research.checkpoint.com Open in urlscan Pro
2a02:26f0:6c00:19e::38f0 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Submission: On May 06 via api (May 6th 2019, 4:50:40 pm UTC) from CH

Summary HTTP 86 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 25 IPs in 5 countries across 21 domains to perform 86 HTTP transactions. The main IP is 2a02:26f0:6c00:19e::38f0, located in European Union and belongs to AKAMAI-ASN1, US. The main domain is research.checkpoint.com.
TLS certificate: Issued by DigiCert ECC Secure Server CA on October 29th 2018. Valid for: a year.

This is the only time research.checkpoint.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 4	2a02:26f0:6c0... 2a02:26f0:6c00:19e::38f0	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
38	2a02:26f0:6c0... 2a02:26f0:6c00:18d::38f0	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	23.111.9.35 23.111.9.35	33438 (HIGHWINDS2) (HIGHWINDS2 - Highwinds Network Group)
1	205.185.208.52 205.185.208.52	20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group)
8	2.19.32.109 2.19.32.109	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	2.19.43.118 2.19.43.118	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:824::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
5	2a00:1450:400... 2a00:1450:4001:81f::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a02:26f0:f1:... 2a02:26f0:f1:280::3adf	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700::68... 2606:4700::6813:9308	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	151.101.120.157 151.101.120.157	54113 (FASTLY) (FASTLY - Fastly)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER - Twitter Inc.)
2 2	2a00:1450:400... 2a00:1450:400c:c08::9a	15169 (GOOGLE) (GOOGLE - Google LLC)
2 2	2a00:1450:400... 2a00:1450:4001:825::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:81a::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a03:2880:f01... 2a03:2880:f01c:216:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK - Facebook)
1	2.21.37.220 2.21.37.220	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2 3	2a05:f500:11:... 2a05:f500:11:101::b93f:9005	14413 (LINKEDIN) (LINKEDIN - LinkedIn Corporation)
1 1	2620:109:c002... 2620:109:c002::6cae:a0a	14413 (LINKEDIN) (LINKEDIN - LinkedIn Corporation)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER - Twitter Inc.)
1	2.16.186.243 2.16.186.243	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	184.31.84.223 184.31.84.223	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	151.101.2.2 151.101.2.2	54113 (FASTLY) (FASTLY - Fastly)
1	50.31.142.19 50.31.142.19	22075 (AS-OUTBRAIN) (AS-OUTBRAIN - Outbrain)
2	2a03:2880:f11... 2a03:2880:f11c:8083:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK - Facebook)
1 3	18.184.119.244 18.184.119.244	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	23.38.58.100 23.38.58.100	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	192.28.144.124 192.28.144.124	53580 (MARKETO) (MARKETO - MARKETO)
86	25

4 2a02:26f0:6c00:19e::38f0 (European Union) 1 redirects

ASN20940 (AKAMAI-ASN1, US)

research.checkpoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

38 2a02:26f0:6c00:18d::38f0 (European Union)

ASN20940 (AKAMAI-ASN1, US)

research.checkpoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.111.9.35 (Phoenix, United States)

ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.208.52 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2.19.32.109 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-19-32-109.deploy.static.akamaitechnologies.com

sc1.checkpoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2.19.43.118 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-19-43-118.deploy.static.akamaitechnologies.com

platform-api.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
buttons-config.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
platform-cdn.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:81f::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:f1:280::3adf (European Union)

ASN20940 (AKAMAI-ASN1, US)

sjs.bizographics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:9308 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.120.157 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (San Francisco, United States)

ASN13414 (TWITTER - Twitter Inc., US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c08::9a (Ireland) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:825::2004 (Ireland) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81a::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:216:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.21.37.220 (France)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-21-37-220.deploy.static.akamaitechnologies.com

amplify.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a05:f500:11:101::b93f:9005 (Ireland) 2 redirects

ASN14413 (LINKEDIN - LinkedIn Corporation, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:109:c002::6cae:a0a (United States) 1 redirects

ASN14413 (LINKEDIN - LinkedIn Corporation, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (San Francisco, United States)

ASN13414 (TWITTER - Twitter Inc., US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.186.243 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-243.deploy.static.akamaitechnologies.com

c.sharethis.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 184.31.84.223 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a184-31-84-223.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.2.2 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)

tr.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 50.31.142.19 (Chicago, United States)

ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US)
PTR: chi.outbrain.com

amplifypixel.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8083:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.184.119.244 (Cambridge, United States) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-184-119-244.eu-central-1.compute.amazonaws.com

l.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.38.58.100 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-38-58-100.deploy.static.akamaitechnologies.com

t.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (San Mateo, United States)

ASN53580 (MARKETO - MARKETO, Inc., US)

750-dqh-528.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
50	checkpoint.com 1 redirects research.checkpoint.com sc1.checkpoint.com	3 MB
11	sharethis.com 1 redirects platform-api.sharethis.com buttons-config.sharethis.com l.sharethis.com platform-cdn.sharethis.com t.sharethis.com	35 KB
5	google-analytics.com www.google-analytics.com	54 KB
4	linkedin.com 3 redirects px.ads.linkedin.com www.linkedin.com	2 KB
3	outbrain.com amplify.outbrain.com tr.outbrain.com amplifypixel.outbrain.com	3 KB
2	facebook.com www.facebook.com	250 B
2	marketo.net munchkin.marketo.net	5 KB
2	facebook.net connect.facebook.net	60 KB
2	google.de www.google.de	218 B
2	google.com 2 redirects www.google.com	363 B
2	doubleclick.net 2 redirects stats.g.doubleclick.net	317 B
1	mktoresp.com 750-dqh-528.mktoresp.com	272 B
1	consensu.org c.sharethis.mgr.consensu.org
1	twitter.com analytics.twitter.com	265 B
1	t.co t.co	166 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	crazyegg.com script.crazyegg.com	325 B
1	bizographics.com sjs.bizographics.com	5 KB
1	googletagmanager.com www.googletagmanager.com	34 KB
1	jquery.com code.jquery.com	30 KB
1	fontawesome.com use.fontawesome.com	13 KB
86	21

	Domain	Requested by
42	research.checkpoint.com	1 redirects research.checkpoint.com
8	sc1.checkpoint.com	research.checkpoint.com
5	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com research.checkpoint.com
4	platform-cdn.sharethis.com	research.checkpoint.com
3	l.sharethis.com	1 redirects research.checkpoint.com
3	px.ads.linkedin.com	2 redirects research.checkpoint.com
2	t.sharethis.com	platform-api.sharethis.com t.sharethis.com
2	www.facebook.com	research.checkpoint.com connect.facebook.net
2	munchkin.marketo.net	research.checkpoint.com munchkin.marketo.net
2	connect.facebook.net	research.checkpoint.com connect.facebook.net
2	www.google.de	research.checkpoint.com
2	www.google.com	2 redirects
2	stats.g.doubleclick.net	2 redirects
1	750-dqh-528.mktoresp.com	munchkin.marketo.net
1	amplifypixel.outbrain.com	research.checkpoint.com
1	tr.outbrain.com	research.checkpoint.com
1	c.sharethis.mgr.consensu.org	platform-api.sharethis.com
1	analytics.twitter.com	static.ads-twitter.com
1	www.linkedin.com	1 redirects
1	buttons-config.sharethis.com	platform-api.sharethis.com
1	amplify.outbrain.com	research.checkpoint.com
1	t.co	research.checkpoint.com
1	static.ads-twitter.com	www.googletagmanager.com
1	script.crazyegg.com	www.googletagmanager.com
1	sjs.bizographics.com	www.googletagmanager.com
1	www.googletagmanager.com	research.checkpoint.com
1	platform-api.sharethis.com	research.checkpoint.com
1	code.jquery.com	research.checkpoint.com
1	use.fontawesome.com	research.checkpoint.com
86	29

This site contains links to these domains. Also see Links.

