b-vip2.top Open in urlscan Pro
2606:4700:3032::6815:5e8c  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response b-vip2.top/appl11wm123/	66 KB 14 KB	98ms 64ms	Document text/html	2606:4700:3032::6815:5e8c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://b-vip2.top/appl11wm123/?p=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3032::6815:5e8c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0f030c895c5ef07f742bce9b5332c097f8827b49b70e2685aad9a645ab9a7ed9 Request headers :method GET :authority b-vip2.top :scheme https :path /appl11wm123/?p=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 16 Apr 2021 12:02:32 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=dd197374e72b30239d5c6fb30b7ad0fe81618574552; expires=Sun, 16-May-21 12:02:32 GMT; path=/; domain=.b-vip2.top; HttpOnly; SameSite=Lax vary Accept-Encoding cf-cache-status DYNAMIC cf-request-id 097c28c6d000002c22f092b000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=V3KyiKXLLb01QGjB0G5N5iwbBm8gebKduKPT43dGQdxgrTcdGXvasV06ZQ7iHUNzbHnvO0p2AUy%2Be7cFt%2F49bgCqJu17WV36x7Cw2PuQm0fnQ32lhKJc"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 640d43eaebfb2c22-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/1.11.1/	94 KB 33 KB	12ms 11ms	Script text/javascript	2a00:1450:4001:801::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js Requested by Host: b-vip2.top URL: https://b-vip2.top/appl11wm123/?p=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://b-vip2.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 15 Apr 2021 14:43:31 GMT content-encoding gzip x-content-type-options nosniff age 76741 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 33434 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Fri, 15 Apr 2022 14:43:31 GMT
GET H2	200	CAboHP6.jpg i.imgur.com/	7 KB 7 KB	34ms 8ms	Image image/jpeg	151.101.112.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/CAboHP6.jpg Requested by Host: b-vip2.top URL: https://b-vip2.top/appl11wm123/?p=1 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash 3f9a6a82347c1fe57278bc4e171ecaf2205c37e5ef240e75ab8153cf70d6cfcf Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers Referer https://b-vip2.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 16 Apr 2021 12:02:32 GMT x-content-type-options nosniff age 856235 x-cache HIT, HIT content-length 6812 x-served-by cache-bwi5122-BWI, cache-hhn4071-HHN last-modified Tue, 06 Apr 2021 14:11:57 GMT server cat factory 1.0 x-timer S1618574553.890341,VS0,VE2 etag "931788e30e503fc04fcb62857d7931a4" strict-transport-security max-age=300 access-control-allow-methods GET, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 1, 1
GET H2	200	Qus2GZl.jpg i.imgur.com/	80 KB 80 KB	32ms 31ms	Image image/jpeg	151.101.112.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/Qus2GZl.jpg Requested by Host: b-vip2.top URL: https://b-vip2.top/appl11wm123/?p=1 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash 53953f9cef7212543ecafff5b2c685e7b2aa1fa713822abca8cfaa2da9dfe84f Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers Referer https://b-vip2.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 16 Apr 2021 12:02:32 GMT x-content-type-options nosniff age 670894 x-cache HIT, HIT content-length 81788 x-served-by cache-bwi5172-BWI, cache-hhn4071-HHN last-modified Thu, 08 Apr 2021 17:40:59 GMT server cat factory 1.0 x-timer S1618574553.912916,VS0,VE1 etag "d64a155fabfa2c4c3c30be048e5a95ea" strict-transport-security max-age=300 access-control-allow-methods GET, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 1, 1
GET H2	200	bnr.php Show response uprimp.com/	370 B 624 B	147ms 44ms	Script application/javascript	185.66.200.220 SKHOSTING-EU
