menbaidauone-k.ddicorp.com Open in urlscan Pro
65.158.88.132 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://menbaidauone-k.ddicorp.com/index.php
Effective URL:
http://menbaidauone-k.ddicorp.com/
Submission Tags: phishtake
Submission: On January 15 via api (January 15th 2021, 11:47:32 am UTC) from JP

Summary HTTP 25 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 25 HTTP transactions. The main IP is 65.158.88.132, located in Dubuque, United States and belongs to CENTURYLINK-US-LEGACY-QWEST, US. The main domain is menbaidauone-k.ddicorp.com.

This is the only time menbaidauone-k.ddicorp.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	65.158.88.132 65.158.88.132	209 (CENTURYLI...) (CENTURYLINK-US-LEGACY-QWEST)
20 20	184.168.131.241 184.168.131.241	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
20 40	2606:4700::68... 2606:4700::6810:10c2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:821::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:824::2003	15169 (GOOGLE) (GOOGLE)
25	4

2 65.158.88.132 (Dubuque, United States) 1 redirects

ASN209 (CENTURYLINK-US-LEGACY-QWEST, US)
PTR: 65-158-88-132.dia.static.qwest.net

menbaidauone-k.ddicorp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 184.168.131.241 (Scottsdale, United States) 20 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-184-168-131-241.ip.secureserver.net

bevipclub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

40 2606:4700::6810:10c2 (United States) 20 redirects

ASN13335 (CLOUDFLARENET, US)

www.bevipclub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:821::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
60	bevipclub.com 40 redirects bevipclub.com www.bevipclub.com	11 KB
3	googleapis.com fonts.googleapis.com	3 KB
2	ddicorp.com 1 redirects menbaidauone-k.ddicorp.com	14 KB
1	gstatic.com fonts.gstatic.com	12 KB
25	4

	Domain	Requested by
40	www.bevipclub.com	20 redirects menbaidauone-k.ddicorp.com
20	bevipclub.com	20 redirects
3	fonts.googleapis.com	menbaidauone-k.ddicorp.com
2	menbaidauone-k.ddicorp.com	1 redirects
1	fonts.gstatic.com	fonts.googleapis.com
25	5

This site contains links to these domains. Also see Links.

Domain
bevipclub.com
www.backyard-expressions.com
wordpress.org
www.akithemes.com

Subject Issuer	Validity	Valid
www.bevipclub.com Cloudflare Inc ECC CA-3	`2020-07-02` - `2021-07-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://menbaidauone-k.ddicorp.com/
Frame ID: C6D510FCF84EBF6A0982811DC4EFB740
Requests: 25 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://menbaidauone-k.ddicorp.com/index.php HTTP 301
http://menbaidauone-k.ddicorp.com/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i
headers server /php\/?([\d.]+)?/i
html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

Python (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:^|\s)Python(?:\/([\d.]+))?/i
headers server /mod_python(?:\/([\d.]+))?/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
headers link /rel="https:\/\/api\.w\.org\/"/i

CentOS (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /CentOS/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_python (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_python(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
headers server /mod_python(?:\/([\d.]+))?/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Slick (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /(?:\/([\d.]+))?\/slick(?:\.min)?\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
script /(?:\/([\d.]+))?\/slick(?:\.min)?\.js/i
script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

Page Statistics

25
Requests

80 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

29 kB
Transfer

30 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: http://bevipclub.com/wordpress/

Search URL Search Domain Scan URL

URL: https://www.backyard-expressions.com/
Title: Backyard-Expressions.com

Search URL Search Domain Scan URL

URL: https://wordpress.org/
Title: Proudly powered by WordPress

Search URL Search Domain Scan URL

URL: https://www.akithemes.com/
Title: Aki Themes

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://menbaidauone-k.ddicorp.com/index.php HTTP 301
http://menbaidauone-k.ddicorp.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://bevipclub.com/wordpress/wp-includes/css/dist/block-library/style.min.css?ver=5.0.3 HTTP 301
https://www.bevipclub.com/optin25413609?ver=5.0.3 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 1

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/css/bootstrap.min.css?ver=5.0.3 HTTP 301
https://www.bevipclub.com/optin25413609?ver=5.0.3 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 2

http://bevipclub.com/wordpress/wp-content/themes/free-blog/style.css?ver=5.0.3 HTTP 301
https://www.bevipclub.com/optin25413609?ver=5.0.3 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 3

http://bevipclub.com/wordpress/wp-content/themes/aki-blog/style.css?ver=1.0.1 HTTP 301
https://www.bevipclub.com/optin25413609?ver=1.0.1 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 7

http://bevipclub.com/wordpress/wp-content/themes/free-blog/css/font-awesome.min.css?ver=4.5.0 HTTP 301
https://www.bevipclub.com/optin25413609?ver=4.5.0 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 8