Domain
www.checkpoint.com
www.facebook.com
plus.google.com
www.linkedin.com
twitter.com
threatemulation.checkpoint.com
www.cpcheckme.com
threatmap.checkpoint.com
www.buzzfeednews.com
blog.checkpoint.com
bit.ly

Subject Issuer	Validity	Valid
*.checkpoint.com DigiCert ECC Secure Server CA	`2018-10-29` - `2020-01-28`	a year	crt.sh
*.fontawesome.com DigiCert SHA2 Secure Server CA	`2018-09-17` - `2019-11-21`	a year	crt.sh
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh
*.sharethis.com DigiCert SHA2 Secure Server CA	`2018-12-16` - `2020-03-16`	a year	crt.sh
*.google-analytics.com Google Internet Authority G3	`2019-04-16` - `2019-07-09`	3 months	crt.sh
js.bizographics.com DigiCert SHA2 Secure Server CA	`2018-04-13` - `2020-04-17`	2 years	crt.sh
ssl945600.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2018-12-20` - `2019-09-18`	9 months	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2018-08-16` - `2019-08-21`	a year	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2019-03-07` - `2020-03-07`	a year	crt.sh
www.google.de Google Internet Authority G3	`2019-04-16` - `2019-07-09`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2019-03-08` - `2019-06-06`	3 months	crt.sh
*.outbrain.com DigiCert SHA2 Secure Server CA	`2018-12-14` - `2020-03-14`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2017-06-06` - `2019-06-11`	2 years	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2019-01-28` - `2020-01-28`	a year	crt.sh
*.sharethis.mgr.consensu.org DigiCert ECC Secure Server CA	`2018-07-31` - `2019-07-31`	a year	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2018-12-24` - `2020-03-24`	a year	crt.sh
f2.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-04-01` - `2019-09-07`	5 months	crt.sh
cert1.a1.atm.aqfer.net Let's Encrypt Authority X3	`2019-02-21` - `2019-05-22`	3 months	crt.sh
*.mktoresp.com GeoTrust RSA CA 2018	`2018-02-05` - `2020-02-05`	2 years	crt.sh

This page contains 4 frames:

Primary Page: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Frame ID: FD27B6BB38698596ED6C0B90FA6D6B86
Requests: 83 HTTP requests in this frame

Frame: https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Frame ID: F2AC5E961310051486F038EB79AD74DF
Requests: 1 HTTP requests in this frame

Frame: https://t.sharethis.com/a/t_.htm?ver=0.244.10679&cid=c010&cls=B
Frame ID: CF008474DF18195558E7FB858A3C4C0E
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 7B4ECAB08B5F5A9E7967CDB7F93824A8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play HTTP 301
http://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/ HTTP 307
https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+wp-(?:content|includes)/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+wp-(?:content|includes)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

env /^CE2$/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

env /^google_tag_manager$/i

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

script /munchkin\.marketo\.net\/munchkin\.js/i
env /^Munchkin$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Twitter Bootstrap () Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i

Page Statistics

86
Requests

100 %
HTTPS

46 %
IPv6

21
Domains

29
Subdomains

25
IPs

5
Countries

3671 kB
Transfer

4468 kB
Size

1
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://www.checkpoint.com/
Title: CheckPoint.com

Search URL Search Domain Scan URL

URL: https://www.facebook.com/checkpointsoftware

Search URL Search Domain Scan URL

URL: https://plus.google.com/+checkpoint/posts

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/check-point-software-technologies

Search URL Search Domain Scan URL

URL: https://twitter.com/_cpresearch_

Search URL Search Domain Scan URL

URL: https://threatemulation.checkpoint.com/
Title: SandBlast File Analysis

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/urlcat/
Title: URL Categorization

Search URL Search Domain Scan URL

URL: http://www.cpcheckme.com/checkme/
Title: Instant Security Assessment

Search URL Search Domain Scan URL

URL: https://threatmap.checkpoint.com/ThreatPortal/livemap.html
Title: Live Threat Map

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/support-services/threatcloud-incident-response/

Search URL Search Domain Scan URL

URL: https://www.buzzfeednews.com/article/craigsilverman/google-play-store-ad-fraud-du-group-baidu
Title: his story

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/advisories/
Title: IPS ADVISORIES

Search URL Search Domain Scan URL

URL: http://blog.checkpoint.com/
Title: CHECK POINT BLOG

Search URL Search Domain Scan URL

URL: https://bit.ly/2Pmx8R2

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play HTTP 301
http://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/ HTTP 307
https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 58

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j73&tid=UA-194688-1&cid=952200703.1557161422&jid=1364331459&gjid=574566174&_gid=1618922104.1557161422&_u=aGDAgEADQ~&z=1580956506 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-1&cid=952200703.1557161422&jid=1364331459&_v=j73&z=1580956506 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-1&cid=952200703.1557161422&jid=1364331459&_v=j73&z=1580956506&slf_rd=1&random=1119552585

Request Chain 60

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j73&tid=UA-194688-3&cid=952200703.1557161422&jid=341114576&gjid=1047356392&_gid=1618922104.1557161422&_u=aGDAgEADQ~&z=378755449 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-3&cid=952200703.1557161422&jid=341114576&_v=j73&z=378755449 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-3&cid=952200703.1557161422&jid=341114576&_v=j73&z=378755449&slf_rd=1&random=2988253613

Request Chain 66

https://px.ads.linkedin.com/collect/?time=1557161423063&pid=51830&url=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&fmt=js&s=1 HTTP 302
https://px.ads.linkedin.com/collect/?time=1557161423063&pid=51830&url=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&fmt=js&s=1&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1557161423063%26pid%3D51830%26url%3Dhttps%253A%252F%252Fresearch.checkpoint.com%252Fpreamo-a-clicker-campaign-found-on-google-play%252F%26fmt%3Djs%26s%3D1%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect/?time=1557161423063&pid=51830&url=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&fmt=js&s=1&cookiesTest=true&liSync=true

Request Chain 74

https://l.sharethis.com/pview?event=pview&version=st_sop.js&lang=en&hostname=research.checkpoint.com&location=%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&product=sticky-share-buttons&url=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&source=sharethis.js&fcmp=false&title=PreAMo%3A%20A%20Clicker%20Campaign%20found%20on%20Google%20Play%20-%20Check%20Point%20Research&publisher=5a3031770f16c70012a3c297&ts1557161422976=&sop=true HTTP 301
https://l.sharethis.com/sc?cm=ZGAWnVzQZc8AAAASOn6gAw%3D%3D&uid=true&url=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&sop=true

86 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Redirect Chain

https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play
http://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

33 KB
9 KB

45ms
45ms

Document
text/html

2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

c77b1aa6b10f397546ec1c9c6cbace79383dd20f960c81ba2164152d8e7ab382

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Host: research.checkpoint.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server: Apache
Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Link: <http://research.checkpoint.com/?p=21303>; rel=shortlink
Cache-Control: private, max-age=600, must-revalidate
Content-Type: text/html; charset=UTF-8
X-XSS-Protection: 1; mode=block
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Mon, 06 May 2019 16:50:21 GMT
Content-Length: 9241
Connection: keep-alive

Redirect headers

Location: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Non-Authoritative-Reason: HSTS

GET
H/1.1 200
OK style.min.css
research.checkpoint.com/wp-includes/css/dist/block-library/ 25 KB
5 KB 17ms
13ms Stylesheet
text/css 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-includes/css/dist/block-library/style.min.css?ver=5.1.1

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

a72261a5191d1485620242b7d3b735501757aef23dedc6d27c84919af838e756

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 25 Feb 2019 23:52:54 GMT
Server: Apache
ETag: "629a-582c0a39f2180"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: text/css
Cache-Control: public,max-age=600000, must-revalidate
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4258
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK style.css
research.checkpoint.com/wp-content/themes/research/ 16 KB
4 KB 12ms
6ms Stylesheet
text/css 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.16

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

f6dafbf3df2e63d4f82554dd65d1746c683caebcef703efc7ca6443e5822378f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 03 May 2019 18:11:59 GMT
Server: Apache
ETag: "40e9-587ffafc6b9c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: text/css
Cache-Control: public,max-age=600000, must-revalidate
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4009
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK bootstrap.min.css
research.checkpoint.com/wp-content/themes/research/css/ 137 KB
21 KB 23ms
8ms Stylesheet
text/css 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/css/bootstrap.min.css?ver=4.1

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 27 Jul 2018 21:29:10 GMT
Server: Apache
ETag: "22485-57201cd647580"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: text/css
Cache-Control: public,max-age=600000, must-revalidate
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 21024
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK flickity.min.css
research.checkpoint.com/wp-content/themes/research/css/ 2 KB
1 KB 23ms
7ms Stylesheet
text/css 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/css/flickity.min.css?ver=1.1

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

a8da941d8a446516c824ebc9fb77b42e6b92c6deed1daed266bd821ed27bc516

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 27 Jul 2018 21:29:10 GMT
Server: Apache
ETag: "71d-57201cd647580"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: text/css
Cache-Control: public,max-age=600000, must-revalidate
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 648
X-XSS-Protection: 1; mode=block

GET
H2 200 all.css
use.fontawesome.com/releases/v5.6.3/css/ 52 KB
13 KB 19ms
14ms Stylesheet
text/css 23.111.9.35
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.6.3/css/all.css?ver=5.6.3
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 481a0574246e281316ffa0e15399bf5388bb81ae550ce0401a0353b6bb2d1e5a