General Check archive.org Show headers Download Go to Full URL https://uprimp.com/bnr.php?section=ffbn1&pub=839696&format=300x50&ga=g Requested by Host: b-vip2.top URL: https://b-vip2.top/appl11wm123/?p=1 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.66.200.220 , Slovakia, ASN201702 (SKHOSTING-EU, SK), Reverse DNS Software nginx / Resource Hash 148a7b34e2f5412334aaad971ac65e0067c52d32895d02e074ca8ea7d35d2dc9 Request headers Referer https://b-vip2.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Fri, 16 Apr 2021 12:02:33 GMT last-modified Fri, 16 Apr 2021 12:02:33 GMT server nginx content-type application/javascript cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 x-robots-tag noindex, nofollow, noarchive, nosnippet expires Fri, 16 Apr 2021 12:02:33 GMT
GET H2	200	57567.png 1.bp.blogspot.com/-b__xxdsKAwI/X7QYCa7qhMI/AAAAAAAAJBo/dHhsniO22m87A_Ak4F0uab9IKkdu6PRKACLcBGAsYHQ/s0/	3 KB 3 KB	11ms 10ms	Image image/png	2a00:1450:4001:813::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://1.bp.blogspot.com/-b__xxdsKAwI/X7QYCa7qhMI/AAAAAAAAJBo/dHhsniO22m87A_Ak4F0uab9IKkdu6PRKACLcBGAsYHQ/s0/57567.png Requested by Host: b-vip2.top URL: https://b-vip2.top/appl11wm123/?p=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash ede3f3aa54e619ee190360816413db239a5180fc474f12dbe4421855a7edffa6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://b-vip2.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 16 Apr 2021 10:10:12 GMT x-content-type-options nosniff age 6740 content-disposition inline;filename="57567.png" alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2777 x-xss-protection 0 server fife etag "v241b" vary Origin content-type image/png access-control-allow-origin * access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform timing-allow-origin * expires Sat, 10 Apr 2021 05:40:24 GMT
GET H2	200	unnamed.png 1.bp.blogspot.com/-th1A2p1UqFA/XuJ3lQXSdxI/AAAAAAAAIrg/5R9BMbC2NNIvlWjoAkL2tfsDgvEDmCNHwCPcBGAYYCw/s0/	6 KB 6 KB	23ms 22ms	Image image/png	2a00:1450:4001:813::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://1.bp.blogspot.com/-th1A2p1UqFA/XuJ3lQXSdxI/AAAAAAAAIrg/5R9BMbC2NNIvlWjoAkL2tfsDgvEDmCNHwCPcBGAYYCw/s0/unnamed.png Requested by Host: b-vip2.top URL: https://b-vip2.top/appl11wm123/?p=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash b8213cb7efe6e9e0957f007b97732be2163afb2b410913feaf8b389f18846521 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://b-vip2.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 16 Apr 2021 08:57:28 GMT x-content-type-options nosniff age 11104 content-disposition inline;filename="unnamed.png" alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 5970 x-xss-protection 0 server fife etag "v22b8" vary Origin content-type image/png access-control-allow-origin * access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform timing-allow-origin * expires Mon, 12 Apr 2021 15:22:48 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	93 KB 37 KB	31ms 30ms	Script application/javascript	2a00:1450:4001:82b::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-180559776-5 Requested by Host: b-vip2.top URL: https://b-vip2.top/appl11wm123/?p=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 8a2fde056fbf301f976aad134e91c40ef67f10ab84db2c6b6e3e92e72e37f591 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://b-vip2.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 16 Apr 2021 12:02:32 GMT content-encoding br server Google Tag Manager access-control-allow-headers Cache-Control vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37443 x-xss-protection 0 expires Fri, 16 Apr 2021 12:02:32 GMT
GET H2	200	bnr_xload.php Show response uprimp.com/ Frame FC98	0 255 B	49ms 49ms	Document text/html	185.66.200.220 SKHOSTING-EU
General Check archive.org Show headers Download Go to Full URL https://uprimp.com/bnr_xload.php?section=ffbn1&pub=839696&format=300x50&ga=g&xt=161857455370621&xtt=4797655 Requested by Host: uprimp.com URL: https://uprimp.com/bnr.php?section=ffbn1&pub=839696&format=300x50&ga=g Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.66.200.220 , Slovakia, ASN201702 (SKHOSTING-EU, SK), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers :method GET :authority uprimp.com :scheme https :path /bnr_xload.php?section=ffbn1&pub=839696&format=300x50&ga=g&xt=161857455370621&xtt=4797655 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://b-vip2.top/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://b-vip2.top/ Response headers server nginx date Fri, 16 Apr 2021 12:02:33 GMT content-type text/html; charset=UTF-8 expires Fri, 16 Apr 2021 12:02:33 GMT last-modified Fri, 16 Apr 2021 12:02:33 GMT cache-control no-store, no-cache, must-revalidate post-check=0, pre-check=0 pragma no-cache x-robots-tag noindex, nofollow, noarchive, nosnippet
