-id: 26fffc687fecf80d4b95022c3e302df1
x-runtime: 0.091867
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 612476ff0d0dc27c-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/css/slick.css?ver=4.5.0
https://www.bevipclub.com/optin25413609?ver=4.5.0
https://www.bevipclub.com/bf-vip-club-welcome

0
0

20ms
20ms

Stylesheet
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Sat, 16 Jan 2021 02:39:14 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07aaa8b38f0000c27cd2a10000000001
x-request-id: 11ca0b9260bbb6e7e4409070d86f4071
x-runtime: 0.077888
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 612476ff4d45c27c-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-includes/js/jquery/jquery.js?ver=1.12.4
https://www.bevipclub.com/optin25413609?ver=1.12.4
https://www.bevipclub.com/bf-vip-club-welcome

0
0

34ms
34ms

Script
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Sat, 16 Jan 2021 02:39:13 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07aaa8b1060000c27cb3113000000001
x-request-id: 83c8e54d33181d9c2cc7c3a0481af4ef
x-runtime: 0.086152
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 612476fb39fec27c-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
https://www.bevipclub.com/optin25413609?ver=1.4.1
https://www.bevipclub.com/bf-vip-club-welcome

0
0

32ms
32ms

Script
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Sat, 16 Jan 2021 02:39:13 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07aaa8b13c0000c27cec9a2000000001
x-request-id: 8387dc183e386fec656ea0f35a583774
x-runtime: 0.084172
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 612476fb9a50c27c-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/bootstrap.min.js?ver=4.6.0
https://www.bevipclub.com/optin25413609?ver=4.6.0
https://www.bevipclub.com/bf-vip-club-welcome

0
0

22ms
22ms

Script
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Sat, 16 Jan 2021 02:39:13 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07aaa8b26c0000c27c89931000000001
x-request-id: ee98c6f4f73df353d2b237f0137d1a9f
x-runtime: 0.076385
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 612476fd7bbfc27c-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/slick.js?ver=4.6.0
https://www.bevipclub.com/optin25413609?ver=4.6.0
https://www.bevipclub.com/bf-vip-club-welcome

0
0

42ms
42ms

Script
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Sat, 16 Jan 2021 02:39:13 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07aaa8b26c0000c27ca08bd000000001
x-request-id: c68746e7c13cad6acb9420bfd8260ab8
x-runtime: 0.073739
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 612476fd7bc1c27c-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/?wordfence_syncAttackData=1610764628.5509
https://www.bevipclub.com/optin25413609?wordfence_syncAttackData=1610764628.5509
https://www.bevipclub.com/bf-vip-club-welcome

0
0

25ms
24ms

Script
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Sat, 16 Jan 2021 02:39:15 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07aaa8b9240000c27cd2a3c000000001
x-request-id: 1020eb57980cd66a59b512988950c31a
x-runtime: 0.076185
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 612477083b9bc27c-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/uploads/2019/01/Backyard-Logo-all-black.png
https://www.bevipclub.com/optin25413609
https://www.bevipclub.com/bf-vip-club-welcome

0
0

22ms
22ms

Image
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Sat, 16 Jan 2021 02:39:14 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07aaa8b6ed0000c27cb0b02000000001
x-request-id: 0a5ffc9d31cb689a751918c947fc6913
x-runtime: 0.080858
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 61247704a946c27c-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-includes/js/wp-emoji-release.min.js?ver=5.0.3
https://www.bevipclub.com/optin25413609?ver=5.0.3
https://www.bevipclub.com/bf-vip-club-welcome

0
0

25ms
24ms

Script
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Sat, 16 Jan 2021 02:39:15 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07aaa8b97b0000c27cd43e6000000001
x-request-id: 2f7be7ec4e5b6c208a5c9f07cfee9ec6
x-runtime: 0.094345
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 61247708cbffc27c-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/uploads/2019/01/Backyard-Logo-all-white-300x92.png
https://www.bevipclub.com/optin25413609
https://www.bevipclub.com/bf-vip-club-welcome

0
0

29ms
29ms

Image
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Sat, 16 Jan 2021 02:39:15 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07aaa8b7dd0000c27ca08e8000000001
x-request-id: 336acf1b9cc4de4ff90ffb9355b3c672
x-runtime: 0.080870
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 612477062a3ac27c-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/js/navigation.js?ver=20151215
https://www.bevipclub.com/optin25413609?ver=20151215
https://www.bevipclub.com/bf-vip-club-welcome

0
0

21ms
21ms

Script
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Sat, 16 Jan 2021 02:39:14 GMT
cf-cache-status: MISS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07aaa8b5b00000c27c6a015000000001
x-request-id: b2054011229ca58d3f177d888f78f796
x-runtime: 0.079433
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 61247702afcfc27c-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/js/script.js?ver=20151215
https://www.bevipclub.com/optin25413609?ver=20151215
https://www.bevipclub.com/bf-vip-club-welcome