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/css/slick.css?ver=4.5.0 HTTP 301
https://www.bevipclub.com/optin25413609?ver=4.5.0 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 9

http://bevipclub.com/wordpress/wp-includes/js/jquery/jquery.js?ver=1.12.4 HTTP 301
https://www.bevipclub.com/optin25413609?ver=1.12.4 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 10

http://bevipclub.com/wordpress/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1 HTTP 301
https://www.bevipclub.com/optin25413609?ver=1.4.1 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 11

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/bootstrap.min.js?ver=4.6.0 HTTP 301
https://www.bevipclub.com/optin25413609?ver=4.6.0 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 12

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/slick.js?ver=4.6.0 HTTP 301
https://www.bevipclub.com/optin25413609?ver=4.6.0 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 13

http://bevipclub.com/wordpress/?wordfence_syncAttackData=1610711108.4295 HTTP 301
https://www.bevipclub.com/optin25413609?wordfence_syncAttackData=1610711108.4295 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 14

http://bevipclub.com/wordpress/wp-content/uploads/2019/01/Backyard-Logo-all-black.png HTTP 301
https://www.bevipclub.com/optin25413609 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 15

http://bevipclub.com/wordpress/wp-includes/js/wp-emoji-release.min.js?ver=5.0.3 HTTP 301
https://www.bevipclub.com/optin25413609?ver=5.0.3 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 16

http://bevipclub.com/wordpress/wp-content/uploads/2019/01/Backyard-Logo-all-white-300x92.png HTTP 301
https://www.bevipclub.com/optin25413609 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 17

http://bevipclub.com/wordpress/wp-content/themes/free-blog/js/navigation.js?ver=20151215 HTTP 301
https://www.bevipclub.com/optin25413609?ver=20151215 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 18

http://bevipclub.com/wordpress/wp-content/themes/free-blog/js/script.js?ver=20151215 HTTP 301
https://www.bevipclub.com/optin25413609?ver=20151215 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 19

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/custom.js?ver=20151215 HTTP 301
https://www.bevipclub.com/optin25413609?ver=20151215 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 20

http://bevipclub.com/wordpress/wp-content/themes/free-blog/js/skip-link-focus-fix.js?ver=20151215 HTTP 301
https://www.bevipclub.com/optin25413609?ver=20151215 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 21

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/theia-sticky-sidebar.js?ver=20151215 HTTP 301
https://www.bevipclub.com/optin25413609?ver=20151215 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

Request Chain 22

http://bevipclub.com/wordpress/wp-includes/js/wp-embed.min.js?ver=5.0.3 HTTP 301
https://www.bevipclub.com/optin25413609?ver=5.0.3 HTTP 302
https://www.bevipclub.com/bf-vip-club-welcome

25 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
menbaidauone-k.ddicorp.com/
Redirect Chain

http://menbaidauone-k.ddicorp.com/index.php
http://menbaidauone-k.ddicorp.com/

13 KB
14 KB

465ms
464ms

Document
text/html

65.158.88.132
CENTURYLINK-US-LE...

General

Check archive.org

Show headers Download Go to

Full URL: http://menbaidauone-k.ddicorp.com/
Protocol: HTTP/1.1
Server: 65.158.88.132 Dubuque, United States, ASN209 (CENTURYLINK-US-LEGACY-QWEST, US),
Reverse DNS: 65-158-88-132.dia.static.qwest.net
Software: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 mod_python/3.5.0- Python/2.7.5 PHP/7.2.34 / PHP/7.2.34
Resource Hash: f904805e65fbfc0223637cf145b53ced4e021476d4bbfe4f702868c94921c4d1

Request headers

Host: menbaidauone-k.ddicorp.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 15 Jan 2021 11:45:08 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 mod_python/3.5.0- Python/2.7.5 PHP/7.2.34
X-Powered-By: PHP/7.2.34
Link: <http://bevipclub.com/wordpress/index.php?rest_route=/>; rel="https://api.w.org/", <http://bevipclub.com/wordpress/>; rel=shortlink
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Fri, 15 Jan 2021 11:45:07 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 mod_python/3.5.0- Python/2.7.5 PHP/7.2.34
X-Powered-By: PHP/7.2.34
Location: http://menbaidauone-k.ddicorp.com/
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-includes/css/dist/block-library/style.min.css?ver=5.0.3
https://www.bevipclub.com/optin25413609?ver=5.0.3
https://www.bevipclub.com/bf-vip-club-welcome