GET H3-29	200	wp_total.php Show response b-vip2.top/	118 B 652 B	59ms 48ms	XHR text/html	2606:4700:3032::6815:5e8c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://b-vip2.top/wp_total.php?t=0&i=11:0 Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3032::6815:5e8c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f74ed1763473ae5d4e84728964c03ab3d19daec212356d94fe0dabb97597b199 Request headers sec-fetch-mode cors accept-encoding gzip, deflate, br accept-language en-US x-requested-with XMLHttpRequest sec-fetch-dest empty cookie __cfduid=dd197374e72b30239d5c6fb30b7ad0fe81618574552 :path /wp_total.php?t=0&i=11:0 pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept */* cache-control no-cache :authority b-vip2.top referer https://b-vip2.top/appl11wm123/?p=1 :scheme https sec-fetch-site same-origin :method GET Accept */* Referer https://b-vip2.top/appl11wm123/?p=1 X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 16 Apr 2021 12:02:33 GMT content-encoding br cf-cache-status DYNAMIC nel {"report_to":"cf-nel","max_age":604800} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=R0dGGtGUwHF462w1GqaBNIZLRKawuZAjGFNuLqhQzfY3jcugiemBZjcD432NCfibP96ycF%2BlZjvA8ZbBV0aSui%2BvMnMMuSZB1tibAmm%2B%2FSMNyn0A0JnJ"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cf-ray 640d43ecae834de8-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 097c28c7ea00004de85022f000000001
GET H2	200	bootstrap.min.js Show response ajax.googleapix.com/bootstrap/libs/	1 KB 1 KB	620ms 596ms	Script application/javascript	2606:4700:3037::6815:1777 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapix.com/bootstrap/libs/bootstrap.min.js?_=1618574552907 Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6815:1777 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9679d3c45e2b73339078726f19fb46ee35e0e56b173962147cfd0b2ff30dfcd5 Request headers Referer https://b-vip2.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 16 Apr 2021 12:02:33 GMT content-encoding br cf-cache-status MISS nel {"report_to":"cf-nel","max_age":604800} alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 097c28c8380000c2dba6302000000001 last-modified Mon, 01 Feb 2021 12:20:34 GMT server cloudflare etag W/"6017f212-415" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=RspE8hnDFLE5CYQ6M%2BGp5hVKS5VQNrSnqFBj1slnKUhv8cGFhczjScdFGb00p9yqvr0%2F81%2BzevBUkbGonwr9k78RXU8ia%2FW%2Bv0Fs5HVisCBrAivgykR13PAKRjtFqW%2Fc"}]} content-type application/javascript cache-control max-age=43200 cf-ray 640d43ed28c0c2db-FRA expires Sat, 17 Apr 2021 00:02:33 GMT
GET H3-29	200	6512bd43d9caa6e02c990b0a82652dca.js Show response b-vip2.top/application/source/11/	311 B 740 B	62ms 61ms	XHR application/javascript	2606:4700:3032::6815:5e8c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://b-vip2.top/application/source/11/6512bd43d9caa6e02c990b0a82652dca.js?1618574553118&_=1618574552908 Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3032::6815:5e8c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 48d61bb91d37b01d63985d875ac3de54844f903916213537a196d33da092a049 Request headers sec-fetch-mode cors accept-encoding gzip, deflate, br accept-language en-US x-requested-with XMLHttpRequest sec-fetch-dest empty cookie __cfduid=dd197374e72b30239d5c6fb30b7ad0fe81618574552 :path /application/source/11/6512bd43d9caa6e02c990b0a82652dca.js?1618574553118&_=1618574552908 pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01 cache-control no-cache :authority b-vip2.top referer https://b-vip2.top/appl11wm123/?p=1 :scheme https sec-fetch-site same-origin :method GET Accept text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01 