URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Submission: On May 27 via api from US — Scanned from DE

Summary

This website contacted 34 IPs in 4 countries across 26 domains to perform 105 HTTP transactions. The main IP is 141.193.213.21, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is research.checkpoint.com. The Cisco Umbrella rank of the primary domain is 986222.
TLS certificate: Issued by R3 on April 29th 2022. Valid for: 3 months.
This is the only time research.checkpoint.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
19 141.193.213.21 209242 (CLOUDFLAR...)
1 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 2001:4de0:ac1... 20446 (STACKPATH...)
1 2a00:1450:400... 15169 (GOOGLE)
8 104.89.43.125 16625 (AKAMAI-AS)
1 13.32.99.51 16509 (AMAZON-02)
5 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:223... 16509 (AMAZON-02)
1 3.65.251.65 16509 (AMAZON-02)
10 96.16.137.162 16625 (AKAMAI-AS)
7 2a00:1450:400... 15169 (GOOGLE)
1 185.33.220.100 29990 (ASN-APPNEX)
1 2a02:26f0:170... 20940 (AKAMAI-ASN1)
2 52.57.195.65 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
10 2600:9000:236... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:f7:... 20940 (AKAMAI-ASN1)
1 199.232.188.157 54113 (FASTLY)
2 104.92.72.193 16625 (AKAMAI-AS)
5 104.92.90.132 16625 (AKAMAI-AS)
2 2a03:2880:f02... 32934 (FACEBOOK)
3 3 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 192.28.144.124 15224 (OMNITURE)
2 2a03:2880:f12... 32934 (FACEBOOK)
5 192.28.144.84 15224 (OMNITURE)
2 18.66.122.36 16509 (AMAZON-02)
6 54.157.244.245 14618 (AMAZON-AES)
1 104.244.42.195 13414 (TWITTER)
1 104.244.42.69 13414 (TWITTER)
105 34
Apex Domain
Subdomains
Transfer
27 checkpoint.com
research.checkpoint.com — Cisco Umbrella Rank: 986222
sc1.checkpoint.com — Cisco Umbrella Rank: 29591
630 KB
13 sharethis.com
platform-api.sharethis.com — Cisco Umbrella Rank: 4713
buttons-config.sharethis.com — Cisco Umbrella Rank: 5503
l.sharethis.com — Cisco Umbrella Rank: 4375
platform-cdn.sharethis.com — Cisco Umbrella Rank: 10513
54 KB
11 6sc.co
j.6sc.co — Cisco Umbrella Rank: 6764
c.6sc.co — Cisco Umbrella Rank: 10181
ipv6.6sc.co — Cisco Umbrella Rank: 7111
b.6sc.co — Cisco Umbrella Rank: 4771
17 KB
10 marketo.com
abrtp1-cdn.marketo.com — Cisco Umbrella Rank: 29685
rtp-static.marketo.com — Cisco Umbrella Rank: 14928
abrtp1.marketo.com — Cisco Umbrella Rank: 37857
124 KB
8 trendemon.com
assets.trendemon.com — Cisco Umbrella Rank: 73549
trackingapi.trendemon.com — Cisco Umbrella Rank: 26606
50 KB
7 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 35
20 KB
6 onesignal.com
cdn.onesignal.com — Cisco Umbrella Rank: 3029
onesignal.com — Cisco Umbrella Rank: 1276
img.onesignal.com — Cisco Umbrella Rank: 6685
86 KB
4 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 320
www.linkedin.com — Cisco Umbrella Rank: 560
px4.ads.linkedin.com — Cisco Umbrella Rank: 5318
3 KB
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 97
388 B
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 144
114 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 3204
6 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 10780
424 B
1 t.co
t.co — Cisco Umbrella Rank: 505
337 B
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 506
354 B
1 mktoresp.com
750-dqh-528.mktoresp.com — Cisco Umbrella Rank: 656849
311 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 608
14 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 760
3 KB
1 gstatic.com
fonts.gstatic.com
16 KB
1 google.de
www.google.de — Cisco Umbrella Rank: 6117
501 B
1 google.com
www.google.com — Cisco Umbrella Rank: 2
501 B
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 84
447 B
1 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 391
713 B
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 64
76 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 42
1 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 624
30 KB
1 fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 818
12 KB
105 26
Domain Requested by
19 research.checkpoint.com research.checkpoint.com
10 platform-cdn.sharethis.com research.checkpoint.com
8 b.6sc.co research.checkpoint.com
8 sc1.checkpoint.com research.checkpoint.com
7 www.google-analytics.com www.googletagmanager.com
research.checkpoint.com
6 trackingapi.trendemon.com assets.trendemon.com
5 abrtp1.marketo.com abrtp1-cdn.marketo.com
rtp-static.marketo.com
4 rtp-static.marketo.com abrtp1-cdn.marketo.com
3 onesignal.com cdn.onesignal.com
2 assets.trendemon.com research.checkpoint.com
assets.trendemon.com
2 www.facebook.com
2 px.ads.linkedin.com 2 redirects
2 connect.facebook.net research.checkpoint.com
connect.facebook.net
2 munchkin.marketo.net research.checkpoint.com
munchkin.marketo.net
2 epsilon.6sense.com j.6sc.co
2 cdn.onesignal.com research.checkpoint.com
cdn.onesignal.com
1 t.co
1 analytics.twitter.com
1 750-dqh-528.mktoresp.com munchkin.marketo.net
1 px4.ads.linkedin.com
1 www.linkedin.com 1 redirects
1 abrtp1-cdn.marketo.com research.checkpoint.com
1 static.ads-twitter.com www.googletagmanager.com
1 snap.licdn.com www.googletagmanager.com
1 fonts.gstatic.com fonts.googleapis.com
1 img.onesignal.com research.checkpoint.com
1 www.google.de research.checkpoint.com
1 www.google.com research.checkpoint.com
1 stats.g.doubleclick.net www.google-analytics.com
1 ipv6.6sc.co j.6sc.co
1 c.6sc.co j.6sc.co
1 secure.adnxs.com j.6sc.co
1 j.6sc.co research.checkpoint.com
1 l.sharethis.com platform-api.sharethis.com
1 buttons-config.sharethis.com platform-api.sharethis.com
1 www.googletagmanager.com research.checkpoint.com
1 platform-api.sharethis.com research.checkpoint.com
1 fonts.googleapis.com research.checkpoint.com
1 code.jquery.com research.checkpoint.com
1 use.fontawesome.com research.checkpoint.com
105 40
Subject Issuer Validity Valid
research.checkpoint.com
R3
2022-04-29 -
2022-07-28
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2021-07-07 -
2022-07-06
a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA
2021-07-14 -
2022-08-14
a year crt.sh
upload.video.google.com
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
*.checkpoint.com
GlobalSign GCC R3 DV TLS CA 2020
2021-12-07 -
2023-01-08
a year crt.sh
sharethis.com
Amazon
2021-07-19 -
2022-08-17
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
*.6sc.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-08 -
2023-03-11
a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2022-02-11 -
2023-03-14
a year crt.sh
*.6sense.com
Amazon
2021-06-30 -
2022-07-29
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
www.google.com
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
www.google.de
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2022-05-04 -
2022-07-27
3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2022-03-01 -
2023-03-01
a year crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1
2021-07-21 -
2022-07-26
a year crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA
2022-02-06 -
2023-02-07
a year crt.sh
*.marketo.com
DigiCert SHA2 Secure Server CA
2022-02-06 -
2023-02-07
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2022-03-06 -
2022-06-04
3 months crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2021-11-30 -
2022-11-30
a year crt.sh
*.trendemon.com
SSL.com RSA SSL subCA
2021-06-27 -
2022-07-28
a year crt.sh
*.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-07 -
2023-03-06
a year crt.sh
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-07 -
2023-03-06
a year crt.sh