0
0

28ms
28ms

Stylesheet
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 11:47:14 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a7780e8700004a5524370000000001
x-request-id: e5f92135f13e77a51728438528154cb7
x-runtime: 0.085475
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 611f5c5dac594a55-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/css/bootstrap.min.css?ver=5.0.3
https://www.bevipclub.com/optin25413609?ver=5.0.3
https://www.bevipclub.com/bf-vip-club-welcome

0
0

31ms
31ms

Stylesheet
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 11:47:14 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a7780eb700004a553ba7d000000001
x-request-id: 221827e4de0fd4656e0c92cb082e8f73
x-runtime: 0.075662
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 611f5c5dfd014a55-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/style.css?ver=5.0.3
https://www.bevipclub.com/optin25413609?ver=5.0.3
https://www.bevipclub.com/bf-vip-club-welcome

0
0

211ms
210ms

Stylesheet
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 11:47:13 GMT
cf-cache-status: MISS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a7780b6300004a5519b2c000000001
x-request-id: 92dbf17f33761ebfb5ced9db5b996c5d
x-runtime: 0.079681
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 611f5c589f7a4a55-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/aki-blog/style.css?ver=1.0.1
https://www.bevipclub.com/optin25413609?ver=1.0.1
https://www.bevipclub.com/bf-vip-club-welcome

0
0

45ms
45ms

Stylesheet
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 11:47:14 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a7780e7800004a556134c000000001
x-request-id: cb026faeabb287dfda06c5579cd18a49
x-runtime: 0.101698
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 611f5c5d8c0d4a55-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H/1.1 200
OK css
fonts.googleapis.com/ 2 KB
1 KB 17ms
14ms Stylesheet
text/css 2a00:1450:4001:821::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Oswald&ver=5.0.3

Requested by

Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/

Protocol

HTTP/1.1

Server

2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6994926563db9f34ee2dbd99aac6a322e72930feace95fccd5329f08a0689a4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 15 Jan 2021 11:47:12 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 15 Jan 2021 11:47:12 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Fri, 15 Jan 2021 11:47:12 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 2 KB
1 KB 32ms
25ms Stylesheet
text/css 2a00:1450:4001:821::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Merriweather&ver=5.0.3

Requested by

Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/

Protocol

HTTP/1.1

Server

2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d861c078e249dfc3b63ef8af7a5c78e8a756fd7fed5284100672d5e5f9185f8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 15 Jan 2021 11:47:12 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 15 Jan 2021 11:47:12 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Fri, 15 Jan 2021 11:47:12 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 1 KB
982 B 21ms
14ms Stylesheet
text/css 2a00:1450:4001:821::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Italianno|Niconne

Requested by

Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/

Protocol

HTTP/1.1

Server

2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d503eb7e2282c346b59e2df1fc74b5e3ea9eb8e2e030e9c0d5c936d20eb78a56

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 15 Jan 2021 11:47:12 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 15 Jan 2021 11:47:12 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Fri, 15 Jan 2021 11:47:12 GMT

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/css/font-awesome.min.css?ver=4.5.0
https://www.bevipclub.com/optin25413609?ver=4.5.0
https://www.bevipclub.com/bf-vip-club-welcome

0
0

42ms
42ms

Stylesheet
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 11:47:14 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a7780e8200004a55549d9000000001
x-request-id: f419cd6d0f0852cbf2a5b9faaea9232b
x-runtime: 0.083630
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 611f5c5d9c394a55-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/css/slick.css?ver=4.5.0
https://www.bevipclub.com/optin25413609?ver=4.5.0
https://www.bevipclub.com/bf-vip-club-welcome

0
0

242ms
241ms

Stylesheet
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 11:47:13 GMT
cf-cache-status: MISS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a7780b4700004a55219a2000000001
x-request-id: e22b05048dec57edfd5daeb7c23917ef
x-runtime: 0.082771
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 611f5c587f124a55-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-includes/js/jquery/jquery.js?ver=1.12.4
https://www.bevipclub.com/optin25413609?ver=1.12.4
https://www.bevipclub.com/bf-vip-club-welcome