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 06 May 2019 16:50:21 GMT
content-encoding: gzip
last-modified: Thu, 20 Dec 2018 17:45:13 GMT
server: NetDNA-cache/2.2
access-control-allow-origin: *
etag: W/"dc93d584e41f8417f6b7163320d34329"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
status: 200
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H/1.1 200
OK jquery-3.4.0.min.js Show response
code.jquery.com/ 86 KB
30 KB 1066ms
16ms Script
application/javascript 205.185.208.52
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.4.0.min.js?ver=5.1.1
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.185.208.52 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip052.ssl.hwcdn.net
Software: nginx /
Resource Hash: 0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:22 GMT
Content-Encoding: gzip
Last-Modified: Wed, 10 Apr 2019 19:56:14 GMT
Server: nginx
ETag: W/"5cae4a5e-15857"
Vary: Accept-Encoding
X-HW: 1557161422.dop028.fr8.shc,1557161422.dop028.fr8.t,1557161422.cds051.fr8.c
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 30632

GET
H/1.1 200
OK bootstrap.bundle.min.js Show response
research.checkpoint.com/wp-content/themes/research/js/lib/ 66 KB
19 KB 22ms
7ms Script
application/javascript 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/js/lib/bootstrap.bundle.min.js?ver=4.1

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

bb3d017273ed487674d9766d8401cf458228596adcc0c3a6024f44ae715090db

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 27 Jul 2018 21:29:12 GMT
Server: Apache
ETag: "1089e-57201cd82fa00"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: private, max-age=200000, must-revalidate
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 19244
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK flickity.pkgd.min.js Show response
research.checkpoint.com/wp-content/themes/research/js/lib/ 54 KB
14 KB 23ms
8ms Script
application/javascript 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/js/lib/flickity.pkgd.min.js?ver=1.0.1

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

fe2df9f6df4b4a8d7174d259f563b8d9e28e4c03f8f4092fd9db6044e0e64c32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 27 Jul 2018 21:29:12 GMT
Server: Apache
ETag: "d7c9-57201cd82fa00"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: private, max-age=200000, must-revalidate
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 13838
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK single-post.js Show response
research.checkpoint.com/wp-content/themes/research/js/ 397 B
719 B 22ms
7ms Script
application/javascript 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/js/single-post.js?ver=1.0.2

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

cbfee73101feaeb8d3fb0c18c79b5b0b953cdbd32549473339e742d96886b5a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Tue, 14 Aug 2018 07:21:35 GMT
Server: Apache
ETag: "18d-573600f577dc0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: private, max-age=200000, must-revalidate
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 218
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK inc-header.js Show response
research.checkpoint.com/wp-content/themes/research/header/ 1 KB
956 B 30ms
6ms Script
application/javascript 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/header/inc-header.js?v=1.1

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

ae3754c54a0880a98a94c423d3e67f39b5b6f3c63516dafa33866e3e74c9f97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Thu, 15 Nov 2018 13:37:28 GMT
Server: Apache
ETag: "47a-57ab426d8d600"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: private, max-age=200000, must-revalidate
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 455
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK style.css
research.checkpoint.com/wp-content/themes/research/header/ 9 KB
2 KB 22ms
7ms Stylesheet
text/css 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/header/style.css

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

0fe8bcbcd24ab838fbbd773001253fc0353956e81c5ba9c8e23951ebdbae305a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 27 Jul 2018 21:29:11 GMT
Server: Apache
ETag: "25cb-57201cd73b7c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: text/css
Cache-Control: public,max-age=600000, must-revalidate
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1900
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK facebook.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 1 KB
2 KB 20ms
16ms Image
image/gif 2.19.32.109
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/facebook.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.32.109 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-32-109.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 791d8c8cb135d3d53915096e999d3857b6ee16966c20a019f38699f09f6aa2ff

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:21 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: Apache
ETag: "7eb7015574801089503dd7095e1d4313:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1254

GET
H/1.1 200
OK google-plus.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 2 KB
2 KB 20ms
16ms Image
image/gif 2.19.32.109
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/google-plus.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.32.109 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-32-109.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 1998582382fbf956231d65be84b76e08c0c86e5ced8a99c703bdec416d876d76

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:21 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: Apache
ETag: "eedd0b2cde10b6b1930d57a10c6d0422:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1653

GET
H/1.1 200
OK linkedin.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 1 KB
2 KB 17ms
16ms Image
image/gif 2.19.32.109
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/linkedin.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.32.109 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-32-109.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a22d6b8782097b7cd9588ab582e119bfd6290278275661e9d0f96b2baec0cb8e

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:21 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: Apache
ETag: "6789b034de6591b26bbd9b5fa6b451ca:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1416

GET
H/1.1 200
OK email.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 1 KB
2 KB 17ms
16ms Image
image/gif 2.19.32.109
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/email.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.32.109 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-32-109.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 3643b2c826a615065303aa44b8f463eb854d77934f5f25dc1f74f60d4698f9f0

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:21 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: AkamaiNetStorage
ETag: "15f1e1004accdbc019365e658249f334:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1407

GET
H/1.1 200
OK rss.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 2 KB
2 KB 16ms
14ms Image
image/gif 2.19.32.109
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/rss.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.32.109 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-32-109.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b7cfb1c9430d90b22b3f4497543a4cfef719dc40a3cce130cad766171abe8bbe

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:21 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: Apache
ETag: "8cc18e3677ea53cc679e33e82bf9497a:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1620

GET
H/1.1 200
OK twitter.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 2 KB
2 KB 14ms
13ms Image
image/gif 2.19.32.109
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/twitter.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.32.109 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-32-109.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a59bba774218f207179b30aa8bbd21bad0f7355a52321e08138bd77a308c27d5

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:21 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: Apache
ETag: "6b05f4fc9522afa0cdbeb1a2c0bccc2c:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1608

GET
H/1.1 200
OK check-point-research-logo.gif
sc1.checkpoint.com/sc1/inc/html/images/ 3 KB
3 KB 16ms
15ms Image
image/gif 2.19.32.109
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/check-point-research-logo.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.32.109 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-32-109.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:21 GMT
Last-Modified: Mon, 09 Jul 2018 21:15:16 GMT
Server: Apache
ETag: "c425f4400a5c9dfbaecb24275f494931:1531172224"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2901

GET
H/1.1 200
OK under-attack.gif
research.checkpoint.com/wp-content/themes/research/img/lib/ 2 KB
2 KB 8ms
7ms Image
image/gif 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/themes/research/img/lib/under-attack.gif

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

fab08b60fa81a228f3dd0eb7678669844a4de6a1fd68683a28df73007fd74efa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 27 Jul 2018 21:29:12 GMT
Server: Apache
ETag: "682-57201cd82fa00"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/gif
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1666
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK MobileAppAdware_blog_1021x580.jpg
research.checkpoint.com/wp-content/uploads/2019/04/ 132 KB
133 KB 10ms
9ms Image
image/jpeg 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/MobileAppAdware_blog_1021x580.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

fb670611dedc942184ecb2d77027aa97d786d9862978e3628f9bd75186bbeaa0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 22 Apr 2019 06:24:24 GMT
Server: Apache
ETag: "2112a-587188501b600"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 135466
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-1a.png
research.checkpoint.com/wp-content/uploads/2019/04/ 285 KB
285 KB 24ms
23ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-1a.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

a7d6e29371c697821626a6776a18febfb59931b373cdde7c07b0ddd96169e11e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:40 GMT
Server: Apache
ETag: "473c1-586e4b1f76800"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 291777
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-1b.png
research.checkpoint.com/wp-content/uploads/2019/04/ 28 KB
28 KB 7ms
7ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-1b.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

6816bad669b332541a48efe35df7fadbe61a8b85cb1b2746cc19f5f5e2dea265

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:41 GMT
Server: Apache
ETag: "6ecd-586e4b206aa40"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 28365
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-2.png
research.checkpoint.com/wp-content/uploads/2019/04/ 22 KB
22 KB 7ms
7ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-2.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

e8f7411a47b99f27746a544bf453991a3b4708af49b3ef8ac810710fef619665

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:42 GMT
Server: Apache
ETag: "564f-586e4b215ec80"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 22095
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-3.png
research.checkpoint.com/wp-content/uploads/2019/04/ 100 KB
100 KB 10ms
9ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-3.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

3019aaeeefdf94e47e8c2a38cc349608e1880ee7362dd95abc9032e1f82192e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:43 GMT
Server: Apache
ETag: "18e5f-586e4b2252ec0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 101983
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-4.png
research.checkpoint.com/wp-content/uploads/2019/04/ 68 KB
69 KB 8ms
8ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-4.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

691f295ce172e06611bd8323d8cebde9b754fb28616cf78536a5448830b1a039

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:44 GMT
Server: Apache
ETag: "111f5-586e4b2347100"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 70133
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-5.png
research.checkpoint.com/wp-content/uploads/2019/04/ 43 KB
44 KB 12ms
11ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-5.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

