urlscan.io logo urlscan.io
SecurityTrails logo

research.checkpoint.com Open in urlscan Pro
141.193.213.20  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://click.checkpoint.com/NzUwLURRSC01MjgAAAGFK7lURAn05U1bX4Htvjnr5Sd73cW3ZKnVbKE3mmFDMHjgbWBiGEC2sgjlEx3t6-tNEecc1jI=
Effective URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-...
Submission Tags: falconsandbox
Submission: On September 13 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 33 IPs in 6 countries across 25 domains to perform 99 HTTP transactions. The main IP is 141.193.213.20, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is research.checkpoint.com.
TLS certificate: Issued by R3 on September 12th 2022. Valid for: 3 months.
This is the only time research.checkpoint.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 104.17.71.206 13335 (CLOUDFLAR...)
25 141.193.213.20 209242 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2001:4de0:ac1... 20446 (STACKPATH...)
1 2a00:1450:400... 15169 (GOOGLE)
8 23.46.214.56 16625 (AKAMAI-AS)
1 13.224.189.81 16509 (AMAZON-02)
5 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:20e... 16509 (AMAZON-02)
2 52.57.249.23 16509 (AMAZON-02)
10 2600:9000:21f... 16509 (AMAZON-02)
8 104.126.181.33 16625 (AKAMAI-AS)
3 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 185.89.210.153 29990 (ASN-APPNEX)
2 18.195.70.228 16509 (AMAZON-02)
1 2001:4860:480... 15169 (GOOGLE)
1 2a02:26f0:11a... 20940 (AKAMAI-ASN1)
1 199.232.16.157 54113 (FASTLY)
2 23.205.237.4 16625 (AKAMAI-AS)
2 2a03:2880:f01... 32934 (FACEBOOK)
3 3 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
2 2a03:2880:f11... 32934 (FACEBOOK)
1 192.28.144.124 15224 (OMNITURE)
1 104.244.42.133 13414 (TWITTER)
1 104.244.42.3 13414 (TWITTER)
2 13.224.189.126 16509 (AMAZON-02)
7 35.168.228.181 14618 (AMAZON-AES)
99 33
1    104.17.71.206 (None, )

ASN13335 (CLOUDFLARENET, US)
click.checkpoint.com
25    141.193.213.20 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)
research.checkpoint.com
1    2606:4700:3032::ac43:a9f7 (United States)

ASN13335 (CLOUDFLARENET, US)
use.fontawesome.com
1    2001:4de0:ac18::1:a:2b (Netherlands)

ASN20446 (STACKPATH-CDN, US)
code.jquery.com
1    2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
8    23.46.214.56 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-46-214-56.deploy.static.akamaitechnologies.com
sc1.checkpoint.com
1    13.224.189.81 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-81.fra2.r.cloudfront.net
platform-api.sharethis.com
5    2606:4700::6812:e234 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.onesignal.com
onesignal.com
img.onesignal.com
2    2a00:1450:4001:82b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2600:9000:20eb:2000:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)
buttons-config.sharethis.com
2    52.57.249.23 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-249-23.eu-central-1.compute.amazonaws.com
l.sharethis.com
10    2600:9000:21f3:4400:1d:85c3:6640:93a1 (United States)

ASN16509 (AMAZON-02, US)
platform-cdn.sharethis.com
8    104.126.181.33 (Chicago, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-126-181-33.deploy.static.akamaitechnologies.com
j.6sc.co
c.6sc.co
b.6sc.co
3    2a00:1450:4001:80e::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2a00:1450:400c:c06::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2606:4700::6812:e134 (United States)

ASN13335 (CLOUDFLARENET, US)
onesignal.com
1    2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    185.89.210.153 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
secure.adnxs.com
2    18.195.70.228 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-70-228.eu-central-1.compute.amazonaws.com
epsilon.6sense.com
1    2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
1    2a02:26f0:11a::6867:4868 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)
snap.licdn.com
1    199.232.16.157 (Vienna, Austria)

ASN54113 (FASTLY, US)
static.ads-twitter.com
2    23.205.237.4 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-205-237-4.deploy.static.akamaitechnologies.com
munchkin.marketo.net
2    2a03:2880:f01c:216:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
connect.facebook.net
3    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
www.linkedin.com
1    13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px4.ads.linkedin.com
2    2a03:2880:f11c:8083:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    192.28.144.124 (United States)

ASN15224 (OMNITURE, US)
750-dqh-528.mktoresp.com
1    104.244.42.133 (United States)

ASN13414 (TWITTER, US)
t.co
1    104.244.42.3 (United States)

ASN13414 (TWITTER, US)
analytics.twitter.com
2    13.224.189.126 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-189-126.fra2.r.cloudfront.net
assets.trendemon.com
7    35.168.228.181 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-168-228-181.compute-1.amazonaws.com
trackingapi.trendemon.com
Apex Domain
Subdomains		 Transfer
34 checkpoint.com
click.checkpoint.com
research.checkpoint.com
sc1.checkpoint.com — Cisco Umbrella Rank: 27850
768 KB
14 sharethis.com
platform-api.sharethis.com — Cisco Umbrella Rank: 6169
buttons-config.sharethis.com — Cisco Umbrella Rank: 7262
l.sharethis.com — Cisco Umbrella Rank: 6111
platform-cdn.sharethis.com — Cisco Umbrella Rank: 13511
55 KB
9 trendemon.com
assets.trendemon.com — Cisco Umbrella Rank: 182085
trackingapi.trendemon.com — Cisco Umbrella Rank: 180472
51 KB
8 6sc.co
j.6sc.co — Cisco Umbrella Rank: 16308
c.6sc.co — Cisco Umbrella Rank: 23029
b.6sc.co — Cisco Umbrella Rank: 8700
13 KB
6 onesignal.com
cdn.onesignal.com — Cisco Umbrella Rank: 3423
onesignal.com — Cisco Umbrella Rank: 947
img.onesignal.com — Cisco Umbrella Rank: 6452
86 KB
4 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 894
www.linkedin.com — Cisco Umbrella Rank: 847
px4.ads.linkedin.com — Cisco Umbrella Rank: 6869
4 KB
4 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 94
region1.google-analytics.com — Cisco Umbrella Rank: 2119
20 KB
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 111
315 B
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 208
111 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 6777
6 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 30334
425 B
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 141
154 KB
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 870
394 B
1 t.co
t.co — Cisco Umbrella Rank: 600
338 B
1 mktoresp.com
750-dqh-528.mktoresp.com
318 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 996
15 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 1614
3 KB
1 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 725
713 B
1 gstatic.com
fonts.gstatic.com
16 KB
1 google.de
www.google.de — Cisco Umbrella Rank: 3469
501 B
1 google.com
www.google.com — Cisco Umbrella Rank: 19
501 B
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 188
447 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 120
1 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 976
30 KB
1 fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 1565
12 KB
99 25
Domain Requested by
25 research.checkpoint.com click.checkpoint.com
research.checkpoint.com
10 platform-cdn.sharethis.com research.checkpoint.com
8 sc1.checkpoint.com research.checkpoint.com
7 trackingapi.trendemon.com assets.trendemon.com
6 b.6sc.co research.checkpoint.com
3 www.google-analytics.com www.googletagmanager.com
research.checkpoint.com
3 onesignal.com cdn.onesignal.com
2 assets.trendemon.com click.checkpoint.com
assets.trendemon.com
2 www.facebook.com
2 px.ads.linkedin.com 2 redirects
2 connect.facebook.net click.checkpoint.com
connect.facebook.net
2 munchkin.marketo.net click.checkpoint.com
munchkin.marketo.net
2 epsilon.6sense.com j.6sc.co
2 l.sharethis.com platform-api.sharethis.com
research.checkpoint.com
2 www.googletagmanager.com research.checkpoint.com
www.googletagmanager.com
2 cdn.onesignal.com research.checkpoint.com
cdn.onesignal.com
1 analytics.twitter.com
1 t.co
1 750-dqh-528.mktoresp.com munchkin.marketo.net
1 px4.ads.linkedin.com
1 www.linkedin.com 1 redirects
1 static.ads-twitter.com www.googletagmanager.com
1 snap.licdn.com www.googletagmanager.com
1 region1.google-analytics.com www.googletagmanager.com
1 c.6sc.co j.6sc.co
1 secure.adnxs.com j.6sc.co
1 fonts.gstatic.com fonts.googleapis.com
1 img.onesignal.com research.checkpoint.com
1 www.google.de research.checkpoint.com
1 www.google.com research.checkpoint.com
1 stats.g.doubleclick.net www.google-analytics.com
1 j.6sc.co click.checkpoint.com
1 buttons-config.sharethis.com platform-api.sharethis.com
1 platform-api.sharethis.com research.checkpoint.com
1 fonts.googleapis.com research.checkpoint.com
1 code.jquery.com research.checkpoint.com
1 use.fontawesome.com research.checkpoint.com
1 click.checkpoint.com
99 38
Subject Issuer Validity Valid
click.checkpoint.com
Cloudflare Inc ECC CA-3		 2022-05-05 -
2023-05-05		 a year crt.sh
research.checkpoint.com
R3		 2022-09-12 -
2022-12-11		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-06-06 -
2023-06-05		 a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2022-08-03 -
2023-07-14		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
*.checkpoint.com
GlobalSign GCC R3 DV TLS CA 2020		 2021-12-07 -
2023-01-08		 a year crt.sh
sharethis.com
Amazon		 2022-06-19 -
2023-07-18		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
*.6sc.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-03-08 -
2023-03-11		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
www.google.com
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
www.google.de
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2022-02-11 -
2023-03-14		 a year crt.sh
*.6sense.com
Amazon		 2022-05-31 -
2023-06-29		 a year crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA		 2022-03-01 -
2023-03-01		 a year crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-07-22 -
2023-08-22		 a year crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA		 2022-02-06 -
2023-02-07		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2022-06-23 -
2022-09-21		 3 months crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-11-30 -
2022-11-30		 a year crt.sh
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-03-07 -
2023-03-06		 a year crt.sh
*.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-03-07 -
2023-03-06		 a year crt.sh
*.trendemon.com
SSL.com RSA SSL subCA		 2022-07-12 -
2023-06-26		 a year crt.sh

This page contains 2 frames:

Primary Page: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Frame ID: B6CA7D28E4B20F4C70E44E5CEFABD680
Requests: 97 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: CFC13966D3EEBC3D552ACFE037EFE6E6
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Iranian Spear-Phishing Operation Targets Former Israeli and US High-Ranking Officials - Check Point Research

Page URL History Show full URLs

  1. https://click.checkpoint.com/NzUwLURRSC01MjgAAAGFK7lURAn05U1bX4Htvjnr5Sd73cW3ZKnVbKE3mmFDMHjgbWBiGEC2sgjl... Page URL
  2. https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-for... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • /flickity(?:\.pkgd)?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js
Overall confidence: 100%
Detected patterns
  • cdn\.onesignal\.com
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