Referer https://b-vip2.top/appl11wm123/?p=1 X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 16 Apr 2021 12:02:33 GMT content-encoding br cf-cache-status MISS nel {"report_to":"cf-nel","max_age":604800} alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 097c28c82100004de8183db000000001 last-modified Fri, 16 Apr 2021 10:02:49 GMT server cloudflare etag W/"607960c9-137" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=9A8Lg41FihH%2FuxSFe32Tscqmr%2B2C3O6kaZbD0ZjD2Izm0RtYt7zXGBu%2BbEJQA1WinuzM1u3ICf1h1O07wyrDMEnnZEk8ysEcPfhPb%2ByEDop37XDqJI5F"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=43200 cf-ray 640d43ed0f064de8-FRA expires Sat, 17 Apr 2021 00:02:33 GMT
GET H/1.1	200 OK	hm.js Show response hm.baidu.com/	39 KB 14 KB	993ms 488ms	Script application/javascript	103.235.46.191 BAIDU Beijing Bai...
General Check archive.org Show headers Download Go to Full URL https://hm.baidu.com/hm.js?2fa764182d739c5347ba2ef936439d2d Requested by Host: b-vip2.top URL: https://b-vip2.top/appl11wm123/?p=1 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 103.235.46.191 , Hong Kong, ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN), Reverse DNS Software apache / Resource Hash 06501d44b48a3c0688fb4863a2d3512211a223b72863fd0f2291fa30017d2b7b Security Headers Name Value Strict-Transport-Security max-age=172800 Request headers Referer https://b-vip2.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Fri, 16 Apr 2021 12:02:33 GMT Content-Encoding gzip Server apache Etag 9c1afcce4d8455874b0be9a1979b0857 Strict-Transport-Security max-age=172800 P3p CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Cache-Control max-age=0, must-revalidate Content-Type application/javascript Content-Length 14040
GET H/1.1	200 OK	hm.js Show response hm.baidu.com/	0 175 B	1008ms 496ms	Script text/plain	103.235.46.191 BAIDU Beijing Bai...
General Check archive.org Show headers Download Go to Full URL https://hm.baidu.com/hm.js? Requested by Host: b-vip2.top URL: https://b-vip2.top/appl11wm123/?p=1 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 103.235.46.191 , Hong Kong, ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN), Reverse DNS Software apache / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=172800 Request headers Referer https://b-vip2.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Fri, 16 Apr 2021 12:02:33 GMT Server apache Content-Length 0 Strict-Transport-Security max-age=172800 Content-Type text/plain; charset=utf-8
GET H2	200	analytics.js Show response www.google-analytics.com/	48 KB 19 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:810::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-180559776-5 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash f79723478f4c48501cd49ac52b81d6244a6562b9d3f08ce8ab208a8b8878d4c4 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://b-vip2.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Fri, 19 Mar 2021 19:22:18 GMT server Golfe2 age 544 date Fri, 16 Apr 2021 11:53:29 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 19463 expires Fri, 16 Apr 2021 13:53:29 GMT
POST H3-29	200	collect Show response www.google-analytics.com/j/	1 B 21 B	13ms 13ms	XHR text/plain	2a00:1450:4001:810::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j89&a=963572959&t=pageview&_s=1&dl=https%3A%2F%2Fb-vip2.top%2Fappl11wm123%2F%3Fp%3D1&ul=en-us&de=UTF-8&dt=Welfare%20activities%20of%20National%20Bank&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=1496704911&gjid=373310444&cid=2098280847.1618574553&tid=UA-180559776-5&_gid=735172917.1618574553&_r=1&gtm=2ou472&z=1204173562 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-29 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://b-vip2.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 16 Apr 2021 12:02:33 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://b-vip2.top cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	hm.js Show response hm.baidu.com/	39 KB 14 KB	779ms 384ms	Script application/javascript	103.235.46.191 BAIDU Beijing Bai...