51c2a6681ece79e75268390e6e886ae535512d26cd3f15a0d0b6f7fff9910576

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:45 GMT
Server: Apache
ETag: "adf8-586e4b243b340"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 44536
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-6.png
research.checkpoint.com/wp-content/uploads/2019/04/ 83 KB
84 KB 8ms
8ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-6.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

bc887fab55f0ad888e4151b7cd23c34ffda4e030d54b9cf7cf8b4c89b06ccc60

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:46 GMT
Server: Apache
ETag: "14cf4-586e4b252f580"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 85236
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-7.png
research.checkpoint.com/wp-content/uploads/2019/04/ 52 KB
52 KB 8ms
8ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-7.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

8d3348f5ce4c05743e901d91a6280a1ed9275165eebef91f15168db9aaadbe1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:47 GMT
Server: Apache
ETag: "cf05-586e4b26237c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 52997
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-8.png
research.checkpoint.com/wp-content/uploads/2019/04/ 84 KB
85 KB 8ms
8ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-8.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

3a3286cfabe5dc5785a93328f5fac567fa5cee69c602a1d1572e2201acedb507

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:48 GMT
Server: Apache
ETag: "1516b-586e4b2717a00"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 86379
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-9.png
research.checkpoint.com/wp-content/uploads/2019/04/ 40 KB
41 KB 7ms
7ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-9.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

77d10380683691180a6b9ebc287a5a3c35f8616008305ed956f2d05e2fe75058

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:50 GMT
Server: Apache
ETag: "a13d-586e4b28ffe80"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 41277
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-10.png
research.checkpoint.com/wp-content/uploads/2019/04/ 18 KB
19 KB 17ms
17ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-10.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

8017677fd66fbb0ee72689dea50ee4d1d4183bac432dfea4ee5b79951d3472b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:27 GMT
Server: Apache
ETag: "49c5-586e4b1310ac0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 18885
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-11a.png
research.checkpoint.com/wp-content/uploads/2019/04/ 23 KB
23 KB 15ms
14ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-11a.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

307a51d34b230d0c37c6c80be98ca6f52360e88ad3d5c2ca7718cbc2888d0130

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:28 GMT
Server: Apache
ETag: "5b81-586e4b1404d00"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:21 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 23425
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-11b.png
research.checkpoint.com/wp-content/uploads/2019/04/ 15 KB
16 KB 9ms
9ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-11b.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

777f2d9ea611c4d306323c6c17673250ff6323424457f229ab78f4a8bbf105d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:28 GMT
Server: Apache
ETag: "3c7c-586e4b1404d00"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:22 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 15484
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-12a.png
research.checkpoint.com/wp-content/uploads/2019/04/ 24 KB
25 KB 55ms
52ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-12a.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

bbcd09c22b7f36eaff4fbdc1155161cbe803c388466e5b7ad289547052b23375

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:29 GMT
Server: Apache
ETag: "61bc-586e4b14f8f40"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:22 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 25020
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-12b.png
research.checkpoint.com/wp-content/uploads/2019/04/ 6 KB
7 KB 17ms
16ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-12b.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

45b4ac64b1f05ce5b7c5d8cb956bdc075a1e996ad2a1367a0d161abd0b1565f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:30 GMT
Server: Apache
ETag: "18f5-586e4b15ed180"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:22 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6389
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-13.png
research.checkpoint.com/wp-content/uploads/2019/04/ 156 KB
156 KB 9ms
8ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-13.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

bae7e785e73fbac565e96254aa1226a98995739557f271fbb7be3f99dae1c394

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:31 GMT
Server: Apache
ETag: "26eba-586e4b16e13c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:22 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 159418
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-14.png
research.checkpoint.com/wp-content/uploads/2019/04/ 85 KB
85 KB 7ms
7ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-14.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

0eb07678eb95ba78403511cabf09fbe75d5a197ff94ad76a347bc9ded93f691d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:32 GMT
Server: Apache
ETag: "152a2-586e4b17d5600"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:22 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 86690
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-15.png
research.checkpoint.com/wp-content/uploads/2019/04/ 37 KB
38 KB 11ms
11ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-15.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

034a0277c281f6186d57e251cb29292b7f22aca62a09620244e4760013f5c797

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:33 GMT
Server: Apache
ETag: "94b3-586e4b18c9840"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:22 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 38067
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-16.png
research.checkpoint.com/wp-content/uploads/2019/04/ 45 KB
46 KB 8ms
8ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-16.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

a62646a22144c84281eefb6e3d88666fbaca572feb5ac6e1fea32ab912972147

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:34 GMT
Server: Apache
ETag: "b5ae-586e4b19bda80"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:22 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 46510
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-19.png
research.checkpoint.com/wp-content/uploads/2019/04/ 101 KB
101 KB 9ms
8ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-19.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

72ab47e527f9891e713e25b1b5abf111361d350d99449f81457f87afb2d99a9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:38 GMT
Server: Apache
ETag: "1943a-586e4b1d8e380"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:22 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 103482
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-18.png
research.checkpoint.com/wp-content/uploads/2019/04/ 90 KB
91 KB 9ms
8ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-18.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

4c9108141eed691abbf95e7cb42ea7f89edc3ef173646a9f7f69013140a32a6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:36 GMT
Server: Apache
ETag: "16859-586e4b1ba5f00"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:22 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 92249
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK preamo-malware-20.png
research.checkpoint.com/wp-content/uploads/2019/04/ 42 KB
42 KB 10ms
8ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/preamo-malware-20.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

7caf203935378b7c178f8c719ce6a662020283df2fba592f96fa3e251cdd0f04

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 19 Apr 2019 16:34:39 GMT
Server: Apache
ETag: "a828-586e4b1e825c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:22 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43048
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK control-panel-1021x580.jpg
research.checkpoint.com/wp-content/uploads/2019/05/ 142 KB
143 KB 6ms
6ms Image
image/jpeg 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/05/control-panel-1021x580.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

81dace21889845f24965228581063c267b882bb8f0a56f0ea542423758457363

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Wed, 01 May 2019 10:12:59 GMT
Server: Apache
ETag: "2387c-587d0c30e60c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:22 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 145532
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK Data_Breaches.jpg
research.checkpoint.com/wp-content/uploads/2019/04/ 751 KB
751 KB 7ms
6ms Image
image/jpeg 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/Data_Breaches.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

eca3bafa27f8254899afa47d2a9a8bab1c39ac971143c79227332de19dff11f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Tue, 30 Apr 2019 07:51:10 GMT
Server: Apache
ETag: "bba6e-587baaa09f780"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:22 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 768622
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK TI-Bulletins.jpg
research.checkpoint.com/wp-content/uploads/2019/03/ 5 KB
5 KB 6ms
6ms Image
image/jpeg 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/03/TI-Bulletins.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

b7fc664ed17cbb1375ccbed7319bf53598e908288a16913310b54b8b900f7eab

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Thu, 07 Mar 2019 09:18:07 GMT
Server: Apache
ETag: "1426-5837d9590d1c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:22 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5158
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK ResearchAnalysis_blog_1021x580.jpg
research.checkpoint.com/wp-content/uploads/2019/04/ 82 KB
83 KB 22ms
19ms Image
image/jpeg 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/ResearchAnalysis_blog_1021x580.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

05dbe6b7af7ff019d9192f9cd34ee1925bb7b0566eef212e301c31a0ed50eab6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Tue, 23 Apr 2019 09:19:47 GMT
Server: Apache
ETag: "14940-5872f161152c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:22 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 84288
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK NationStateAttacks.jpg
research.checkpoint.com/wp-content/uploads/2019/04/ 569 KB
570 KB 6ms
6ms Image
image/jpeg 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/NationStateAttacks.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

f06cecdc67e6925037863f0d8d0d0fa8b77c3d8f04034f15216878abe81b148e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Tue, 23 Apr 2019 14:25:13 GMT
Server: Apache
ETag: "8e5ab-587335a61e440"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:22 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 583083
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK sharethis.js Show response
platform-api.sharethis.com/js/ 91 KB
28 KB 1090ms
15ms Script
text/javascript 2.19.43.118
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://platform-api.sharethis.com/js/sharethis.js
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.43.118 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-43-118.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e5c2f85b9e49be5acd30c8ba3767b124d8945f35000eef89902a0485c04e6040

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:22 GMT
Content-Encoding: gzip
ETag: W/"16d4e-SgmVDK5mv+C+DRaEIjQ3WYUSiQ4"
Vary: Accept-Encoding
Access-Control-Allow-Methods: DELETE, GET, HEAD, OPTIONS, POST, PUT
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 27855

GET
H/1.1 200
OK CfP_1021x580_A.jpg
research.checkpoint.com/wp-content/uploads/2018/11/ 132 KB
132 KB 12ms
11ms Image
image/jpeg 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2018/11/CfP_1021x580_A.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