99
Requests

99 %
HTTPS

53 %
IPv6

25
Domains

38
Subdomains

33
IPs

6
Countries

1345 kB
Transfer

3210 kB
Size

32
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://click.checkpoint.com/NzUwLURRSC01MjgAAAGFK7lURAn05U1bX4Htvjnr5Sd73cW3ZKnVbKE3mmFDMHjgbWBiGEC2sgjlEx3t6-tNEecc1jI= Page URL
  2. https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1- Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 79
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1663098634803&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F%3Fmkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1- HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D51830%26time%3D1663098634803%26url%3Dhttps%253A%252F%252Fresearch.checkpoint.com%252F2022%252Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%252F%253Fmkt_tok%253DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1663098634803&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F%3Fmkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1663098634803&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F%3Fmkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-&liSync=true&e_ipv6=AQIq_7FJ2CD08QAAAYM4Z0Qpi1T-fAWkc2mEB0qZZ3rQNvfDRDP2Jk2LadcKVTIcP6u5Wecn

99 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
NzUwLURRSC01MjgAAAGFK7lURAn05U1bX4Htvjnr5Sd73cW3ZKnVbKE3mmFDMHjgbWBiGEC2sgjlEx3t6-tNEecc1jI=
click.checkpoint.com/ 		696 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://click.checkpoint.com/NzUwLURRSC01MjgAAAGFK7lURAn05U1bX4Htvjnr5Sd73cW3ZKnVbKE3mmFDMHjgbWBiGEC2sgjlEx3t6-tNEecc1jI=
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self';script-src 'self' 'sha256-0e/zNAmbPoWp0kPb8jNL5sq+rqnqZXN5gKBtft2mfBQ=';object-src 'none';form-action:'none';frame-src:'none'
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
private, no-cache, no-store, max-age=0
cf-cache-status
DYNAMIC
cf-ray
74a3698a7b776993-FRA
content-security-policy
default-src 'self'; img-src 'self';script-src 'self' 'sha256-0e/zNAmbPoWp0kPb8jNL5sq+rqnqZXN5gKBtft2mfBQ=';object-src 'none';form-action:'none';frame-src:'none'
content-type
text/html;charset=UTF-8
date
Tue, 13 Sep 2022 19:50:31 GMT
referrer-policy
strict-origin
server
cloudflare
x-frame-options
SAMEORIGIN
x-request-id
a1826578dc8f9d08
Primary Request /
research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/ 		54 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Requested by
Host: click.checkpoint.com
URL: https://click.checkpoint.com/NzUwLURRSC01MjgAAAGFK7lURAn05U1bX4Htvjnr5Sd73cW3ZKnVbKE3mmFDMHjgbWBiGEC2sgjlEx3t6-tNEecc1jI=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / WP Engine
Resource Hash
f0b9d27e9a75a9beaf7ffc255c599973058dcdfb6cd1b10933e45f7c327e6324
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://click.checkpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
max-age=600, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
74a3698d3da06933-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Tue, 13 Sep 2022 19:50:31 GMT
link
<https://research.checkpoint.com/?p=26263>; rel=shortlink
server
cloudflare
vary
Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache
MISS
x-cache-group
normal
x-cacheable
SHORT
x-frame-options
SAMEORIGIN
x-powered-by
WP Engine
x-xss-protection
1; mode=block
style.min.css
research.checkpoint.com/wp-includes/css/dist/block-library/ 		87 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-includes/css/dist/block-library/style.min.css?ver=6.0.2
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:31 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 04 Jul 2022 12:10:37 GMT
server
cloudflare
age
422554
etag
W/"62c2d8bd-15b64"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74a3698fca576933-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
style.css
research.checkpoint.com/wp-content/themes/research/ 		18 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.32
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef9e48bd5f604cd8d52ac00607fc60c2f4276a7e88c3f2bce907c7aaec90ed41

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:31 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 10 Aug 2022 01:47:46 GMT
server
cloudflare
age
3001162
etag
W/"62f30e42-4972"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74a3698fca5a6933-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
bootstrap.min.css
research.checkpoint.com/wp-content/themes/research/css/ 		137 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/css/bootstrap.min.css?ver=4.1
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:31 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:49 GMT
server
cloudflare
age
15537747
etag
W/"5dc49a65-22485"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74a3698fca5f6933-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
flickity.min.css
research.checkpoint.com/wp-content/themes/research/css/ 		2 KB
732 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/css/flickity.min.css?ver=1.1
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a8da941d8a446516c824ebc9fb77b42e6b92c6deed1daed266bd821ed27bc516

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:31 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
17049446
etag
W/"5dc49a64-71d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74a3698fca626933-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
all.css
use.fontawesome.com/releases/v5.6.3/css/ 		52 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/releases/v5.6.3/css/all.css?ver=5.6.3
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:a9f7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
481a0574246e281316ffa0e15399bf5388bb81ae550ce0401a0353b6bb2d1e5a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:31 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
603001
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
Q4W9K978S82KDQDH
x-amz-id-2
CickaTxgh+m8Vr8F+fEXjXZiJ19dUc4YXnfvhD6CWtVM3jigyssu3pjN5pVtZ0auEbUp1o2IJR8=
last-modified
Wed, 30 Jun 2021 15:44:33 GMT
server
cloudflare
etag
W/"dc93d584e41f8417f6b7163320d34329"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DqEmwEQj%2BjQ8UYMXGfFSXjYEBOldsbBUGrWhR%2BJiZKRLEfXAINaa2jF0xy5RYfmpJTb3gMMOqUFfJGvIzm6OEO97fwMuaqQLiBrgikyqM9dtIUZSCcG1WXhAmq%2BIBy%2BNiPG31ZR99Vy62YDbQO%2FwnJkA"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=31556926
cf-ray
74a3698ffe3cbbd4-FRA
enlighterjs.min.css
research.checkpoint.com/wp-content/plugins/enlighter/cache/ 		78 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/plugins/enlighter/cache/enlighterjs.min.css?ver=TJ0/7+iAWMKbDKS
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6048e330c0f362be46b20de45d35a5ace57a04be04a29da10448d6949f6f69ce

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:31 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 15 Feb 2021 20:35:46 GMT
server
cloudflare
age
17324599
etag
W/"602adb22-13686"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74a3698fca666933-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
jquery-3.4.0.min.js
code.jquery.com/ 		86 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.4.0.min.js?ver=6.0.2
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:31 GMT
content-encoding
gzip
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
etag
W/"28feccc0-15857"
vary
Accept-Encoding
x-hw
1663098631.dop220.am5.t,1663098631.cds305.am5.hn,1663098631.cds276.am5.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30632
bootstrap.bundle.min.js
research.checkpoint.com/wp-content/themes/research/js/lib/ 		66 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/js/lib/bootstrap.bundle.min.js?ver=4.1
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bb3d017273ed487674d9766d8401cf458228596adcc0c3a6024f44ae715090db

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:31 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
27890404
etag
W/"5dc49a64-1089e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74a3698fca6b6933-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
flickity.pkgd.min.js
research.checkpoint.com/wp-content/themes/research/js/lib/ 		54 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/js/lib/flickity.pkgd.min.js?ver=1.0.1
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe2df9f6df4b4a8d7174d259f563b8d9e28e4c03f8f4092fd9db6044e0e64c32

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:31 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
17049446
etag
W/"5dc49a64-d7c9"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74a3698fca6f6933-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
single-post.js
research.checkpoint.com/wp-content/themes/research/js/ 		422 B
299 B 		Script
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/js/single-post.js?ver=1.0.4
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f5bd223eafa1c6d1aff21c91c6bfb825f7f36830d97eef41c432681ed671f85

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:31 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 14 Jan 2020 00:00:05 GMT
server
cloudflare
age
19999508
etag
W/"5e1d0485-1a6"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74a3698fca736933-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
inc-header.js
research.checkpoint.com/wp-content/themes/research/header/ 		1 KB
518 B 		Script
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/header/inc-header.js?v=1.1
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ae3754c54a0880a98a94c423d3e67f39b5b6f3c63516dafa33866e3e74c9f97d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:31 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
20000248
etag
W/"5dc49a64-47a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74a3698fca766933-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
style.css
research.checkpoint.com/wp-content/themes/research/header/ 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/header/style.css
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0fe8bcbcd24ab838fbbd773001253fc0353956e81c5ba9c8e23951ebdbae305a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:31 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
17359069
etag
W/"5dc49a64-25cb"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74a3698fca696933-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
css
fonts.googleapis.com/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
234b9bab83aa0c52e9e5192995427a2bc44876cf1a11545ed631f369b8dc6534
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 13 Sep 2022 18:22:59 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Tue, 13 Sep 2022 19:50:31 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 13 Sep 2022 19:50:31 GMT
facebook.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/facebook.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.46.214.56 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-46-214-56.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
791d8c8cb135d3d53915096e999d3857b6ee16966c20a019f38699f09f6aa2ff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Tue, 13 Sep 2022 19:50:31 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"7eb7015574801089503dd7095e1d4313:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1254
google-plus.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/google-plus.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.46.214.56 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-46-214-56.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
1998582382fbf956231d65be84b76e08c0c86e5ced8a99c703bdec416d876d76

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Tue, 13 Sep 2022 19:50:31 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"eedd0b2cde10b6b1930d57a10c6d0422:1612322629.149034"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1653
linkedin.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/linkedin.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.46.214.56 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-46-214-56.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a22d6b8782097b7cd9588ab582e119bfd6290278275661e9d0f96b2baec0cb8e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Tue, 13 Sep 2022 19:50:32 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"6789b034de6591b26bbd9b5fa6b451ca:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1416
email.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/email.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.46.214.56 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-46-214-56.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
3643b2c826a615065303aa44b8f463eb854d77934f5f25dc1f74f60d4698f9f0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Tue, 13 Sep 2022 19:50:31 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"15f1e1004accdbc019365e658249f334:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1407
rss.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/rss.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.46.214.56 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-46-214-56.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
b7cfb1c9430d90b22b3f4497543a4cfef719dc40a3cce130cad766171abe8bbe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Tue, 13 Sep 2022 19:50:31 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"8cc18e3677ea53cc679e33e82bf9497a:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1620
twitter.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/twitter.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.46.214.56 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-46-214-56.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a59bba774218f207179b30aa8bbd21bad0f7355a52321e08138bd77a308c27d5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Tue, 13 Sep 2022 19:50:32 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"6b05f4fc9522afa0cdbeb1a2c0bccc2c:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1608
check-point-research-logo.gif
sc1.checkpoint.com/sc1/inc/html/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/check-point-research-logo.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.46.214.56 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-46-214-56.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Tue, 13 Sep 2022 19:50:31 GMT
Last-Modified
Mon, 09 Jul 2018 21:15:16 GMT
Server
AkamaiNetStorage
ETag
"c425f4400a5c9dfbaecb24275f494931:1531172224"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
2901
under-attack.gif
research.checkpoint.com/wp-content/themes/research/img/lib/ 		458 B
727 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/themes/research/img/lib/under-attack.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c0f7ef8329ae6da56bd269492901fb024a05d7b67e977995a82b506af4b3b030