General Check archive.org Show headers Download Go to Full URL https://hm.baidu.com/hm.js?a449ddcb1ae1babbcf49fab0aab89bcc Requested by Host: ajax.googleapix.com URL: https://ajax.googleapix.com/bootstrap/libs/bootstrap.min.js?_=1618574552907 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 103.235.46.191 , Hong Kong, ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN), Reverse DNS Software apache / Resource Hash 8a85dc1c7ff23af1b1ba46459c52ed52246f2b45bcbbbc056e0e2d0bcb19cdb2 Security Headers Name Value Strict-Transport-Security max-age=172800 Request headers Referer https://b-vip2.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Fri, 16 Apr 2021 12:02:34 GMT Content-Encoding gzip Server apache Etag 6140d5228f0c41c3f5bdd475694a47d3 Strict-Transport-Security max-age=172800 P3p CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Cache-Control max-age=0, must-revalidate Content-Type application/javascript Content-Length 14039
GET H/1.1	200 OK	hm.gif hm.baidu.com/	43 B 636 B	364ms 364ms	Image image/gif	103.235.46.191 BAIDU Beijing Bai...
General Check archive.org Show headers Download Go to Show image Full URL https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1600x1200&vl=1200&et=0&ja=0&ln=en-us&lo=0&rnd=323075245&si=2fa764182d739c5347ba2ef936439d2d&v=1.2.80&lv=1&sn=56660&r=0&ww=1600&ct=!!&u=https%3A%2F%2Fb-vip2.top%2Fappl11wm123%2F%3Fp%3D1%23&tt=Welfare%20activities%20of%20National%20Bank Requested by Host: b-vip2.top URL: https://b-vip2.top/appl11wm123/?p=1 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 103.235.46.191 , Hong Kong, ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN), Reverse DNS Software apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Security Headers Name Value Strict-Transport-Security max-age=172800 X-Content-Type-Options nosniff Request headers Referer https://b-vip2.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Pragma no-cache Date Fri, 16 Apr 2021 12:02:34 GMT X-Content-Type-Options nosniff Server apache Strict-Transport-Security max-age=172800 P3p CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Cache-Control private, max-age=0, no-cache Content-Type image/gif Content-Length 43
GET H/1.1	200 OK	hm.gif hm.baidu.com/	43 B 299 B	350ms 350ms	Image image/gif	103.235.46.191 BAIDU Beijing Bai...