9a6f22e2d9bba0601021ffb3fb8e484336fdd3041f6675f900ffc8c320091f06

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 02 Nov 2018 21:13:47 GMT
Server: Apache
ETag: "20f44-579b502d358c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 16:50:22 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 134980
X-XSS-Protection: 1; mode=block

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 155 KB
34 KB 18ms
18ms Script
application/javascript 2a00:1450:4001:824::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager (scaffolding) /

Resource Hash

afe8966a178414732a640767da814920743e6d097272bd98b8dc8d8788043846

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 06 May 2019 16:50:22 GMT
content-encoding: br
last-modified: Wed, 01 May 2019 22:14:49 GMT
server: Google Tag Manager (scaffolding)
access-control-allow-origin: http://www.googletagmanager.com
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-length: 34528
x-xss-protection: 0
expires: Mon, 06 May 2019 16:50:22 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81f::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 16 Jan 2019 20:01:45 GMT
server: Golfe2
age: 4673
date: Mon, 06 May 2019 15:32:29 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 17543
expires: Mon, 06 May 2019 17:32:29 GMT

GET
H/1.1 200
OK insight.min.js Show response
sjs.bizographics.com/ 15 KB
5 KB 7ms
7ms Script
application/x-javascript 2a02:26f0:f1:280::3adf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sjs.bizographics.com/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:f1:280::3adf , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:22 GMT
Content-Encoding: gzip
Last-Modified: Mon, 03 Dec 2018 23:03:30 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=41232
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4571

GET
H2 200 7614.js Show response
script.crazyegg.com/pages/scripts/0041/ 155 B
325 B 15ms
15ms Script
application/x-javascript 2606:4700::6813:9308
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0041/7614.js?432544
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e66d5c0b32b55fd27a1ff8c74bd88f63c1047603ea1685781539a0782d939b4

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 06 May 2019 16:50:22 GMT
via: 1.1 c5ad7defce0694621f07129d852e42da.cloudfront.net (CloudFront)
cf-cache-status: HIT
cf-polished: origSize=156
x-cache: Hit from cloudfront
status: 200
content-encoding: gzip
last-modified: Tue, 09 Apr 2019 20:20:37 GMT
server: cloudflare
etag: W/"8872624abb9bee7082097e58c74fe2a2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: private, max-age=300
cf-ray: 4d2c73e9aff7969e-FRA
x-amz-cf-id: wc3Bx2ZFkrB0wevnLk_1hDhDTVWpMWx7ydtKB6EHRWPlW90BSJT-Uw==
cf-bgj: minify

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 62ms
61ms Script
application/javascript 151.101.120.157
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.120.157 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 06 May 2019 16:50:22 GMT
content-encoding: gzip
age: 2558
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-cdg20762-CDG
last-modified: Tue, 23 Jan 2018 19:05:33 GMT
x-timer: S1557161422.403679,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 js Show response
www.google-analytics.com/gtm/ 51 KB
19 KB 26ms
25ms Script
application/javascript 2a00:1450:4001:81f::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=GTM-5L6CQT3&t=gtm1&cid=952200703.1557161422

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager (scaffolding) /

Resource Hash

277f60c6cc5ee0bbbaf948c56636fda0d7453c7fa474ca1338f9d283ce9e05ad

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 06 May 2019 16:50:22 GMT
content-encoding: br
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
server: Google Tag Manager (scaffolding)
access-control-allow-origin: http://www.googletagmanager.com
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-length: 19708
x-xss-protection: 0
expires: Mon, 06 May 2019 16:50:22 GMT

GET
H2 200 adsct
t.co/i/ 43 B
166 B 146ms
145ms Image
image/gif 104.244.42.5
Twitter Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nxi3o&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://twitter.com/i/xss_report

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 06 May 2019 16:50:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 1; mode=block; report=https://twitter.com/i/xss_report
x-response-time: 118
pragma: no-cache
last-modified: Mon, 06 May 2019 16:50:22 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: b3428ee38b089f7a8283bb850b47dc4e
x-transaction: 001ca4b900a2b202
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81f::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 16 Jan 2019 20:01:45 GMT
server: Golfe2
age: 4673
date: Mon, 06 May 2019 15:32:29 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 17543
expires: Mon, 06 May 2019 17:32:29 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
109 B 6ms
6ms Image
image/gif 2a00:1450:4001:81f::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j73&a=2105720905&t=pageview&_s=1&dl=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&ul=en-us&de=UTF-8&dt=PreAMo%3A%20A%20Clicker%20Campaign%20found%20on%20Google%20Play%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAgEADQ~&jid=1364331459&gjid=574566174&cid=952200703.1557161422&tid=UA-194688-1&_gid=1618922104.1557161422&gtm=2wg4305JCRGP&z=1231413744

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Mar 2019 05:19:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 5052649
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j73&tid=UA-194688-1&cid=952200703.1557161422&jid=1364331459&gjid=574566174&_gid=1618922104.1557161422&_u=aGDAgEADQ~&z=1580956506
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-1&cid=952200703.1557161422&jid=1364331459&_v=j73&z=1580956506
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-1&cid=952200703.1557161422&jid=1364331459&_v=j73&z=1580956506&slf_rd=1&random=1119552585

42 B
109 B

20ms
20ms

Image
image/gif

2a00:1450:4001:81a::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-1&cid=952200703.1557161422&jid=1364331459&_v=j73&z=1580956506&slf_rd=1&random=1119552585

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 May 2019 16:50:22 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 06 May 2019 16:50:22 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-1&cid=952200703.1557161422&jid=1364331459&_v=j73&z=1580956506&slf_rd=1&random=1119552585
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
103 B 6ms
6ms Image
image/gif 2a00:1450:4001:81f::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j73&a=2105720905&t=pageview&_s=1&dl=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&ul=en-us&de=UTF-8&dt=PreAMo%3A%20A%20Clicker%20Campaign%20found%20on%20Google%20Play%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAgEADQ~&jid=341114576&gjid=1047356392&cid=952200703.1557161422&tid=UA-194688-3&_gid=1618922104.1557161422&gtm=2wg4305JCRGP&z=148758602

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Mar 2019 05:19:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 5052649
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j73&tid=UA-194688-3&cid=952200703.1557161422&jid=341114576&gjid=1047356392&_gid=1618922104.1557161422&_u=aGDAgEADQ~&z=378755449
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-3&cid=952200703.1557161422&jid=341114576&_v=j73&z=378755449
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-3&cid=952200703.1557161422&jid=341114576&_v=j73&z=378755449&slf_rd=1&random=2988253613

42 B
109 B

20ms
19ms

Image
image/gif

2a00:1450:4001:81a::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-3&cid=952200703.1557161422&jid=341114576&_v=j73&z=378755449&slf_rd=1&random=2988253613

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 May 2019 16:50:22 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 06 May 2019 16:50:22 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-3&cid=952200703.1557161422&jid=341114576&_v=j73&z=378755449&slf_rd=1&random=2988253613
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK search-icon.gif
sc1.checkpoint.com/sc1/inc/html/images/ 2 KB
2 KB 16ms
15ms Image
image/gif 2.19.32.109
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/search-icon.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.32.109 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-32-109.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 953d6908ab55929254e46c77e5c751a6e2df7ab84430f134edc3bb62d8f7d32f

Request headers

Referer: https://research.checkpoint.com/wp-content/themes/research/header/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:22 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: Apache
ETag: "2e1aa25e7e77e6a393fd38efb413370f:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1755

GET
H/1.1 200
OK 34CA47_6_0.woff2
research.checkpoint.com/wp-content/themes/research/fonts/ 58 KB
59 KB 12ms
12ms Font
application/octet-stream 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/fonts/34CA47_6_0.woff2

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

0fc686423c26cb1030032fd7e4f2dd664c4b08517a8990c0b46269dd4e01910b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.16
Origin: https://research.checkpoint.com

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 07 Jan 2019 16:17:09 GMT
Server: Apache
ETag: "e890-57ee08f822b40"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Cache-Control: max-age=86400
Date: Mon, 06 May 2019 16:50:22 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 59536
X-XSS-Protection: 1; mode=block
Expires: Tue, 07 May 2019 16:50:22 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 53 KB
15 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

fa59b1ed1b011e084474ad818b5f6986d84fc678e2f37fee9330eb52d86860b3

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Origin, Accept-Encoding
content-length: 15397
x-xss-protection: 0
pragma: public
x-fb-debug: bSwx+7miKa6NMHcopGERJcrnRwhOqQM1t+lwEazFLd52auEmOMXIYPGTp1/uL8DfSrxay1yow0XWB7Yak7/FMg==
date: Mon, 06 May 2019 16:50:22 GMT
x-frame-options: DENY
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: public, max-age=1200
access-control-allow-credentials: true
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK obtp.js Show response
amplify.outbrain.com/cp/ 4 KB
2 KB 69ms
20ms Script
application/x-javascript 2.21.37.220
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/cp/obtp.js
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.37.220 , France, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-21-37-220.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b5703e469f7e06927cabb0a5220c35a67a043f198dd913289da775f43f053e44