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:31 GMT
cf-cache-status
HIT
age
1039365
cf-polished
origFmt=gif, origSize=1666
content-disposition
inline; filename="under-attack.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
458
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
etag
"5dc49a64-682"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
74a36990b97d691f-FRA
cf-bgj
imgq:100,h2pri
image2.png
research.checkpoint.com/wp-content/uploads/2022/06/ 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2022/06/image2.png
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
943a1b1e71227309f613db611de5c22d02c999de5798a601e5e4229fb62371e6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:31 GMT
cf-cache-status
MISS
last-modified
Fri, 10 Jun 2022 07:28:54 GMT
server
cloudflare
etag
"62a2f2b6-8eed"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
74a36990b97e691f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
36589
email-decode.min.js
research.checkpoint.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 		1 KB
871 B 		Script
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 09 Sep 2022 17:33:45 GMT
server
cloudflare
x-frame-options
DENY
etag
W/"631b78f9-4d7"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
74a369909961691f-FRA
expires
Thu, 15 Sep 2022 19:50:31 GMT
sharethis.js
platform-api.sharethis.com/js/ 		190 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform-api.sharethis.com/js/sharethis.js
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.189.81 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-189-81.fra2.r.cloudfront.net
Software
/
Resource Hash
2b02c99b94bd29097fd168548bea6dfc28c9ffd3c2d751c1f375c9da902d8f63
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:47:19 GMT
content-encoding
gzip
vary
Accept-Encoding
age
192
etag
W/"2f749-jZtDoLQECLv0cAmOiJJ6B61Kdic"
x-frame-options
SAMEORIGIN
x-cache
Hit from cloudfront
content-type
text/javascript; charset=utf-8
via
1.1 3aed5a4f89d72775aaf2cc5a5f642386.cloudfront.net (CloudFront)
edge-control
cache-maxage=60m,downstream-ttl=60m
cache-control
max-age=600, public
x-amz-cf-pop
FRA2-C1
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-id
sL52MsWnRFMM-hUWK5wa0yGQroSOXWvVlx0vuN9JyOnWcbwXuKNfkQ==
CfP_1021x580_A.jpg
research.checkpoint.com/wp-content/uploads/2018/11/ 		128 KB
128 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2018/11/CfP_1021x580_A.jpg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
408ddad0ef179adef886bffc95c5851680e2e1a3d9f04a03f5bb8d1efb73344c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:31 GMT
cf-cache-status
HIT
age
17359068
cf-polished
origSize=134980, status=webp_bigger
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
130561
last-modified
Thu, 07 Nov 2019 22:27:41 GMT
server
cloudflare
etag
"5dc49a5d-20f44"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
74a36990b97f691f-FRA
cf-bgj
imgq:100,h2pri
enlighterjs.min.js
research.checkpoint.com/wp-content/plugins/enlighter/cache/ 		57 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/plugins/enlighter/cache/enlighterjs.min.js?ver=TJ0/7+iAWMKbDKS
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7e0c4a1ed3d232553d98c82ea0e04cee8975d0a67df819e161f96e7c32179e8c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:31 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 15 Feb 2021 20:35:46 GMT
server
cloudflare
age
21704531
etag
W/"602adb22-e33f"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74a36990a971691f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
OneSignalSDK.js
cdn.onesignal.com/sdks/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=6.0.2
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d12c6745eca14e06d4dea70f4c2bd875769b349770d04300477ab18d0db005d4
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

cf-ray
74a36990eb77bbc2-FRA
date
Tue, 13 Sep 2022 19:50:31 GMT
via
1.1 google
cf-cache-status
HIT
server
cloudflare
age
2798
etag
W/"ae63ef8ff03da61fffaa7f165729897a"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=259200
strict-transport-security
max-age=15552000; includeSubDomains
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Fri, 16 Sep 2022 19:50:31 GMT
gtm.js
www.googletagmanager.com/ 		272 KB
81 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a125cbc6c0b638507ead3c379e240e4677fc8f8837bb900b21ef6bc86a19e76d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:31 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
82291
x-xss-protection
0
last-modified
Tue, 13 Sep 2022 18:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 13 Sep 2022 19:50:31 GMT
search-icon.gif
sc1.checkpoint.com/sc1/inc/html/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/search-icon.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/wp-content/themes/research/header/style.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.46.214.56 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-46-214-56.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
953d6908ab55929254e46c77e5c751a6e2df7ab84430f134edc3bb62d8f7d32f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Tue, 13 Sep 2022 19:50:31 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"2e1aa25e7e77e6a393fd38efb413370f:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1755
34CA47_6_0.woff2
research.checkpoint.com/wp-content/themes/research/fonts/ 		58 KB
58 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/fonts/34CA47_6_0.woff2
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.32
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0fc686423c26cb1030032fd7e4f2dd664c4b08517a8990c0b46269dd4e01910b

Request headers

Referer
https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.32
Origin
https://research.checkpoint.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:31 GMT
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
3536355
etag
"5dc49a64-e890"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
74a36990c9a1691f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
59536
IranSpearPhishing-social-FB-LI.jpg
research.checkpoint.com/wp-content/uploads/2022/06/ 		145 KB
145 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2022/06/IranSpearPhishing-social-FB-LI.jpg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
837bf851229384ad9d7eb78b9d3cce910c8d6c799644f0a0cb1bf6aa27eb3930

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:32 GMT
cf-cache-status
MISS
last-modified
Fri, 10 Jun 2022 23:30:38 GMT
server
cloudflare
etag
"62a3d41e-244a6"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
74a36990e9d9691f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
148646
image3.png
research.checkpoint.com/wp-content/uploads/2022/06/ 		58 KB
58 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2022/06/image3.png
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
772ac6f594c97fb68dd038b491f43890edd6cb741f71bd9a21a5e65ab1c4ee66

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:32 GMT
cf-cache-status
MISS
last-modified
Fri, 10 Jun 2022 07:28:55 GMT
server
cloudflare
etag
"62a2f2b7-e638"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
74a369912a4f691f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
58936
image4.png
research.checkpoint.com/wp-content/uploads/2022/06/ 		36 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2022/06/image4.png
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8303d853bcefe186c32005fc9b0c2baa29670ddeb27afe563f957bccaa717d0a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:32 GMT
cf-cache-status
MISS
last-modified
Fri, 10 Jun 2022 07:28:57 GMT
server
cloudflare
etag
"62a2f2b9-9172"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
74a369912a51691f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
37234
image5.png
research.checkpoint.com/wp-content/uploads/2022/06/ 		61 KB
61 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2022/06/image5.png
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
53407349057c67f649d8288413013dc71304220982f94dc79bc80372b9ffcef2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:32 GMT
cf-cache-status
MISS
last-modified
Fri, 10 Jun 2022 07:28:58 GMT
server
cloudflare
etag
"62a2f2ba-f44c"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
74a369912a57691f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
62540
image6.png
research.checkpoint.com/wp-content/uploads/2022/06/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2022/06/image6.png
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a18555bfddb67377c542c8795cd09ec0cd94a5dca6d21236995001ca5954306f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:32 GMT
cf-cache-status
MISS
last-modified
Fri, 10 Jun 2022 07:28:59 GMT
server
cloudflare
etag
"62a2f2bb-2760"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
74a369912a5a691f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
10080
image7.png
research.checkpoint.com/wp-content/uploads/2022/06/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2022/06/image7.png
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
292300e164a4d590f6785ec87a49d8557a9ca0631d7aa22942aee96d90e93b91

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:32 GMT
cf-cache-status
MISS
last-modified
Fri, 10 Jun 2022 07:29:00 GMT
server
cloudflare
etag
"62a2f2bc-3e7d"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
74a369912a5b691f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
15997
5a3031770f16c70012a3c297.js
buttons-config.sharethis.com/js/ 		525 B
941 B 		Script
General
Check archive.org
Download Go to
Full URL
https://buttons-config.sharethis.com/js/5a3031770f16c70012a3c297.js
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:2000:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
eee6d8fe37122ba1538560131fe5c95f9a4b6c45e2059076a7a92513fcb12f20
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:01 GMT
via
1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
last-modified
Tue, 12 Dec 2017 19:43:54 GMT
server
AmazonS3
age
30
etag
"29c30155cdf2eaa96943948b94d537b6"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
cache-control
max-age=60,public
accept-ranges
bytes
x-amz-cf-pop
FRA2-C1
strict-transport-security
max-age=31536000; includeSubDomains
content-length
525
x-amz-cf-id
WcY41lPhV7QmgRzaL15n6X6VxxF-AHdqw5wiqtojLvukOAjtv8Ouhw==
pview
l.sharethis.com/ 		0
410 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://l.sharethis.com/pview?event=pview&hostname=research.checkpoint.com&location=%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F&product=sticky-share-buttons&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F%3Fmkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-&source=sharethis.js&fcmp=false&fcmpv2=false&has_segmentio=false&title=Iranian%20Spear-Phishing%20Operation%20Targets%20Former%20Israeli%20and%20US%20High-Ranking%20Officials%20-%20Check%20Point%20Research&refDomain=click.checkpoint.com&cms=unknown&publisher=5a3031770f16c70012a3c297&sop=true&version=st_sop.js&lang=en&description=Introduction%20Check%20Point%20Research%20uncovers%20a%20recent%20Iranian-based%20spear-phishing%20operation%20aimed%20against%20former%20Israeli%20officials%2C%20high-ranking%20military%20personnel%2C%20research%20fellows%20in%20research%20institutions%2C%20think%20tanks%2C%20and%20against%20Israeli%20citizens.%20The%20attacks%20use%20a%20custom%20phishing%20infrastructure%2C%20as%20well%20as%20a%20wide%20array%20of%20fake%20email%20accounts%20to%20impersonate%20trusted%20parties.%20To%20establish%20deeper%20trust%20with...%20Click%20to%20Read%20More
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.249.23 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-57-249-23.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Tue, 13 Sep 2022 19:50:31 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains;
Access-Control-Allow-Origin
https://research.checkpoint.com
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Access-Control-Max-Age
1728000
Connection
keep-alive
Access-Control-Allow-Headers
*
log
l.sharethis.com/ 		0
380 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://l.sharethis.com/log?event=ibl&title=&url=https%3A%2F%2Fclick.checkpoint.com%2F&fcmp=false&fcmpv2=false&has_segmentio=false&product=sticky-share-buttons&publisher=5a3031770f16c70012a3c297&refDomain=click.checkpoint.com&refQuery=&source=sharethis.js&ts=1663098631869&sop=true&cms=unknown&description=Introduction%20Check%20Point%20Research%20uncovers%20a%20recent%20Iranian-based%20spear-phishing%20operation%20aimed%20against%20former%20Israeli%20officials%2C%20high-ranking%20military%20personnel%2C%20research%20fellows%20in%20research%20institutions%2C%20think%20tanks%2C%20and%20against%20Israeli%20citizens.%20The%20attacks%20use%20a%20custom%20phishing%20infrastructure%2C%20as%20well%20as%20a%20wide%20array%20of%20fake%20email%20accounts%20to%20impersonate%20trusted%20parties.%20To%20establish%20deeper%20trust%20with...%20Click%20to%20Read%20More
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.249.23 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-57-249-23.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Tue, 13 Sep 2022 19:50:31 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains;
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Access-Control-Max-Age
1728000
Connection
keep-alive
Access-Control-Allow-Headers
*
image8.png
research.checkpoint.com/wp-content/uploads/2022/06/ 		33 KB
33 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2022/06/image8.png
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c6cf1b1801acf2d1e7767962782e3ea3d4aceefd6c2ffc08cdd8ba41aebce98a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:32 GMT
cf-cache-status
MISS
last-modified
Fri, 10 Jun 2022 07:29:01 GMT
server
cloudflare
etag
"62a2f2bd-8212"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
74a369915ac5691f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
33298
image9.png
research.checkpoint.com/wp-content/uploads/2022/06/ 		51 KB
51 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2022/06/image9.png
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
87a4d32b1d3411b7695538302d3e9ada4666aff61243f6e6bc968ee3b2d6db38