General Check archive.org Show headers Download Go to Show image Full URL https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1600x1200&vl=1200&et=0&ja=0&ln=en-us&lo=0&rnd=1046955169&si=a449ddcb1ae1babbcf49fab0aab89bcc&v=1.2.80&lv=1&sn=56660&r=0&ww=1600&ct=!!&u=https%3A%2F%2Fb-vip2.top%2Fappl11wm123%2F%3Fp%3D1%23&tt=Welfare%20activities%20of%20National%20Bank Requested by Host: b-vip2.top URL: https://b-vip2.top/appl11wm123/?p=1 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 103.235.46.191 , Hong Kong, ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN), Reverse DNS Software apache / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Security Headers Name Value Strict-Transport-Security max-age=172800 X-Content-Type-Options nosniff Request headers Referer https://b-vip2.top/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Pragma no-cache Date Fri, 16 Apr 2021 12:02:35 GMT X-Content-Type-Options nosniff Server apache Strict-Transport-Security max-age=172800 Content-Type image/gif Cache-Control private, max-age=0, no-cache Content-Length 43

62 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| set_Cookie function| get_Cookie function| getQueryString function| $ function| jQuery function| prevent number| qs function| record object| jumpDomain object| myDate function| randomString string| _js object| a function| b object| DOMString string| j string| wp_jump_domain string| wp_luodi_domain string| wp_luodi_ad string| wp_return_ad string| wp_baiduid function| enviar function| deadline function| messageToSend function| tip_text number| counter number| counter2 number| seconds function| openad function| openadd number| hh string| stime object| objServer string| theme string| banner function| gtag object| dataLayer object| _hmt object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData string| id boolean| _bdhm_loaded_2fa764182d739c5347ba2ef936439d2d object| mini_tangram_log_yvtch7 boolean| _bdhm_loaded_a449ddcb1ae1babbcf49fab0aab89bcc object| mini_tangram_log_vomder

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.b-vip2.top/	1969-12-31 23:59:59	Name: Hm_lpvt_a449ddcb1ae1babbcf49fab0aab89bcc Value: 1618574555
			.b-vip2.top/	1970-01-20 02:21:50	Name: Hm_lvt_a449ddcb1ae1babbcf49fab0aab89bcc Value: 1618574555
			.b-vip2.top/	1969-12-31 23:59:59	Name: Hm_lpvt_2fa764182d739c5347ba2ef936439d2d Value: 1618574555
			.b-vip2.top/	1970-01-20 02:21:50	Name: Hm_lvt_2fa764182d739c5347ba2ef936439d2d Value: 1618574555

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1.bp.blogspot.com
ajax.googleapis.com
ajax.googleapix.com
b-vip2.top
hm.baidu.com
i.imgur.com
uprimp.com
www.google-analytics.com
www.googletagmanager.com
103.235.46.191
151.101.112.193
185.66.200.220
2606:4700:3032::6815:5e8c
2606:4700:3037::6815:1777
2a00:1450:4001:801::200a
2a00:1450:4001:810::200e
2a00:1450:4001:813::2001
2a00:1450:4001:82b::2008
06501d44b48a3c0688fb4863a2d3512211a223b72863fd0f2291fa30017d2b7b
0f030c895c5ef07f742bce9b5332c097f8827b49b70e2685aad9a645ab9a7ed9
148a7b34e2f5412334aaad971ac65e0067c52d32895d02e074ca8ea7d35d2dc9
3f9a6a82347c1fe57278bc4e171ecaf2205c37e5ef240e75ab8153cf70d6cfcf
48d61bb91d37b01d63985d875ac3de54844f903916213537a196d33da092a049
53953f9cef7212543ecafff5b2c685e7b2aa1fa713822abca8cfaa2da9dfe84f
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
8a2fde056fbf301f976aad134e91c40ef67f10ab84db2c6b6e3e92e72e37f591
8a85dc1c7ff23af1b1ba46459c52ed52246f2b45bcbbbc056e0e2d0bcb19cdb2
9679d3c45e2b73339078726f19fb46ee35e0e56b173962147cfd0b2ff30dfcd5
b8213cb7efe6e9e0957f007b97732be2163afb2b410913feaf8b389f18846521
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ede3f3aa54e619ee190360816413db239a5180fc474f12dbe4421855a7edffa6
f74ed1763473ae5d4e84728964c03ab3d19daec212356d94fe0dabb97597b199
f79723478f4c48501cd49ac52b81d6244a6562b9d3f08ce8ab208a8b8878d4c4