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:23 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Feb 2019 08:51:57 GMT
Server: Apache
ETag: "4874136f9bd9aaf33fa7a5842ae56a91:1549961517"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1995
Expires: Mon, 06 May 2019 17:10:23 GMT

GET
H/1.1 200
OK 5a3031770f16c70012a3c297.js Show response
buttons-config.sharethis.com/js/ 525 B
946 B 366ms
15ms Script
text/javascript 2.19.43.118
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://buttons-config.sharethis.com/js/5a3031770f16c70012a3c297.js
Requested by: Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.43.118 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-43-118.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: eee6d8fe37122ba1538560131fe5c95f9a4b6c45e2059076a7a92513fcb12f20

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:23 GMT
Last-Modified: Tue, 12 Dec 2017 19:43:54 GMT
Server: AmazonS3
x-amz-request-id: D3529B3C78164014
ETag: "29c30155cdf2eaa96943948b94d537b6"
Content-Type: text/javascript
Cache-Control: public, max-age=60
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 525
x-amz-id-2: eJNqWXqB2b39A27+1tdwSVe/7cDnRptAKPhPbWbb2WQ/jKaJ6Liiwner2WtOvRJ03JDYYanJ+gA=

GET
H2

200

/ Show response
px.ads.linkedin.com/collect/
Redirect Chain

https://px.ads.linkedin.com/collect/?time=1557161423063&pid=51830&url=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&fmt=js&s=1
https://px.ads.linkedin.com/collect/?time=1557161423063&pid=51830&url=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&fmt=js&s=1&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1557161423063%26pid%3D51830%26url%3Dhttps%253A%252F%252Fresearch.checkpoint.com%252Fpreamo-a-cli...
https://px.ads.linkedin.com/collect/?time=1557161423063&pid=51830&url=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&fmt=js&s=1&cookiesTest=true&liSync=true

0
199 B

169ms
168ms

Script
application/javascript

2a05:f500:11:101::b93f:9005
LinkedIn Corporation

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/collect/?time=1557161423063&pid=51830&url=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&fmt=js&s=1&cookiesTest=true&liSync=true
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN - LinkedIn Corporation, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 06 May 2019 16:50:23 GMT
content-encoding: gzip
server: Play
vary: Accept-Encoding
x-li-fabric: prod-lor1
status: 200
x-li-proto: http/2
x-li-pop: prod-tln1
content-type: application/javascript
content-length: 20
x-li-uuid: joleaxAmnBWAS80XkisAAA==

Redirect headers

date: Mon, 06 May 2019 16:50:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 302
x-li-pop: prod-edc2
content-length: 20
x-li-uuid: IOJegBAmnBUgd++OSCsAAA==
pragma: no-cache
server: Play
x-frame-options: sameorigin
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
vary: Accept-Encoding
strict-transport-security: max-age=2592000
x-li-fabric: prod-lor1
location: https://px.ads.linkedin.com/collect/?time=1557161423063&pid=51830&url=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&fmt=js&s=1&cookiesTest=true&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob:; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
265 B 154ms
153ms Script
application/javascript 104.244.42.195
Twitter Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nxi3o&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),

Reverse DNS

Software

tsa_f /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://twitter.com/i/xss_report

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 06 May 2019 16:50:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 1; mode=block; report=https://twitter.com/i/xss_report
x-response-time: 118
pragma: no-cache
last-modified: Mon, 06 May 2019 16:50:23 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: f492fe202f082e8cab64681024ff1a68
x-transaction: 00717aec00e35b39
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1 200
OK portal.html
c.sharethis.mgr.consensu.org/v1.0/cmp/ Frame F2AC 0
0 164ms
35ms Document
text/html 2.16.186.243
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Requested by: Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.243 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-243.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Host: c.sharethis.mgr.consensu.org
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Methods: DELETE, GET, HEAD, OPTIONS, POST, PUT
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
ETag: W/"26b-4977387000"
Last-Modified: Tue, 01 Jan 1980 00:00:00 GMT
Vary: Accept-Encoding
Content-Length: 334
Cache-Control: public, max-age=3600
Date: Mon, 06 May 2019 16:50:23 GMT
Connection: keep-alive

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 308ms
18ms Script
application/x-javascript 184.31.84.223
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.84.223 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-31-84-223.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 66f7eaa7a45f696c332cd450771f4be48e110f6afbe1fe7b39c7a95518aeef76

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:23 GMT
Content-Encoding: gzip
Last-Modified: Fri, 05 Apr 2019 02:53:44 GMT
Server: Apache
ETag: "54520320df20b526337717d6d28181fc:1554432824"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 752

GET
H2 200 1692853834349189 Show response
connect.facebook.net/signals/config/ 174 KB
45 KB 8ms
7ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1692853834349189?v=2.8.47&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

29df5d37091da3988086b1eb7c5a1935f2bd816dac3ab0fe5b6d65e4d52db889

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Origin, Accept-Encoding
content-length: 45757
x-xss-protection: 0
pragma: public
x-fb-debug: CPbv9cucuKc3bnp1uHNMdX/ToMU+DuWWIDj/eL8/480m3EtBg+oR0DEAU6JYxykNX/IIJTYWoupd8TmojqQWmg==
date: Mon, 06 May 2019 16:50:23 GMT
x-frame-options: DENY
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: public, max-age=1200
access-control-allow-credentials: true
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 pixel
tr.outbrain.com/ 43 B
212 B 116ms
114ms Image
image/gif 151.101.2.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.outbrain.com/pixel?marketerId=007281ee64432ffe21cc9ba8667dd68bed&obApiVersion=1.0.11&name=PAGE_VIEW&dl=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&optOut=false&bust=06055253321583083

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.2.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

Resource Hash

33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=0; includeSubDomains;
content-encoding: gzip
traffic-path: NYDC1, JFK, HHN, Europe1
x-cache: MISS, MISS
status: 200
x-traceid: c825cfaec9eee2bd68f6083b94198af1
content-length: 60
x-served-by: cache-jfk8147-JFK, cache-hhn1525-HHN
x-timer: S1557161423.175863,VS0,VE91
date: Mon, 06 May 2019 16:50:23 GMT
content-type: image/gif;
via: 1.1 varnish, 1.1 varnish
cache-control: no-cache
backend-ip: 104.156.90.47
accept-ranges: bytes, bytes
x-cache-hits: 0, 0

GET
H/1.1 200
OK pixel
amplifypixel.outbrain.com/ 43 B
314 B 505ms
160ms Image
image/gif 50.31.142.19
Outbrain

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://amplifypixel.outbrain.com/pixel?mid=007281ee64432ffe21cc9ba8667dd68bed&dl=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&bust=0721083670658929

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

50.31.142.19 Chicago, United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),

Reverse DNS

chi.outbrain.com

Software

Resource Hash

33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:23 GMT
Cache-Control: no-cache
X-TraceId: 61df5d89d304c3f44f0f4397fcb0ebc0
content-encoding: gzip
Content-Length: 60
Strict-Transport-Security: max-age=0; includeSubDomains;
Content-Type: image/gif;

GET
H2 200 /
www.facebook.com/tr/ 44 B
250 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8083:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1692853834349189&ev=PageView&dl=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&rl=&if=false&ts=1557161423199&sw=1600&sh=1200&v=2.8.47&r=stable&ec=0&o=30&fbp=fb.1.1557161423195.1782550779&it=1557161423127&coo=false&rqm=GET

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 06 May 2019 16:50:23 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Mon, 06 May 2019 16:50:23 GMT

GET
H/1.1

301
Moved Permanently

sc Show response
l.sharethis.com/
Redirect Chain

https://l.sharethis.com/pview?event=pview&version=st_sop.js&lang=en&hostname=research.checkpoint.com&location=%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&product=sticky-share-buttons&url=h...
https://l.sharethis.com/sc?cm=ZGAWnVzQZc8AAAASOn6gAw%3D%3D&uid=true&url=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&sop=true

0
-1 B

102ms
16ms

XHR
text/html

18.184.119.244
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://l.sharethis.com/sc?cm=ZGAWnVzQZc8AAAASOn6gAw%3D%3D&uid=true&url=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&sop=true
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.119.244 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-184-119-244.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:23 GMT
Location: /sc?cm=ZGAWnVzQZc8AAAASOn6gAw%3D%3D&uid=true&url=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&sop=true
Access-Control-Max-Age: 1728000
P3p: policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Access-Control-Allow-Origin: https://research.checkpoint.com
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Headers: *
Content-Length: 194
Stid: ZGAWnVzQZc8AAAASOn6gAw==