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:32 GMT
cf-cache-status
MISS
last-modified
Fri, 10 Jun 2022 07:29:02 GMT
server
cloudflare
etag
"62a2f2be-ca5e"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
74a369915ac7691f-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
51806
OneSignalPageSDKES6.js
cdn.onesignal.com/sdks/ 		283 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=6.0.2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
843114448aaeeda7e8caa0cf76d61e0c63b8bffccd34517483363fdb15cdc80c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

cf-ray
74a36991bf789b4c-FRA
date
Tue, 13 Sep 2022 19:50:31 GMT
via
1.1 google
cf-cache-status
HIT
server
cloudflare
age
2804
etag
W/"2f96824aee4bf927e734cc519e3e726d"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=259200
strict-transport-security
max-age=15552000; includeSubDomains
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Fri, 16 Sep 2022 19:50:31 GMT
twitter.svg
platform-cdn.sharethis.com/img/ 		731 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/twitter.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:4400:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7c93346d4f681a0be90d1dfc19346382a4700f1810f41caa54415688dee1777f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Thu, 18 Aug 2022 01:05:31 GMT
via
1.1 6fa33d47af6f4da7007689083cfe9b9c.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
age
2313902
etag
"0af2fb38987598376c99e21af17ade45"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
731
x-amz-cf-id
yojaZKni-EbLFxxZE2qbf_whGVYae_4DuqTDGvinot18-yVZYeKkCg==
whatsapp.svg
platform-cdn.sharethis.com/img/ 		832 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/whatsapp.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:4400:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
847eb36b4dc4b05f94052dcd98077319e74d882334a106bb9ca451ba211c9c2c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Sun, 14 Aug 2022 22:10:43 GMT
via
1.1 6fa33d47af6f4da7007689083cfe9b9c.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
age
2583590
etag
"afe7fc60ed757db39a88d2950fce69c9"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
832
x-amz-cf-id
IEsgQVvWeK27u86sVcGXmSqGMFFxD4U0R-xkDTLDk1hbT_NtFrXtyA==
facebook.svg
platform-cdn.sharethis.com/img/ 		301 B
724 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/facebook.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:4400:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Fri, 02 Sep 2022 05:08:41 GMT
via
1.1 6fa33d47af6f4da7007689083cfe9b9c.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
age
1003312
etag
"c6e9be45643e197ce1db1d7e24a99adc"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
301
x-amz-cf-id
kZo6h5VkrrjsGWBRtdSO-S5BhFxUNgR1BFfhbk0miU1PorOgyvgaKQ==
linkedin.svg
platform-cdn.sharethis.com/img/ 		456 B
881 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/linkedin.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:4400:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Mon, 29 Aug 2022 03:10:45 GMT
via
1.1 6fa33d47af6f4da7007689083cfe9b9c.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
age
1355988
etag
"fa43b4ede18498b114fc7185993f6da7"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
456
x-amz-cf-id
fbzGWu4moih_RVHQECmGrXu6MT3PxPyjv06G2YRyy859EuB7ti2Y4A==
email.svg
platform-cdn.sharethis.com/img/ 		343 B
768 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/email.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:4400:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Mon, 22 Aug 2022 04:56:04 GMT
via
1.1 6fa33d47af6f4da7007689083cfe9b9c.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
age
1954469
etag
"5977437466e857c7ddcadda6f6d88c2a"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
343
x-amz-cf-id
7szyUp5fu9e1Mc3H25Yr727_8zMkgPlMYscu4mERBzZkKFxQHOJ1fw==
pinterest.svg
platform-cdn.sharethis.com/img/ 		771 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/pinterest.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:4400:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
efc737b4f58cfe73a9bd0e57d7570365701381da31e628b269e7217a0ce3359d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Sat, 20 Aug 2022 03:57:45 GMT
via
1.1 6fa33d47af6f4da7007689083cfe9b9c.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
age
2130768
etag
"2b10a062e719c64b686e2e8fcdc216dc"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
771
x-amz-cf-id
4z1VFlag6Eb4rJOWgsCSo3LWsVZEOuVA_cMLsJswfOwRHHcyeBBXoA==
sharethis.svg
platform-cdn.sharethis.com/img/ 		514 B
937 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/sharethis.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:4400:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Fri, 09 Sep 2022 00:38:14 GMT
via
1.1 6fa33d47af6f4da7007689083cfe9b9c.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
age
414739
etag
"deecdaa377907db5cc1722fc831670a1"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
514
x-amz-cf-id
4xqQ4YU5d-SK2opEXpGhrzwnaAinyHAuu6fC_Nn_xWF7vosAIBGyuQ==
reddit.svg
platform-cdn.sharethis.com/img/ 		910 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/reddit.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:4400:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
dadbb59b37bfea4c78c6e15c8cbb96dfba84526e43a0767dc244fd062a841aba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Thu, 25 Aug 2022 06:22:19 GMT
via
1.1 6fa33d47af6f4da7007689083cfe9b9c.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
age
1690094
etag
"78d796ca648d8a5e665b48ed0217c56a"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
910
x-amz-cf-id
LhUZqhMwT8PaD5KuNNSASE0cJmTw60af-6a0sqM6cdz7AV9zrhaZVA==
arrow_left.svg
platform-cdn.sharethis.com/img/ 		565 B
1007 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/arrow_left.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:4400:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Wed, 07 Sep 2022 05:01:47 GMT
via
1.1 6fa33d47af6f4da7007689083cfe9b9c.cloudfront.net (CloudFront)
vary
Accept-Encoding
age
571726
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
565
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
etag
"b55d8d2b9321e381a3c38a4bddb74037"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
ysXShFp6qWuLpjXz2JT1haxJDBf3TiOtatkxJ5R1JnaJB9rLrArxcA==
arrow_right.svg
platform-cdn.sharethis.com/img/ 		565 B
988 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/arrow_right.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:4400:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Sun, 11 Sep 2022 09:21:07 GMT
via
1.1 6fa33d47af6f4da7007689083cfe9b9c.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
age
210566
etag
"9928d025bd5792b718ee0a185f62e67c"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
565
x-amz-cf-id
AOjM7EpkCtwWcpdpL49Olw-d89VVJ1BlU4CRDKj6d7v6n4aPQ3VA0A==
web
onesignal.com/api/v1/sync/3ba17c77-81bb-4a83-8917-7b62de3d6e22/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onesignal.com/api/v1/sync/3ba17c77-81bb-4a83-8917-7b62de3d6e22/web?callback=__jp0
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d43f8786c88edd43fcaf08b571d0ceccd70d2575e4f2339eebca9b4e6875fe40
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:32 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
EXPIRED
x-permitted-cross-domain-policies
none
status
200 OK
x-envoy-upstream-service-time
83
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
x-request-id
2b1e540d-b3be-4476-ba6e-8706590b921e
x-runtime
0.082379
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"d43f8786c88edd43fcaf08b571d0cecc"
x-download-options
noopen
strict-transport-security
max-age=15552000; includeSubDomains
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=3600
cf-ray
74a369922dabbbc2-FRA
access-control-allow-headers
SDK-Version
expires
Tue, 13 Sep 2022 20:50:32 GMT
6si.min.js
j.6sc.co/ 		30 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: click.checkpoint.com
URL: https://click.checkpoint.com/NzUwLURRSC01MjgAAAGFK7lURAn05U1bX4Htvjnr5Sd73cW3ZKnVbKE3mmFDMHjgbWBiGEC2sgjlEx3t6-tNEecc1jI=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.126.181.33 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-126-181-33.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
b71f76186117ab510aca8eb8208815da837acdd4b29e171c9897993175c28878
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 13 Sep 2022 19:50:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 22 Aug 2022 22:26:40 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"630402a0-786e"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
9594
expires
Tue, 13 Sep 2022 19:50:32 GMT
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Apr 2022 21:02:38 GMT
server
Golfe2
age
2912
date
Tue, 13 Sep 2022 19:02:00 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Tue, 13 Sep 2022 21:02:00 GMT
js
www.googletagmanager.com/gtag/ 		210 KB
73 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-48VXKGDGCV&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d4389721d4ab163ed6c8c6dbbc690c3a06fea18284d2fcf7b1d48890bab5eb1e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:34 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
75046
x-xss-protection
0
expires
Tue, 13 Sep 2022 19:50:34 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
447 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-194688-3&cid=1626863099.1663098632&jid=2037003323&gjid=319852063&_gid=257196422.1663098632&_u=YGBAgEABAAAAAE~&z=2075357219
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c06::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://research.checkpoint.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 13 Sep 2022 19:50:32 GMT
content-type
text/plain
access-control-allow-origin
https://research.checkpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=1706883603&t=pageview&_s=1&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F%3Fmkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-&dr=https%3A%2F%2Fclick.checkpoint.com%2F&ul=en-us&de=UTF-8&dt=Iranian%20Spear-Phishing%20Operation%20Targets%20Former%20Israeli%20and%20US%20High-Ranking%20Officials%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgEAB~&jid=2037003323&gjid=319852063&cid=1626863099.1663098632&tid=UA-194688-3&_gid=257196422.1663098632&gtm=2wg9c05JCRGP&z=643118784
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 13 Sep 2022 16:28:28 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
12124
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
OneSignalSDKStyles.css
onesignal.com/sdks/ 		82 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