0
0

25ms
25ms

Script
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Sat, 16 Jan 2021 02:39:14 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07aaa8b6920000c27cc602c000000001
x-request-id: 006f60ace4b68605aab8f22ff0378001
x-runtime: 0.081085
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6124770418cfc27c-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/custom.js?ver=20151215
https://www.bevipclub.com/optin25413609?ver=20151215
https://www.bevipclub.com/bf-vip-club-welcome

0
0

21ms
21ms

Script
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Sat, 16 Jan 2021 02:39:15 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07aaa8b6af0000c27ca1ac4000000001
x-request-id: ae5e6090426432e28e1682d522365bd3
x-runtime: 0.080668
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6124770448f4c27c-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/js/skip-link-focus-fix.js?ver=20151215
https://www.bevipclub.com/optin25413609?ver=20151215
https://www.bevipclub.com/bf-vip-club-welcome

0
0

34ms
33ms

Script
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Sat, 16 Jan 2021 02:39:15 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07aaa8b6a10000c27cdb3ee000000001
x-request-id: 943358c6120cc72a2bb09a5afed248a8
x-runtime: 0.071058
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6124770438e6c27c-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/theia-sticky-sidebar.js?ver=20151215
https://www.bevipclub.com/optin25413609?ver=20151215
https://www.bevipclub.com/bf-vip-club-welcome

0
0

24ms
24ms

Script
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Sat, 16 Jan 2021 02:39:14 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07aaa8b6a30000c27cb0aff000000001
x-request-id: b616aa1bf234784293eceaff6331e377
x-runtime: 0.076910
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 6124770438eac27c-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-includes/js/wp-embed.min.js?ver=5.0.3
https://www.bevipclub.com/optin25413609?ver=5.0.3
https://www.bevipclub.com/bf-vip-club-welcome

0
0

24ms
24ms

Script
text/html

2606:4700::6810:cc2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:cc2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Sat, 16 Jan 2021 02:39:15 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07aaa8b7c20000c27c541e6000000001
x-request-id: ccd3bc0bc0cbc4747c8756fbd46f97f1
x-runtime: 0.076322
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 612477060a17c27c-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H/1.1 200
OK u-440qyriQwlOrhSvowK_l5-fCZMdeX3rg.woff2
fonts.gstatic.com/s/merriweather/v22/ 12 KB
12 KB 12ms
7ms Font
font/woff2 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/merriweather/v22/u-440qyriQwlOrhSvowK_l5-fCZMdeX3rg.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Merriweather&ver=5.0.3

Protocol

HTTP/1.1

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4fa437e044d3f739bd5e4aa2d1bd94e3952e888baec655763cd7969576001da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://menbaidauone-k.ddicorp.com
Referer: http://fonts.googleapis.com/css?family=Merriweather&ver=5.0.3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 15 Jan 2021 09:30:16 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 10 Sep 2020 17:10:13 GMT
Server: sffe
Age: 61738
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 12256
X-XSS-Protection: 0
Expires: Sat, 15 Jan 2022 09:30:16 GMT

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bevipclub.com
fonts.googleapis.com
fonts.gstatic.com
menbaidauone-k.ddicorp.com
www.bevipclub.com
184.168.131.241
2606:4700::6810:cc2
2a00:1450:4001:81d::2003
2a00:1450:4001:824::200a
65.158.88.132
3391d25c152ec6ebbcf7aa8aeea676c888ab24a5298e00fc1fde75376a9b43f4
6994926563db9f34ee2dbd99aac6a322e72930feace95fccd5329f08a0689a4e
d503eb7e2282c346b59e2df1fc74b5e3ea9eb8e2e030e9c0d5c936d20eb78a56
d861c078e249dfc3b63ef8af7a5c78e8a756fd7fed5284100672d5e5f9185f8b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4fa437e044d3f739bd5e4aa2d1bd94e3952e888baec655763cd7969576001da

menbaidauone-k.ddicorp.com Open in urlscan Pro 65.158.88.132 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

25 Requests

80 %HTTPS

60 %IPv6

4 Domains

5 Subdomains

4 IPs

2 Countries

29 kBTransfer

30 kBSize

0 Cookies

4 Outgoing links

Page URL History

Redirected requests

25 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

menbaidauone-k.ddicorp.com Open in urlscan Pro
65.158.88.132 Public Scan

Screenshot
Live screenshot

Full Image

25
Requests

80 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

29 kB
Transfer

30 kB
Size

0
Cookies

25 HTTP transactions
0 data transactions