Redirect headers

Date: Mon, 06 May 2019 16:50:23 GMT
Access-Control-Allow-Origin: https://research.checkpoint.com
Access-Control-Max-Age: 1728000
P3p: policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Location: /sc?cm=ZGAWnVzQZc8AAAASOn6gAw%3D%3D&uid=true&url=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&sop=true
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Headers: *
Content-Length: 194
Stid: ZGAWnVzQZc8AAAASOn6gAw==

GET
H/1.1 200
OK whatsapp.svg
platform-cdn.sharethis.com/img/ 832 B
1 KB 1086ms
15ms Image
image/svg+xml 2.19.43.118
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform-cdn.sharethis.com/img/whatsapp.svg
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.43.118 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-43-118.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 847eb36b4dc4b05f94052dcd98077319e74d882334a106bb9ca451ba211c9c2c

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:24 GMT
Last-Modified: Fri, 04 Jan 2019 18:31:20 GMT
Server: AmazonS3
x-amz-request-id: 978706B8B4A2B27A
ETag: "afe7fc60ed757db39a88d2950fce69c9"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 832
x-amz-id-2: u8PbN4cIl4FkDaFIUjegmiixoYhjtiEuuiHprvV9HB5f4JovpMJXL1+W4z8Dp2FiRI00S4NFNRU=

GET
H/1.1 200
OK reddit.svg
platform-cdn.sharethis.com/img/ 910 B
922 B 1086ms
15ms Image
image/svg+xml 2.19.43.118
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform-cdn.sharethis.com/img/reddit.svg
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.43.118 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-43-118.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: dadbb59b37bfea4c78c6e15c8cbb96dfba84526e43a0767dc244fd062a841aba

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:24 GMT
Content-Encoding: gzip
Last-Modified: Fri, 04 Jan 2019 18:31:14 GMT
Server: AmazonS3
x-amz-request-id: 0585C26F6E06F944
ETag: "78d796ca648d8a5e665b48ed0217c56a"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 491
x-amz-id-2: yFu9LU3z3WmTxX5HtjVxlx81UgnQ/eC1zq4iQKxmrEvS4dYcCTLrqFpotSdMM/IFfnasZL6W7Jo=

GET
H/1.1 200
OK arrow_left.svg
platform-cdn.sharethis.com/img/ 565 B
949 B 1100ms
14ms Image
image/svg+xml 2.19.43.118
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform-cdn.sharethis.com/img/arrow_left.svg
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.43.118 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-43-118.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:24 GMT
Last-Modified: Fri, 04 Jan 2019 18:31:05 GMT
Server: AmazonS3
x-amz-request-id: 860C7676964A89BA
ETag: "b55d8d2b9321e381a3c38a4bddb74037"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 565
x-amz-id-2: bWt/rpQHMsaVK+6zHgk7ji0FeUWLugR5wpok0TBQAb9iaseGRZ3GIhxcnN373+KibvdwFljjYqQ=

GET
H/1.1 200
OK arrow_right.svg
platform-cdn.sharethis.com/img/ 565 B
949 B 1099ms
15ms Image
image/svg+xml 2.19.43.118
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform-cdn.sharethis.com/img/arrow_right.svg
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.43.118 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-43-118.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:24 GMT
Last-Modified: Fri, 04 Jan 2019 18:31:05 GMT
Server: AmazonS3
x-amz-request-id: BECE9179367F8EC9
ETag: "9928d025bd5792b718ee0a185f62e67c"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 565
x-amz-id-2: h6lE2cepykY/qBF4SDzfV/ywkiWBvlLZQDlhK1dJRZKTE3psDaN74Cvr4MIculViiryAUjznxuY=

GET
H/1.1 200
OK sc Show response
l.sharethis.com/ 51 B
481 B 28ms
18ms XHR
text/plain 18.184.119.244
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://l.sharethis.com/sc?cm=ZGAWnVzQZc8AAAASOn6gAw%3D%3D&uid=true&url=https%3A%2F%2Fresearch.checkpoint.com%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&sop=true
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.119.244 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-184-119-244.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: db17e01e0765f8da72f925874820df39249bfc68c002fa113ad2f04451009ec1

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Origin: https://research.checkpoint.com

Response headers

Date: Mon, 06 May 2019 16:50:23 GMT
Access-Control-Max-Age: 1728000
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: https://research.checkpoint.com
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Stid: ZGAWnVzQZc8AAAASOn6gAw==
Access-Control-Allow-Headers: *
Content-Length: 51

GET
H/1.1 200
OK t.dhj Show response
t.sharethis.com/1/d/ 2 KB
1 KB 144ms
19ms Script
application/javascript 23.38.58.100
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://t.sharethis.com/1/d/t.dhj?cid=c010&cls=B&dmn=research.checkpoint.com&rnd=1557161423429

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.38.58.100 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a23-38-58-100.deploy.static.akamaitechnologies.com

Software

Resource Hash

adc6b4dd1862cb5ca4abe32d2cb6125177e743c54399ac961c879bb0b61a9138

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:23 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="DSP LAW NID OUR DEL SAM BUS UNI PUR COM NAV INT STA PRE LOC OTC"
Cache-Control: private, max-age=3600
Connection: keep-alive
Content-Type: application/javascript
Content-Length: 958
Expires: Mon, 06 May 2019 17:50:23 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/155/ 9 KB
4 KB 38ms
20ms Script
application/x-javascript 184.31.84.223
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/155/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.84.223 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-31-84-223.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: efb6b9732bf508ee305363b10cf2a67ace474e06eb42642f2c3696b2442a5775

Request headers

Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 16:50:23 GMT
Content-Encoding: gzip
Last-Modified: Fri, 30 Nov 2018 03:18:20 GMT
Server: Apache
ETag: "c67dad42946949112916578f78706df8:1543547900"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 3923
Expires: Wed, 14 Aug 2019 16:50:23 GMT

GET
H/1.1 200
OK visitWebPage Show response
750-dqh-528.mktoresp.com/webevents/ 2 B
272 B 560ms
100ms XHR
text/plain 192.28.144.124
MARKETO

General

Check archive.org

Show headers Download Go to

Full URL: https://750-dqh-528.mktoresp.com/webevents/visitWebPage?_mchNc=1557161423478&_mchCn=&_mchId=750-DQH-528&_mchTk=_mch-checkpoint.com-1557161423477-49522&_mchHo=research.checkpoint.com&_mchPo=&_mchRu=%2Fpreamo-a-clicker-campaign-found-on-google-play%2F&_mchPc=https%3A&_mchVr=155&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/155/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.28.144.124 San Mateo, United States, ASN53580 (MARKETO - MARKETO, Inc., US),
Reverse DNS
Software: spray-can/1.3.3 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Origin: https://research.checkpoint.com

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 06 May 2019 16:50:23 GMT
Content-Encoding: gzip
Server: spray-can/1.3.3
Content-Length: 22
X-Request-Id: f9b0fdfa-e7c1-41c8-80d0-4fb5f234317b
Content-Type: text/plain; charset=UTF-8

GET
H/1.1 200
OK t_.htm
t.sharethis.com/a/ Frame CF00 0
0 18ms
15ms Document
text/html 23.38.58.100
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://t.sharethis.com/a/t_.htm?ver=0.244.10679&cid=c010&cls=B
Requested by: Host: t.sharethis.com
URL: https://t.sharethis.com/1/d/t.dhj?cid=c010&cls=B&dmn=research.checkpoint.com&rnd=1557161423429
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.38.58.100 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-38-58-100.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Host: t.sharethis.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Response headers

Content-Encoding: gzip
Content-Length: 849
Cache-Control: max-age=604800
Expires: Mon, 13 May 2019 16:50:23 GMT
Date: Mon, 06 May 2019 16:50:23 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="DSP LAW NID OUR DEL SAM BUS UNI PUR COM NAV INT STA PRE LOC OTC"
Content-Type: text/html
Vary: Accept-Encoding

POST
H2 200 /
www.facebook.com/tr/ Frame 7B4E 0
0 6ms
6ms Document
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 1994
pragma: no-cache
cache-control: no-cache
origin: https://research.checkpoint.com
upgrade-insecure-requests: 1
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/
accept-encoding: gzip, deflate, br
Origin: https://research.checkpoint.com
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://research.checkpoint.com/preamo-a-clicker-campaign-found-on-google-play/

Response headers

status: 200
content-type: text/plain
access-control-allow-origin: https://research.checkpoint.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 0
server: proxygen-bolt
date: Mon, 06 May 2019 16:50:23 GMT