cf-ray
74a369938bf09b4c-FRA
date
Tue, 13 Sep 2022 19:50:32 GMT
via
1.1 google
cf-cache-status
HIT
server
cloudflare
age
2804
etag
W/"4e9aaefffd5f8ae7dc83361aa2294190"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=2592000
strict-transport-security
max-age=15552000; includeSubDomains
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Thu, 13 Oct 2022 19:50:32 GMT
icon
onesignal.com/api/v1/apps/3ba17c77-81bb-4a83-8917-7b62de3d6e22/ 		176 B
599 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://onesignal.com/api/v1/apps/3ba17c77-81bb-4a83-8917-7b62de3d6e22/icon
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57e48df5586242df165fa8424ae8cb9e360c8e81b6a711736bf1f395a2c02a2f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:32 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
x-permitted-cross-domain-policies
none
status
200 OK
x-envoy-upstream-service-time
10
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
x-request-id
51e8f9a0-f2ec-46e5-97fc-d3742c944c32
x-runtime
0.008167
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"57e48df5586242df165fa8424ae8cb9e"
x-download-options
noopen
strict-transport-security
max-age=15552000; includeSubDomains
content-type
application/json; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
max-age=0, private, must-revalidate
cf-ray
74a36993dfbc910c-FRA
access-control-allow-headers
SDK-Version
ga-audiences
www.google.com/ads/ 		42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-194688-3&cid=1626863099.1663098632&jid=2037003323&_u=YGBAgEABAAAAAE~&z=206277066
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 13 Sep 2022 19:50:32 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-194688-3&cid=1626863099.1663098632&jid=2037003323&_u=YGBAgEABAAAAAE~&z=206277066
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 13 Sep 2022 19:50:32 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
7ec0ceb7-c110-40e8-9782-73562b05b110.gif
img.onesignal.com/t/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.onesignal.com/t/7ec0ceb7-c110-40e8-9782-73562b05b110.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:32 GMT
vary
Accept-Encoding
cf-cache-status
REVALIDATED
x-amz-request-id
CSV43WPQV31BEHHD
x-amz-meta-cache-control
public, maxage=604800
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2901
x-amz-id-2
Q9NqJLAVD+5gLsSkLRFgsDugdThxj3yYALMdgbnGc8Uc8DOvlW9aGq+Nzll1V6/471Fnugfdf5s=
last-modified
Mon, 26 Aug 2019 20:17:26 GMT
server
cloudflare
etag
"c425f4400a5c9dfbaecb24275f494931"
strict-transport-security
max-age=15552000; includeSubDomains
cache-control
public, max-age=2678400
accept-ranges
bytes
cf-ray
74a369943984bbc2-FRA
expires
Fri, 14 Oct 2022 19:50:32 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://research.checkpoint.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Thu, 08 Sep 2022 08:01:51 GMT
x-content-type-options
nosniff
age
474521
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 08 Sep 2023 08:01:51 GMT
getuidj
secure.adnxs.com/ 		11 B
713 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.89.210.153 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 13 Sep 2022 19:50:32 GMT
X-Proxy-Origin
185.213.155.166; 185.213.155.166; 943.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid
48f83ea2-d34b-402d-8449-75bf52939b96
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://research.checkpoint.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/ 		7 B
207 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.126.181.33 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-126-181-33.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:32 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://research.checkpoint.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
img.gif
b.6sc.co/v1/beacon/ 		43 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&visitor=a270e8d2-8019-44a6-8ecb-8189a9b9a186&session=d09c0ad0-bf19-4c6a-8cec-3d81f18306b5&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2013%20Sep%202022%2019%3A50%3A32%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20Spear-Phishing%20Operation%20Targets%20Former%20Israeli%20and%20US%20High-Ranking%20Officials%20-%20Check%20Point%20Research%22%7D&cb=&r=https%3A%2F%2Fclick.checkpoint.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F%3Fmkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-&pageViewId=05c5052b-0be3-41b8-8a53-c70c271cb1b1&an_uid=0
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.126.181.33 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-126-181-33.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:32 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
details
epsilon.6sense.com/v3/company/ 		431 B
425 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.70.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-70-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
507670a9c3b08c1e6a5ee1657bac6d0deb7862accb1ff090c2050b70104192c3

Request headers

Authorization
Token 08e578d30e2119adb1ab60b02b8f1dd15c6b908d
Referer
https://research.checkpoint.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:32 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://research.checkpoint.com
access-control-allow-credentials
true
content-length
235
details
epsilon.6sense.com/v3/company/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.70.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-70-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization
Access-Control-Request-Method
GET
Origin
https://research.checkpoint.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://research.checkpoint.com
access-control-max-age
1800
date
Tue, 13 Sep 2022 19:50:32 GMT
server
nginx
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=1706883603&t=event&ni=1&_s=1&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F%3Fmkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-&dr=https%3A%2F%2Fclick.checkpoint.com%2F&ul=en-us&de=UTF-8&dt=Iranian%20Spear-Phishing%20Operation%20Targets%20Former%20Israeli%20and%20US%20High-Ranking%20Officials%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aGDAgEABAAAAAE~&jid=&gjid=&cid=1626863099.1663098632&tid=UA-194688-3&_gid=257196422.1663098632&gtm=2wg9c05JCRGP&cd9=&cd10=&cd11=&cd12=&cd13=&cd14=&cd16=&cd17=Sweden&z=991840619
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 13 Sep 2022 16:28:28 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
12124
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
494 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&visitor=a270e8d2-8019-44a6-8ecb-8189a9b9a186&session=d09c0ad0-bf19-4c6a-8cec-3d81f18306b5&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2013%20Sep%202022%2019%3A50%3A33%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2013%20Sep%202022%2019%3A50%3A32%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20Spear-Phishing%20Operation%20Targets%20Former%20Israeli%20and%20US%20High-Ranking%20Officials%20-%20Check%20Point%20Research%22%7D&cb=&r=https%3A%2F%2Fclick.checkpoint.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F%3Fmkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-&pageViewId=05c5052b-0be3-41b8-8a53-c70c271cb1b1&an_uid=0
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.126.181.33 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-126-181-33.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:33 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
494 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&visitor=a270e8d2-8019-44a6-8ecb-8189a9b9a186&session=d09c0ad0-bf19-4c6a-8cec-3d81f18306b5&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2013%20Sep%202022%2019%3A50%3A34%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2013%20Sep%202022%2019%3A50%3A33%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20Spear-Phishing%20Operation%20Targets%20Former%20Israeli%20and%20US%20High-Ranking%20Officials%20-%20Check%20Point%20Research%22%7D&cb=&r=https%3A%2F%2Fclick.checkpoint.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F%3Fmkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-&pageViewId=05c5052b-0be3-41b8-8a53-c70c271cb1b1&an_uid=0
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/check-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives/?mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.126.181.33 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-126-181-33.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:34 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
collect
region1.google-analytics.com/g/ 		0
343 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-48VXKGDGCV&gtm=2oe9c0&_p=1706883603&cid=1626863099.1663098632&ul=en-us&sr=1600x1200&_z=ccd.v9B&_s=1&sid=1663098634&sct=1&seg=0&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F%3Fmkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-&dr=https%3A%2F%2Fclick.checkpoint.com%2F&dt=Iranian%20Spear-Phishing%20Operation%20Targets%20Former%20Israeli%20and%20US%20High-Ranking%20Officials%20-%20Check%20Point%20Research&en=page_view&_fv=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-48VXKGDGCV&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 13 Sep 2022 19:50:34 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://research.checkpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:11a::6867:4868 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:34 GMT
content-encoding
gzip
last-modified
Fri, 12 Aug 2022 20:23:36 GMT
x-cdn
AKAM
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=67667
accept-ranges
bytes
content-length
3063
uwt.js
static.ads-twitter.com/ 		56 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.16.157 Vienna, Austria, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
41b758f84ab2dd5da6f7ba488813d17410ebb48bc2074d304c26d63c5ece003d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:35 GMT
content-encoding
gzip
last-modified
Tue, 30 Aug 2022 15:04:19 GMT
etag
"d4de8398858246712016031c834bb061+gzip+gzip"
vary
Accept-Encoding,Host
x-tw-cdn
FT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache
x-cache
HIT, HIT
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
content-length
15317
x-served-by
cache-iad-kjyo7100110-IAD, cache-vie6325-VIE
munchkin.js
munchkin.marketo.net/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: click.checkpoint.com
URL: https://click.checkpoint.com/NzUwLURRSC01MjgAAAGFK7lURAn05U1bX4Htvjnr5Sd73cW3ZKnVbKE3mmFDMHjgbWBiGEC2sgjlEx3t6-tNEecc1jI=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.205.237.4 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-205-237-4.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
91a50850c517899e1c975079158949f7a500ddf5a7307fe36bf50092926beedc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Tue, 13 Sep 2022 19:50:34 GMT
Content-Encoding
gzip
Last-Modified
Fri, 09 Sep 2022 01:18:39 GMT
Server
AkamaiNetStorage
ETag
"92b41a298690c047b0c4602dd843cba4:1662686319.691662"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
728
fbevents.js
connect.facebook.net/en_US/ 		100 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: click.checkpoint.com
URL: https://click.checkpoint.com/NzUwLURRSC01MjgAAAGFK7lURAn05U1bX4Htvjnr5Sd73cW3ZKnVbKE3mmFDMHjgbWBiGEC2sgjlEx3t6-tNEecc1jI=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
5ae95e748ad12444cd760e245c02264cea3e8deb41fabd95f1e0784b81f72783
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
26737
x-xss-protection
0
pragma
public
x-fb-debug
TATRNSfxgFZh0OfPieMkY4JipSk3ty7ZPN3cO+O10c1AdJIa8aKm1zVr1kRFyk9EUqhk/5P1r2dSYg9nWV1bnQ==
x-fb-trip-id
686109401
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Tue, 13 Sep 2022 19:50:34 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
1692853834349189
connect.facebook.net/signals/config/ 		292 KB
84 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/1692853834349189?v=2.9.79&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
c7987fa399af086aa19748e7504ca702d17233ab72abbb1a078880ac9c3a9cce
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection
0
pragma
public
x-fb-debug
AnRPem9nxyqDaSbr7j3EvBhXU6pkd2m+3yG1Uhg3Tw4vc5VbO8MWgIRV/SwuInfyK1yMktgeyWISG4uFPJANOg==
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Tue, 13 Sep 2022 19:50:34 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1663098634803&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-fo...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D51830%26time%3D1663098634803%26url%3Dhttps%253A%252F%252Fresearch.checkpoint.com%...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1663098634803&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-fo...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1663098634803&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-f...
0
265 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1663098634803&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F%3Fmkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-&liSync=true&e_ipv6=AQIq_7FJ2CD08QAAAYM4Z0Qpi1T-fAWkc2mEB0qZZ3rQNvfDRDP2Jk2LadcKVTIcP6u5Wecn
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:34 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: BA45275A0C634CA7AC8CCE648E2F6330 Ref B: FRAEDGE1515 Ref C: 2022-09-13T19:50:35Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-proto
http/2
content-length
0
x-li-uuid
AAXolFNkRSr+iH3dVtZdkw==
x-li-fabric
prod-lva1