0
0

27ms
27ms

Script
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 11:47:14 GMT
cf-cache-status: MISS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a7780c7f00004a5537140000000001
x-request-id: 98767fe5c76d8c639e5467ca110674e4
x-runtime: 0.082584
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 611f5c5a6c064a55-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
https://www.bevipclub.com/optin25413609?ver=1.4.1
https://www.bevipclub.com/bf-vip-club-welcome

0
0

34ms
34ms

Script
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 11:47:13 GMT
cf-cache-status: MISS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a7780cb700004a55278ae000000001
x-request-id: 1be56ba27b4dd862044684f1a379a117
x-runtime: 0.109163
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 611f5c5abce94a55-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/bootstrap.min.js?ver=4.6.0
https://www.bevipclub.com/optin25413609?ver=4.6.0
https://www.bevipclub.com/bf-vip-club-welcome

0
0

33ms
33ms

Script
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 11:47:14 GMT
cf-cache-status: MISS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a7780dcd00004a556133b000000001
x-request-id: 746b70bb8fcdf3a65831717f30d53e07
x-runtime: 0.070541
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 611f5c5c797b4a55-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/slick.js?ver=4.6.0
https://www.bevipclub.com/optin25413609?ver=4.6.0
https://www.bevipclub.com/bf-vip-club-welcome

0
0

34ms
34ms

Script
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 11:47:14 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a7780e5800004a55131ed000000001
x-request-id: 853b9e7aa1358b62500743df3afc542e
x-runtime: 0.085910
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 611f5c5d5b9b4a55-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/?wordfence_syncAttackData=1610711108.4295
https://www.bevipclub.com/optin25413609?wordfence_syncAttackData=1610711108.4295
https://www.bevipclub.com/bf-vip-club-welcome

0
0

26ms
26ms

Script
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 11:47:15 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a778140800004a553481d000000001
x-request-id: ac1409e254d3acd6fd4ce99f07514e7d
x-runtime: 0.083844
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 611f5c666b554a55-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/uploads/2019/01/Backyard-Logo-all-black.png
https://www.bevipclub.com/optin25413609
https://www.bevipclub.com/bf-vip-club-welcome

0
0

29ms
29ms

Image
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 11:47:15 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a778134700004a55243df000000001
x-request-id: fdc4ae37b712be444dadc7dd012f8355
x-runtime: 0.074651
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 611f5c6538394a55-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-includes/js/wp-emoji-release.min.js?ver=5.0.3
https://www.bevipclub.com/optin25413609?ver=5.0.3
https://www.bevipclub.com/bf-vip-club-welcome

0
0

27ms
27ms

Script
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 11:47:15 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a778141400004a553f32c000000001
x-request-id: 8e20fd947ba2daeb223bb23297a92260
x-runtime: 0.084208
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 611f5c668b9a4a55-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/uploads/2019/01/Backyard-Logo-all-white-300x92.png
https://www.bevipclub.com/optin25413609
https://www.bevipclub.com/bf-vip-club-welcome

0
0

22ms
22ms

Image
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 11:47:15 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a778124b00004a5510333000000001
x-request-id: aba447d67dc7384007fc3cd3d4355f01
x-runtime: 0.089257
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 611f5c63ac034a55-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/js/navigation.js?ver=20151215
https://www.bevipclub.com/optin25413609?ver=20151215
https://www.bevipclub.com/bf-vip-club-welcome

0
0

26ms
26ms

Script
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 11:47:15 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a778110600004a5543a46000000001
x-request-id: 0dfaa7a429fcd20f298012cc833667f4
x-runtime: 0.081097
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 611f5c61ae034a55-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/js/script.js?ver=20151215
https://www.bevipclub.com/optin25413609?ver=20151215
https://www.bevipclub.com/bf-vip-club-welcome

0
0

23ms
23ms

Script
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 11:47:15 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a77811c300004a556397a000000001
x-request-id: bda42172eac223db94608c02b3d9b0e3
x-runtime: 0.092329
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 611f5c62d9a94a55-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/custom.js?ver=20151215
https://www.bevipclub.com/optin25413609?ver=20151215
https://www.bevipclub.com/bf-vip-club-welcome

0
0

32ms
31ms

Script
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 11:47:15 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a77811cc00004a556397b000000001
x-request-id: 5e22fed92d4f91adaade01f9455099a2
x-runtime: 0.091097
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 611f5c62e9d64a55-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/js/skip-link-focus-fix.js?ver=20151215
https://www.bevipclub.com/optin25413609?ver=20151215
https://www.bevipclub.com/bf-vip-club-welcome