Verdicts & Comments Add Verdict or Comment

53 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.checkpoint.com/	1970-01-19 02:42:17	Name: _fbp Value: fb.1.1557161423715.1236477797

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

750-dqh-528.mktoresp.com
amplify.outbrain.com
amplifypixel.outbrain.com
analytics.twitter.com
buttons-config.sharethis.com
c.sharethis.mgr.consensu.org
code.jquery.com
connect.facebook.net
l.sharethis.com
munchkin.marketo.net
platform-api.sharethis.com
platform-cdn.sharethis.com
px.ads.linkedin.com
research.checkpoint.com
sc1.checkpoint.com
script.crazyegg.com
sjs.bizographics.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
t.sharethis.com
tr.outbrain.com
use.fontawesome.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
104.244.42.195
104.244.42.5
151.101.120.157
151.101.2.2
18.184.119.244
184.31.84.223
192.28.144.124
2.16.186.243
2.19.32.109
2.19.43.118
2.21.37.220
205.185.208.52
23.111.9.35
23.38.58.100
2606:4700::6813:9308
2620:109:c002::6cae:a0a
2a00:1450:4001:81a::2003
2a00:1450:4001:81f::200e
2a00:1450:4001:824::2008
2a00:1450:4001:825::2004
2a00:1450:400c:c08::9a
2a02:26f0:6c00:18d::38f0
2a02:26f0:6c00:19e::38f0
2a02:26f0:f1:280::3adf
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
2a05:f500:11:101::b93f:9005
50.31.142.19
034a0277c281f6186d57e251cb29292b7f22aca62a09620244e4760013f5c797
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8
05dbe6b7af7ff019d9192f9cd34ee1925bb7b0566eef212e301c31a0ed50eab6
0e66d5c0b32b55fd27a1ff8c74bd88f63c1047603ea1685781539a0782d939b4
0eb07678eb95ba78403511cabf09fbe75d5a197ff94ad76a347bc9ded93f691d
0fc686423c26cb1030032fd7e4f2dd664c4b08517a8990c0b46269dd4e01910b
0fe8bcbcd24ab838fbbd773001253fc0353956e81c5ba9c8e23951ebdbae305a
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1998582382fbf956231d65be84b76e08c0c86e5ced8a99c703bdec416d876d76
1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e
277f60c6cc5ee0bbbaf948c56636fda0d7453c7fa474ca1338f9d283ce9e05ad
29df5d37091da3988086b1eb7c5a1935f2bd816dac3ab0fe5b6d65e4d52db889
3019aaeeefdf94e47e8c2a38cc349608e1880ee7362dd95abc9032e1f82192e6
307a51d34b230d0c37c6c80be98ca6f52360e88ad3d5c2ca7718cbc2888d0130
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c
34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255
3643b2c826a615065303aa44b8f463eb854d77934f5f25dc1f74f60d4698f9f0
3a3286cfabe5dc5785a93328f5fac567fa5cee69c602a1d1572e2201acedb507
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
45b4ac64b1f05ce5b7c5d8cb956bdc075a1e996ad2a1367a0d161abd0b1565f1
481a0574246e281316ffa0e15399bf5388bb81ae550ce0401a0353b6bb2d1e5a
4c9108141eed691abbf95e7cb42ea7f89edc3ef173646a9f7f69013140a32a6d
51c2a6681ece79e75268390e6e886ae535512d26cd3f15a0d0b6f7fff9910576
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38
66f7eaa7a45f696c332cd450771f4be48e110f6afbe1fe7b39c7a95518aeef76
6816bad669b332541a48efe35df7fadbe61a8b85cb1b2746cc19f5f5e2dea265
691f295ce172e06611bd8323d8cebde9b754fb28616cf78536a5448830b1a039
72ab47e527f9891e713e25b1b5abf111361d350d99449f81457f87afb2d99a9f
777f2d9ea611c4d306323c6c17673250ff6323424457f229ab78f4a8bbf105d7
77d10380683691180a6b9ebc287a5a3c35f8616008305ed956f2d05e2fe75058
791d8c8cb135d3d53915096e999d3857b6ee16966c20a019f38699f09f6aa2ff
7caf203935378b7c178f8c719ce6a662020283df2fba592f96fa3e251cdd0f04
8017677fd66fbb0ee72689dea50ee4d1d4183bac432dfea4ee5b79951d3472b8
81dace21889845f24965228581063c267b882bb8f0a56f0ea542423758457363
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
847eb36b4dc4b05f94052dcd98077319e74d882334a106bb9ca451ba211c9c2c
8d3348f5ce4c05743e901d91a6280a1ed9275165eebef91f15168db9aaadbe1d
953d6908ab55929254e46c77e5c751a6e2df7ab84430f134edc3bb62d8f7d32f
9a6f22e2d9bba0601021ffb3fb8e484336fdd3041f6675f900ffc8c320091f06
a22d6b8782097b7cd9588ab582e119bfd6290278275661e9d0f96b2baec0cb8e
a59bba774218f207179b30aa8bbd21bad0f7355a52321e08138bd77a308c27d5
a62646a22144c84281eefb6e3d88666fbaca572feb5ac6e1fea32ab912972147
a72261a5191d1485620242b7d3b735501757aef23dedc6d27c84919af838e756
a7d6e29371c697821626a6776a18febfb59931b373cdde7c07b0ddd96169e11e
a8da941d8a446516c824ebc9fb77b42e6b92c6deed1daed266bd821ed27bc516
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
adc6b4dd1862cb5ca4abe32d2cb6125177e743c54399ac961c879bb0b61a9138
ae3754c54a0880a98a94c423d3e67f39b5b6f3c63516dafa33866e3e74c9f97d
afe8966a178414732a640767da814920743e6d097272bd98b8dc8d8788043846
b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242
b5703e469f7e06927cabb0a5220c35a67a043f198dd913289da775f43f053e44
b7cfb1c9430d90b22b3f4497543a4cfef719dc40a3cce130cad766171abe8bbe
b7fc664ed17cbb1375ccbed7319bf53598e908288a16913310b54b8b900f7eab
bae7e785e73fbac565e96254aa1226a98995739557f271fbb7be3f99dae1c394
bb3d017273ed487674d9766d8401cf458228596adcc0c3a6024f44ae715090db
bbcd09c22b7f36eaff4fbdc1155161cbe803c388466e5b7ad289547052b23375
bc887fab55f0ad888e4151b7cd23c34ffda4e030d54b9cf7cf8b4c89b06ccc60
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b
c77b1aa6b10f397546ec1c9c6cbace79383dd20f960c81ba2164152d8e7ab382
cbfee73101feaeb8d3fb0c18c79b5b0b953cdbd32549473339e742d96886b5a9
dadbb59b37bfea4c78c6e15c8cbb96dfba84526e43a0767dc244fd062a841aba
db17e01e0765f8da72f925874820df39249bfc68c002fa113ad2f04451009ec1
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5c2f85b9e49be5acd30c8ba3767b124d8945f35000eef89902a0485c04e6040
e8f7411a47b99f27746a544bf453991a3b4708af49b3ef8ac810710fef619665
eca3bafa27f8254899afa47d2a9a8bab1c39ac971143c79227332de19dff11f0
eee6d8fe37122ba1538560131fe5c95f9a4b6c45e2059076a7a92513fcb12f20
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efb6b9732bf508ee305363b10cf2a67ace474e06eb42642f2c3696b2442a5775
f06cecdc67e6925037863f0d8d0d0fa8b77c3d8f04034f15216878abe81b148e
f6dafbf3df2e63d4f82554dd65d1746c683caebcef703efc7ca6443e5822378f
fa59b1ed1b011e084474ad818b5f6986d84fc678e2f37fee9330eb52d86860b3
fab08b60fa81a228f3dd0eb7678669844a4de6a1fd68683a28df73007fd74efa
fb670611dedc942184ecb2d77027aa97d786d9862978e3628f9bd75186bbeaa0
fe2df9f6df4b4a8d7174d259f563b8d9e28e4c03f8f4092fd9db6044e0e64c32

research.checkpoint.com Open in urlscan Pro 2a02:26f0:6c00:19e::38f0 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

86 Requests

100 %HTTPS

46 %IPv6

21 Domains

29 Subdomains

25 IPs

5 Countries

3671 kBTransfer

4468 kBSize

1 Cookies

14 Outgoing links

Page URL History

Redirected requests

86 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

research.checkpoint.com Open in urlscan Pro
2a02:26f0:6c00:19e::38f0 Public Scan

Screenshot
Live screenshot

Full Image

86
Requests

100 %
HTTPS

46 %
IPv6

21
Domains

29
Subdomains

25
IPs

5
Countries

3671 kB
Transfer

4468 kB
Size

1
Cookies

86 HTTP transactions
0 data transactions