Redirect headers

date
Tue, 13 Sep 2022 19:50:34 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: ADB6D69E0D0B404BA3A17AA7FA2106E9 Ref B: FRAEDGE1121 Ref C: 2022-09-13T19:50:35Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1663098634803&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F%3Fmkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-&liSync=true&e_ipv6=AQIq_7FJ2CD08QAAAYM4Z0Qpi1T-fAWkc2mEB0qZZ3rQNvfDRDP2Jk2LadcKVTIcP6u5Wecn
x-li-proto
http/2
content-length
0
x-li-uuid
AAXolFNiGaOtCVxk2vPQsA==
/
www.facebook.com/tr/ 		44 B
297 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=1692853834349189&ev=PageView&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F%3Fmkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-&rl=https%3A%2F%2Fclick.checkpoint.com%2F&if=false&ts=1663098634875&sw=1600&sh=1200&v=2.9.79&r=stable&ec=0&o=30&fbp=fb.1.1663098634874.543569096&it=1663098634755&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:34 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
44
expires
Tue, 13 Sep 2022 19:50:34 GMT
munchkin.js
munchkin.marketo.net/162/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/162/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.205.237.4 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-205-237-4.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Tue, 13 Sep 2022 19:50:34 GMT
Content-Encoding
gzip
Last-Modified
Fri, 01 Jul 2022 00:59:12 GMT
Server
AkamaiNetStorage
ETag
"75daf56f6191efe42577301908659c29:1656637152.894482"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4677
Expires
Thu, 22 Dec 2022 19:50:34 GMT
visitWebPage
750-dqh-528.mktoresp.com/webevents/ 		2 B
318 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://750-dqh-528.mktoresp.com/webevents/visitWebPage?_mchNc=1663098634926&_mchCn=&_mchId=750-DQH-528&_mchTk=_mch-checkpoint.com-1663098634925-37584&mkt_tok=NzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-&_mchHo=research.checkpoint.com&_mchPo=&_mchRu=%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F&_mchPc=https%3A&_mchVr=162&_mchEcid=&_mchHa=&_mchRe=https%3A%2F%2Fclick.checkpoint.com%2F&_mchQp=mkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/162/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Tue, 13 Sep 2022 19:50:35 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
59a22c0c-7f5c-40a9-bfcc-01f1873d6394
adsct
t.co/i/ 		43 B
338 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/i/adsct?bci=3&eci=2&event_id=011396c9-10fc-498c-9801-4707ccf6a03b&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=6b7c1d48-a974-4804-91e7-a38edf874a99&tw_document_href=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F%3Fmkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxi3o&type=javascript&version=2.3.27
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.133 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-response-time
104
date
Tue, 13 Sep 2022 19:50:34 GMT
server
tsa_o
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
27e993d1fc8e926d1c6c5b880b52519b94549ebeafe81b5043563b15eff9f4f1
content-length
43
adsct
analytics.twitter.com/i/ 		43 B
394 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=011396c9-10fc-498c-9801-4707ccf6a03b&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=6b7c1d48-a974-4804-91e7-a38edf874a99&tw_document_href=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F%3Fmkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxi3o&type=javascript&version=2.3.27
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-response-time
111
date
Tue, 13 Sep 2022 19:50:34 GMT
server
tsa_o
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
x-transaction-id
272e3321845cfc16
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
e73f58957838a9511d932a14f91a2a28378dd66bd6ed30035973c676810680c5
content-length
43
trends.min.js
assets.trendemon.com/tag/ 		220 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.trendemon.com/tag/trends.min.js
Requested by
Host: click.checkpoint.com
URL: https://click.checkpoint.com/NzUwLURRSC01MjgAAAGFK7lURAn05U1bX4Htvjnr5Sd73cW3ZKnVbKE3mmFDMHjgbWBiGEC2sgjlEx3t6-tNEecc1jI=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.189.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-189-126.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
67affcd8e2f46a4ab641f378e973888030cc93455e54b6a042cb0691056549d2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 12:23:08 GMT
content-encoding
gzip
last-modified
Mon, 05 Sep 2022 08:38:16 GMT
server
AmazonS3
age
26855
etag
"3d6c5cab0eeb5ffb72700457b43a473e"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
content-length
43730
x-amz-cf-id
LU3YN1eHA23ULb0wREHGvD9grgjHupE9bEW8m_zcwipwRD7h9akzlQ==
2336
trackingapi.trendemon.com/api/settings/ 		746 B
885 B 		Script
General
Check archive.org
Download Go to
Full URL
https://trackingapi.trendemon.com/api/settings/2336?callback=jsonp113872&vid=
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.168.228.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-168-228-181.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
e269a38e915722f2f12862dec2402c2226110d0d3123e758513234a3163914de

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 13 Sep 2022 19:50:35 GMT
cache-control
no-store,no-cache
server
Kestrel
content-length
746
content-type
application/x-javascript; charset=UTF-8
/
www.facebook.com/tr/ Frame CFC1 		0
18 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://research.checkpoint.com
Referer
https://research.checkpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://research.checkpoint.com
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Tue, 13 Sep 2022 19:50:35 GMT
priority
u=0
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
img.gif
b.6sc.co/v1/beacon/ 		43 B
494 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&visitor=a270e8d2-8019-44a6-8ecb-8189a9b9a186&session=d09c0ad0-bf19-4c6a-8cec-3d81f18306b5&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2013%20Sep%202022%2019%3A50%3A35%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2013%20Sep%202022%2019%3A50%3A34%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20Spear-Phishing%20Operation%20Targets%20Former%20Israeli%20and%20US%20High-Ranking%20Officials%20-%20Check%20Point%20Research%22%7D&cb=&r=https%3A%2F%2Fclick.checkpoint.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F%3Fmkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-&pageViewId=05c5052b-0be3-41b8-8a53-c70c271cb1b1&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.126.181.33 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-126-181-33.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:35 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
identity.min.js
assets.trendemon.com/global/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.trendemon.com/global/identity.min.js
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.189.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-189-126.fra2.r.cloudfront.net
Software
/ Express
Resource Hash
c66036f1288dcf003502e4f687e102a7ec6afe8bfa29daa9a5bb5ab62eb3567c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 03:12:03 GMT
content-encoding
gzip
age
59919
x-powered-by
Express
x-cache
Hit from cloudfront
via
1.1 3bf3e75bcb9a86b3eb343a1d4392a6de.cloudfront.net (CloudFront)
trd-ts
2022-09-10T03:11:44.812Z
last-modified
Mon, 05 Sep 2022 08:36:43 GMT
etag
W/"46f8-1830ccb7178"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
x-amz-cf-id
SJkMvXrsZoyHeEnuWMek4-HzMgM0PlMM3ndxNXP8sTJ85fDQ8ylB_A==
me
trackingapi.trendemon.com/api/Identity/ 		94 B
508 B 		Script
General
Check archive.org
Download Go to
Full URL
https://trackingapi.trendemon.com/api/Identity/me?accountId=2336&DomainCookie=16630986355227310&fingerPrint=d26d751f1986e8bb55982e80b2c0dd74&callback=jsonp510743&vid=
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.168.228.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-168-228-181.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
8fb232c566025b7f4c6f8836ccd98898e17afd104815d2383d63591f89b8f01a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 13 Sep 2022 19:50:35 GMT
cache-control
no-store,no-cache
server
Kestrel
content-length
94
content-type
application/x-javascript; charset=UTF-8
marketingautomation
trackingapi.trendemon.com/api/ 		94 B
231 B 		Script
General
Check archive.org
Download Go to
Full URL
https://trackingapi.trendemon.com/api/marketingautomation?AccountId=2336&ClientUrl=aHR0cHM6Ly9yZXNlYXJjaC5jaGVja3BvaW50LmNvbS8yMDIyL2NoZWNrLXBvaW50LXJlc2VhcmNoLWV4cG9zZXMtYW4taXJhbmlhbi1waGlzaGluZy1jYW1wYWlnbi10YXJnZXRpbmctZm9ybWVyLWlzcmFlbGktZm9yZWlnbi1taW5pc3Rlci1mb3JtZXItdXMtYW1iYXNzYWRvci1pZGYtZ2VuZXJhbC1hbmQtZGVmZW5zZS1pbmR1c3RyeS1leGVjdXRpdmVzLz9ta3RfdG9rPU56VXdMVVJSU0MwMU1qZ0FBQUdGSzdsVVJGeFNhR0luYmNNcG5nblpfNTlTNTBpUmZEdnBWaDNfMVE4S2lnbk9vOTJwSzFsaXhUQ3k4bzFEZEc4SXh4bmpMa1Uzb0dYM2FGSGczaGhYSEJCYzNmSVVuOVlEZExESGpUVXNpYTJlMkcxLQ%3D%3D&CookieId=16630986355227310&MaCookie=aWQ6NzUwLURRSC01MjgmdG9rZW46X21jaC1jaGVja3BvaW50LmNvbS0xNjYzMDk4NjM0OTI1LTM3NTg0&MaCookieName=X21rdG9fdHJr&MaName=marketo&callback=jsonp650179&vid=2336:16630986355227310
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.168.228.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-168-228-181.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
80b723122618b5dfe69a8430285a7798c58015a01ec210d3d4bff8eebc027216

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 13 Sep 2022 19:50:35 GMT
cache-control
no-store,no-cache
server
Kestrel
content-length
94
content-type
application/x-javascript; charset=UTF-8
personal
trackingapi.trendemon.com/api/experience/ 		15 B
114 B 		Script
General
Check archive.org
Download Go to
Full URL
https://trackingapi.trendemon.com/api/experience/personal?AccountId=2336&ClientUrl=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F%3Fmkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-&MarketingAutomationCookie=id%3A750-DQH-528%26token%3A_mch-checkpoint.com-1663098634925-37584&ExcludeUnitsJson=%5B%5D&callback=jsonp386444&vid=2336:16630986355227310
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.168.228.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-168-228-181.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
ad5f554ef74d12bbdd7ed7ec6d9d2a9de60effe3c94c7049e4ae1453df7b22ac