0
0

30ms
30ms

Script
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 11:47:15 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a77811ac00004a5512003000000001
x-request-id: e0e1b429bcc035853e3e325b47664a9b
x-runtime: 0.079275
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 611f5c62a9244a55-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-content/themes/free-blog/assets/js/theia-sticky-sidebar.js?ver=20151215
https://www.bevipclub.com/optin25413609?ver=20151215
https://www.bevipclub.com/bf-vip-club-welcome

0
0

30ms
30ms

Script
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 11:47:15 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a77811c500004a55613a6000000001
x-request-id: e3d1a55341da4733fc237c5e0d704bce
x-runtime: 0.089812
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 611f5c62d9b74a55-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H2

200

bf-vip-club-welcome Show response
www.bevipclub.com/
Redirect Chain

http://bevipclub.com/wordpress/wp-includes/js/wp-embed.min.js?ver=5.0.3
https://www.bevipclub.com/optin25413609?ver=5.0.3
https://www.bevipclub.com/bf-vip-club-welcome

0
0

90ms
90ms

Script
text/html

2606:4700::6810:10c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.bevipclub.com/bf-vip-club-welcome
Requested by: Host: menbaidauone-k.ddicorp.com
URL: http://menbaidauone-k.ddicorp.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:10c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://menbaidauone-k.ddicorp.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS

Redirect headers

date: Fri, 15 Jan 2021 11:47:15 GMT
cf-cache-status: BYPASS
access-control-allow-origin: *
x-powered-by: Phusion Passenger Enterprise 6.0.7
status: 302 Found
strict-transport-security: max-age=0
cf-request-id: 07a77811bf00004a556d171000000001
x-request-id: 33bec9b3f42e008f5a4264397cce65ea
x-runtime: 0.074973
server: cloudflare
x-frame-options: ALLOWALL
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
content-type: text/html; charset=utf-8
location: https://www.bevipclub.com/bf-vip-club-welcome
cache-control: no-cache, private
access-control-allow-credentials: true
cf-ray: 611f5c62c99e4a55-FRA
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
x-rack-cache: miss

GET
H/1.1 200
OK u-440qyriQwlOrhSvowK_l5-fCZMdeX3rg.woff2
fonts.gstatic.com/s/merriweather/v22/ 12 KB
12 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:824::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/merriweather/v22/u-440qyriQwlOrhSvowK_l5-fCZMdeX3rg.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Merriweather&ver=5.0.3

Protocol

HTTP/1.1

Server

2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4fa437e044d3f739bd5e4aa2d1bd94e3952e888baec655763cd7969576001da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://menbaidauone-k.ddicorp.com
Referer: http://fonts.googleapis.com/css?family=Merriweather&ver=5.0.3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 13 Jan 2021 07:02:17 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 10 Sep 2020 17:10:13 GMT
Server: sffe
Age: 189897
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 12256
X-XSS-Protection: 0
Expires: Thu, 13 Jan 2022 07:02:17 GMT

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bevipclub.com
fonts.googleapis.com
fonts.gstatic.com
menbaidauone-k.ddicorp.com
www.bevipclub.com
184.168.131.241
2606:4700::6810:10c2
2a00:1450:4001:821::200a
2a00:1450:4001:824::2003
65.158.88.132
6994926563db9f34ee2dbd99aac6a322e72930feace95fccd5329f08a0689a4e
d503eb7e2282c346b59e2df1fc74b5e3ea9eb8e2e030e9c0d5c936d20eb78a56
d861c078e249dfc3b63ef8af7a5c78e8a756fd7fed5284100672d5e5f9185f8b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4fa437e044d3f739bd5e4aa2d1bd94e3952e888baec655763cd7969576001da
f904805e65fbfc0223637cf145b53ced4e021476d4bbfe4f702868c94921c4d1

menbaidauone-k.ddicorp.com Open in urlscan Pro 65.158.88.132 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

25 Requests

80 %HTTPS

60 %IPv6

4 Domains

5 Subdomains

4 IPs

2 Countries

29 kBTransfer

30 kBSize

0 Cookies

4 Outgoing links

Page URL History

Redirected requests

25 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

menbaidauone-k.ddicorp.com Open in urlscan Pro
65.158.88.132 Public Scan

Screenshot
Live screenshot

Full Image

25
Requests

80 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

29 kB
Transfer

30 kB
Size

0
Cookies

25 HTTP transactions
0 data transactions