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:35 GMT
server
Kestrel
content-length
15
content-type
application/x-javascript; charset=UTF-8
pageview
trackingapi.trendemon.com/api/events/ 		43 B
234 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trackingapi.trendemon.com/api/events/pageview?accountId=2336&url=aHR0cHM6Ly9yZXNlYXJjaC5jaGVja3BvaW50LmNvbS8yMDIyL2NoZWNrLXBvaW50LXJlc2VhcmNoLWV4cG9zZXMtYW4taXJhbmlhbi1waGlzaGluZy1jYW1wYWlnbi10YXJnZXRpbmctZm9ybWVyLWlzcmFlbGktZm9yZWlnbi1taW5pc3Rlci1mb3JtZXItdXMtYW1iYXNzYWRvci1pZGYtZ2VuZXJhbC1hbmQtZGVmZW5zZS1pbmR1c3RyeS1leGVjdXRpdmVzLz9ta3RfdG9rPU56VXdMVVJSU0MwMU1qZ0FBQUdGSzdsVVJGeFNhR0luYmNNcG5nblpfNTlTNTBpUmZEdnBWaDNfMVE4S2lnbk9vOTJwSzFsaXhUQ3k4bzFEZEc4SXh4bmpMa1Uzb0dYM2FGSGczaGhYSEJCYzNmSVVuOVlEZExESGpUVXNpYTJlMkcxLQ%3D%3D&cookie=16630986355227310&referral=aHR0cHM6Ly9jbGljay5jaGVja3BvaW50LmNvbS8%3D&vid=2336:16630986355227310&r=1663098635761
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.168.228.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-168-228-181.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 13 Sep 2022 19:50:35 GMT
server
Kestrel
age
1691358
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
content-length
43
expires
Mon, 01 Jan 1990 00:00:00 GMT
multiple
trackingapi.trendemon.com/api/events/client-app/ 		43 B
234 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trackingapi.trendemon.com/api/events/client-app/multiple?accountId=2336&url=aHR0cHM6Ly9yZXNlYXJjaC5jaGVja3BvaW50LmNvbS8yMDIyL2NoZWNrLXBvaW50LXJlc2VhcmNoLWV4cG9zZXMtYW4taXJhbmlhbi1waGlzaGluZy1jYW1wYWlnbi10YXJnZXRpbmctZm9ybWVyLWlzcmFlbGktZm9yZWlnbi1taW5pc3Rlci1mb3JtZXItdXMtYW1iYXNzYWRvci1pZGYtZ2VuZXJhbC1hbmQtZGVmZW5zZS1pbmR1c3RyeS1leGVjdXRpdmVzLz9ta3RfdG9rPU56VXdMVVJSU0MwMU1qZ0FBQUdGSzdsVVJGeFNhR0luYmNNcG5nblpfNTlTNTBpUmZEdnBWaDNfMVE4S2lnbk9vOTJwSzFsaXhUQ3k4bzFEZEc4SXh4bmpMa1Uzb0dYM2FGSGczaGhYSEJCYzNmSVVuOVlEZExESGpUVXNpYTJlMkcxLQ%3D%3D&app=sixsense&names=%5B%5D&vid=2336:16630986355227310&r=1663098635823
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.168.228.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-168-228-181.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 13 Sep 2022 19:50:35 GMT
server
Kestrel
age
1691358
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
content-length
43
expires
Mon, 01 Jan 1990 00:00:00 GMT
personal-embedded
trackingapi.trendemon.com/api/experience/ 		15 B
114 B 		Script
General
Check archive.org
Download Go to
Full URL
https://trackingapi.trendemon.com/api/experience/personal-embedded?AccountId=2336&ClientUrl=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F%3Fmkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-&MarketingAutomationCookie=id%3A750-DQH-528%26token%3A_mch-checkpoint.com-1663098634925-37584&Ids=%5B%5D&Groups=%5B%5D&callback=jsonp867768&vid=2336:16630986355227310
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.168.228.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-168-228-181.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
52ba319a654d4a8385ae25d40096bce97b5b69f356548433aedb9e6a0118289d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:35 GMT
server
Kestrel
content-length
15
content-type
application/x-javascript; charset=UTF-8
img.gif
b.6sc.co/v1/beacon/ 		43 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&visitor=a270e8d2-8019-44a6-8ecb-8189a9b9a186&session=d09c0ad0-bf19-4c6a-8cec-3d81f18306b5&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2013%20Sep%202022%2019%3A50%3A36%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2013%20Sep%202022%2019%3A50%3A35%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20Spear-Phishing%20Operation%20Targets%20Former%20Israeli%20and%20US%20High-Ranking%20Officials%20-%20Check%20Point%20Research%22%7D&cb=&r=https%3A%2F%2Fclick.checkpoint.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F%3Fmkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-&pageViewId=05c5052b-0be3-41b8-8a53-c70c271cb1b1&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.126.181.33 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-126-181-33.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:36 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
494 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&visitor=a270e8d2-8019-44a6-8ecb-8189a9b9a186&session=d09c0ad0-bf19-4c6a-8cec-3d81f18306b5&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2013%20Sep%202022%2019%3A50%3A37%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2013%20Sep%202022%2019%3A50%3A36%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%225006%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Iranian%20Spear-Phishing%20Operation%20Targets%20Former%20Israeli%20and%20US%20High-Ranking%20Officials%20-%20Check%20Point%20Research%22%7D&cb=&r=https%3A%2F%2Fclick.checkpoint.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fcheck-point-research-exposes-an-iranian-phishing-campaign-targeting-former-israeli-foreign-minister-former-us-ambassador-idf-general-and-defense-industry-executives%2F%3Fmkt_tok%3DNzUwLURRSC01MjgAAAGFK7lURFxSaGInbcMpngnZ_59S50iRfDvpVh3_1Q8KignOo92pK1lixTCy8o1DdG8IxxnjLkU3oGX3aFHg3hhXHBBc3fIUn9YDdLDHjTUsia2e2G1-&pageViewId=05c5052b-0be3-41b8-8a53-c70c271cb1b1&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.126.181.33 Chicago, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-126-181-33.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 13 Sep 2022 19:50:37 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

127 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| dataLayer function| $ function| jQuery object| bootstrap function| jQueryBridget function| EvEmitter function| getSize function| matchesSelector object| fizzyUIUtils function| Flickity function| Unipointer function| Unidragger function| TapListener function| imagesLoaded function| documentInitOneSignal function| OneSignal object| st object| __stdos__ boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus function| __sharethis__docReady object| __sharethis__ object| EnlighterJS function| EnlighterJSINIT number| __oneSignalSdkLoadCount object| _oneSignalInitOptions function| __jp0 object| google_tag_manager function| postscribe object| google_tag_manager_external function| processEpsilonData string| epsilonName boolean| enabled function| callback number| version object| _6si object| google_tag_data string| GoogleAnalyticsObject function| ga number| TRD_ACC_ID object| gaplugins object| gaGlobal object| gaData boolean| _storagePopulated function| onYouTubeIframeAPIReady string| _linkedin_data_partner_id function| twq function| fbq function| _fbq function| lintrk boolean| _already_called_lintrk function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| MunchkinTracker object| regeneratorRuntime object| twttr function| $Trd_Base64 function| $Trd_i18n function| __awaiter function| __generator function| $Trd_Utils function| $Trd_Tools function| $Trd_Logger function| RecordsService function| __extends function| $Trd_UserPageHistory_Cook object| enRenderModes object| $Trd_InternalEventsTypes object| $Trd_TriggersEventsTypes function| mapBackendTriggers function| $Trd_Context function| $Trd_EnvironmentSettings function| $Trd_ClientCookie function| $Trd_CtaClientCookie function| $Trd_ButtonSelector object| Frequency object| UnitVisibiltyType object| UnitTypeId string| LOCAL_STORAGE_ITEM_NAME function| $Trd_FormListener object| COOKIE_NAMES function| $Trd_Visitor function| $Trd_UrlGrabber function| $Trd_Events function| $Trd_Pageview function| $Trd_Newvisitor function| $Trd_Cookmanager string| $TRD_MA_COOKIE_NAME object| $TRD_MA_COOKIE_NAME_MAP function| $Trd_MarketingAutomation function| $TRD_CtaComponent function| $TRD_CtaContentComponent function| $TRD_GenericLayoutComponent function| $TRD_FormLayoutComponent function| $TRD_RecommendationLayoutComponent function| $TRD_GenericScriptComponent function| $TRD_FastTextLayoutComponent function| $TRD_SurveyLayoutComponent function| __assign function| __spreadArray number| COOLOFF_DAYS_AFTER_CLOSE number| COOLOFF_MS_AFTER_CLOSE function| $Trd_ExperienceManager function| $TRD_ClientAppFactory function| $TRD_ClientApp function| $TRD_ClientAppDrift function| $TRD_ClientAppSixSense object| trdContext undefined| src function| $Trd_Lift function| $Trd_Embedded function| $Trd_NApi object| TrendemonContext object| $trd_Context object| trd_api object| IdentityConfig function| $Trd_Identity

32 Cookies

Domain/Path Name / Value
.click.checkpoint.com/ Name: __cf_bm
Value: pJ5g8h14ffLGQEH6y0zCq1uSOJisqeGAI8TtPhjlcyQ-1663098631-0-AaFrq9PD4w2XDKYj2luoChV/pkiiD61i2CGbWcpUxxQJKX2ldmgyS2plqQ9OauyzmzQ12wxcOZjSNW/by4HBruo=
.checkpoint.com/ Name: _gid
Value: GA1.2.257196422.1663098632
.checkpoint.com/ Name: _dc_gtm_UA-194688-3
Value: 1
research.checkpoint.com/ Name: _an_uid
Value: 0
research.checkpoint.com/ Name: _gd_visitor
Value: a270e8d2-8019-44a6-8ecb-8189a9b9a186
research.checkpoint.com/ Name: _gd_session
Value: d09c0ad0-bf19-4c6a-8cec-3d81f18306b5
.6sc.co/ Name: 6suuid
Value: acf86668b93f000008df20635e02000072220000
.checkpoint.com/ Name: _ga_48VXKGDGCV
Value: GS1.1.1663098634.1.0.1663098634.0.0.0
.checkpoint.com/ Name: _ga
Value: GA1.1.1626863099.1663098632
.checkpoint.com/ Name: _fbp
Value: fb.1.1663098634874.543569096
.checkpoint.com/ Name: _mkto_trk
Value: id:750-DQH-528&token:_mch-checkpoint.com-1663098634925-37584
.linkedin.com/ Name: UserMatchHistory
Value: AQKXMis99GqHIgAAAYM4Z0L7LPt0_rvD2FSwsSu4jTbvO36pNaQq27Edw7aiGa95o97zQW9izoWhlQ
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQLuMAZeN9CzIgAAAYM4Z0L7QP_SBRJ0ioAZH8nrUgbqCKQTQ0LSaMiYYsLsvVoRs8104-8nVIl4EKxmADpqHA
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&666c891a-b709-4b78-8f04-48eab9944e52"
.linkedin.com/ Name: lidc
Value: "b=VGST04:s=V:r=V:a=V:p=V:g=2724:u=1:x=1:i=1663098635:t=1663185035:v=2:sig=AQFLT7SYGRPabTNiUbAQ8acUz_eIIKpg"
.t.co/ Name: muc_ads
Value: ba08b3af-4466-4ca4-af49-dfb13fdee144
.twitter.com/ Name: personalization_id
Value: "v1_UOZL45M/iTVOjoDF4T1T1A=="
.linkedin.com/ Name: lang
Value: v=2&lang=de-de
.www.linkedin.com/ Name: bscookie
Value: "v=1&20220913195035e3b4af27-8aab-4b63-8d5e-71645314e22eAQFRe9pWVLaaZn-dGidgSqJ7NpC_-pK5"
.linkedin.com/ Name: li_gc
Value: MTswOzE2NjMwOTg2MzU7MjswMjFbf8K+TtPg2k8Y1MD1PK8Bz47Dlq8j6S+m0S7ZDSdblw==
.checkpoint.com/ Name: trd_cid
Value: 16630986355227310
trackingapi.trendemon.com/ Name: trd_gavid_2336
Value: 16630986355227310
trackingapi.trendemon.com/ Name: trd_gvid
Value: 16630986355227310
trackingapi.trendemon.com/ Name: trd_vid_2336
Value: 2336%3A16630986355227310
.checkpoint.com/ Name: trd_vid_l
Value: 2336%3A16630986355227310
.checkpoint.com/ Name: trd_vuid_l
Value: 3442811253916321670
.checkpoint.com/ Name: trd_first_visit
Value: 1663098636
.checkpoint.com/ Name: trd_pw
Value: 1
.checkpoint.com/ Name: trd_pws
Value: 1
.checkpoint.com/ Name: trd_sid
Value: 16630986357592726
.checkpoint.com/ Name: trd_ma_cookie
Value: aWQ6NzUwLURRSC01MjgmdG9rZW46X21jaC1jaGVja3BvaW50LmNvbS0xNjYzMDk4NjM0OTI1LTM3NTg0

2 Console Messages

Source Level URL
Text
security error URL: https://click.checkpoint.com/NzUwLURRSC01MjgAAAGFK7lURAn05U1bX4Htvjnr5Sd73cW3ZKnVbKE3mmFDMHjgbWBiGEC2sgjlEx3t6-tNEecc1jI=
Message:
The Content-Security-Policy directive name 'form-action:'none'' contains one or more invalid characters. Only ASCII alphanumeric characters or dashes '-' are allowed in directive names.
security error URL: https://click.checkpoint.com/NzUwLURRSC01MjgAAAGFK7lURAn05U1bX4Htvjnr5Sd73cW3ZKnVbKE3mmFDMHjgbWBiGEC2sgjlEx3t6-tNEecc1jI=
Message:
The Content-Security-Policy directive name 'frame-src:'none'' contains one or more invalid characters. Only ASCII alphanumeric characters or dashes '-' are allowed in directive names.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; img-src 'self';script-src 'self' 'sha256-0e/zNAmbPoWp0kPb8jNL5sq+rqnqZXN5gKBtft2mfBQ=';object-src 'none';form-action:'none';frame-src:'none'
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

750-dqh-528.mktoresp.com
analytics.twitter.com
assets.trendemon.com
b.6sc.co
buttons-config.sharethis.com
c.6sc.co
cdn.onesignal.com
click.checkpoint.com
code.jquery.com
connect.facebook.net
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
img.onesignal.com
j.6sc.co
l.sharethis.com
munchkin.marketo.net
onesignal.com
platform-api.sharethis.com
platform-cdn.sharethis.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
research.checkpoint.com
sc1.checkpoint.com
secure.adnxs.com
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
trackingapi.trendemon.com
use.fontawesome.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
104.126.181.33
104.17.71.206
104.244.42.133
104.244.42.3
13.107.42.14
13.224.189.126
13.224.189.81
141.193.213.20
18.195.70.228
185.89.210.153
192.28.144.124
199.232.16.157
2001:4860:4802:32::36
2001:4de0:ac18::1:a:2b
23.205.237.4
23.46.214.56
2600:9000:20eb:2000:c:abe:f440:93a1
2600:9000:21f3:4400:1d:85c3:6640:93a1
2606:4700:3032::ac43:a9f7
2606:4700::6812:e134
2606:4700::6812:e234
2620:1ec:21::14
2a00:1450:4001:801::2003
2a00:1450:4001:80e::200e
2a00:1450:4001:813::200a
2a00:1450:4001:82b::2004
2a00:1450:4001:82b::2008
2a00:1450:4001:82f::2003
2a00:1450:400c:c06::9a
2a02:26f0:11a::6867:4868
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
35.168.228.181
52.57.249.23
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8
0fc686423c26cb1030032fd7e4f2dd664c4b08517a8990c0b46269dd4e01910b
0fe8bcbcd24ab838fbbd773001253fc0353956e81c5ba9c8e23951ebdbae305a
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1998582382fbf956231d65be84b76e08c0c86e5ced8a99c703bdec416d876d76
1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e
234b9bab83aa0c52e9e5192995427a2bc44876cf1a11545ed631f369b8dc6534
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
292300e164a4d590f6785ec87a49d8557a9ca0631d7aa22942aee96d90e93b91
2b02c99b94bd29097fd168548bea6dfc28c9ffd3c2d751c1f375c9da902d8f63
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255
3643b2c826a615065303aa44b8f463eb854d77934f5f25dc1f74f60d4698f9f0
408ddad0ef179adef886bffc95c5851680e2e1a3d9f04a03f5bb8d1efb73344c
41b758f84ab2dd5da6f7ba488813d17410ebb48bc2074d304c26d63c5ece003d
481a0574246e281316ffa0e15399bf5388bb81ae550ce0401a0353b6bb2d1e5a
507670a9c3b08c1e6a5ee1657bac6d0deb7862accb1ff090c2050b70104192c3
52ba319a654d4a8385ae25d40096bce97b5b69f356548433aedb9e6a0118289d
53407349057c67f649d8288413013dc71304220982f94dc79bc80372b9ffcef2
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57e48df5586242df165fa8424ae8cb9e360c8e81b6a711736bf1f395a2c02a2f
5ae95e748ad12444cd760e245c02264cea3e8deb41fabd95f1e0784b81f72783
5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57
5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009
6048e330c0f362be46b20de45d35a5ace57a04be04a29da10448d6949f6f69ce
67affcd8e2f46a4ab641f378e973888030cc93455e54b6a042cb0691056549d2
768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
772ac6f594c97fb68dd038b491f43890edd6cb741f71bd9a21a5e65ab1c4ee66
791d8c8cb135d3d53915096e999d3857b6ee16966c20a019f38699f09f6aa2ff
7c93346d4f681a0be90d1dfc19346382a4700f1810f41caa54415688dee1777f
7e0c4a1ed3d232553d98c82ea0e04cee8975d0a67df819e161f96e7c32179e8c
7f5bd223eafa1c6d1aff21c91c6bfb825f7f36830d97eef41c432681ed671f85
80b723122618b5dfe69a8430285a7798c58015a01ec210d3d4bff8eebc027216
8303d853bcefe186c32005fc9b0c2baa29670ddeb27afe563f957bccaa717d0a
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
837bf851229384ad9d7eb78b9d3cce910c8d6c799644f0a0cb1bf6aa27eb3930
843114448aaeeda7e8caa0cf76d61e0c63b8bffccd34517483363fdb15cdc80c
847eb36b4dc4b05f94052dcd98077319e74d882334a106bb9ca451ba211c9c2c
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
87a4d32b1d3411b7695538302d3e9ada4666aff61243f6e6bc968ee3b2d6db38
8fb232c566025b7f4c6f8836ccd98898e17afd104815d2383d63591f89b8f01a
91a50850c517899e1c975079158949f7a500ddf5a7307fe36bf50092926beedc
943a1b1e71227309f613db611de5c22d02c999de5798a601e5e4229fb62371e6
953d6908ab55929254e46c77e5c751a6e2df7ab84430f134edc3bb62d8f7d32f
9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99
a125cbc6c0b638507ead3c379e240e4677fc8f8837bb900b21ef6bc86a19e76d
a18555bfddb67377c542c8795cd09ec0cd94a5dca6d21236995001ca5954306f
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a22d6b8782097b7cd9588ab582e119bfd6290278275661e9d0f96b2baec0cb8e
a59bba774218f207179b30aa8bbd21bad0f7355a52321e08138bd77a308c27d5
a8da941d8a446516c824ebc9fb77b42e6b92c6deed1daed266bd821ed27bc516
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad5f554ef74d12bbdd7ed7ec6d9d2a9de60effe3c94c7049e4ae1453df7b22ac
ae3754c54a0880a98a94c423d3e67f39b5b6f3c63516dafa33866e3e74c9f97d
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242
b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1
b71f76186117ab510aca8eb8208815da837acdd4b29e171c9897993175c28878
b7cfb1c9430d90b22b3f4497543a4cfef719dc40a3cce130cad766171abe8bbe
bb3d017273ed487674d9766d8401cf458228596adcc0c3a6024f44ae715090db
c0f7ef8329ae6da56bd269492901fb024a05d7b67e977995a82b506af4b3b030
c66036f1288dcf003502e4f687e102a7ec6afe8bfa29daa9a5bb5ab62eb3567c
c6cf1b1801acf2d1e7767962782e3ea3d4aceefd6c2ffc08cdd8ba41aebce98a
c7987fa399af086aa19748e7504ca702d17233ab72abbb1a078880ac9c3a9cce
cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120
d12c6745eca14e06d4dea70f4c2bd875769b349770d04300477ab18d0db005d4
d4389721d4ab163ed6c8c6dbbc690c3a06fea18284d2fcf7b1d48890bab5eb1e
d43f8786c88edd43fcaf08b571d0ceccd70d2575e4f2339eebca9b4e6875fe40
d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51
dadbb59b37bfea4c78c6e15c8cbb96dfba84526e43a0767dc244fd062a841aba
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e269a38e915722f2f12862dec2402c2226110d0d3123e758513234a3163914de
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eee6d8fe37122ba1538560131fe5c95f9a4b6c45e2059076a7a92513fcb12f20
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef9e48bd5f604cd8d52ac00607fc60c2f4276a7e88c3f2bce907c7aaec90ed41
efc737b4f58cfe73a9bd0e57d7570365701381da31e628b269e7217a0ce3359d
f0b9d27e9a75a9beaf7ffc255c599973058dcdfb6cd1b10933e45f7c327e6324
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe2df9f6df4b4a8d7174d259f563b8d9e28e4c03f8f4092fd9db6044e0e64c32