This page contains 1 frames:

Primary Page: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Frame ID: 6140189BB1899D70E0D1E98842472B37
Requests: 104 HTTP requests in this frame

Screenshot

Page Title

Office 365 Phishing Campaign Exploits Samsung, Adobe and Oxford Servers - Check Point Research

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • <!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • /flickity(?:\.pkgd)?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • cdn\.onesignal\.com

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

105
Requests

99 %
HTTPS

51 %
IPv6

26
Domains

40
Subdomains

34
IPs

4
Countries

1257 kB
Transfer

3255 kB
Size

34
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 71
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1653671437906&url=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D51830%26time%3D1653671437906%26url%3Dhttps%253A%252F%252Fresearch.checkpoint.com%252F2020%252Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%252F%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1653671437906&url=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1653671437906&url=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&liSync=true&e_ipv6=AQIyFvfkhSEarQAAAYEGf6eXhtceozlJ3-cnIgCFFS9CXrYoEn7T46TJuq5h81-CiYMvGeq6

105 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
53 KB
15 KB
Document
General
Full URL
https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / WP Engine
Resource Hash
d8d530ea777d879cc75225758beb68c3cfd749d377f5bd99dd95b813c759c687
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
max-age=600, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
71205d6c5de290d4-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 27 May 2022 17:10:36 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
link
<https://research.checkpoint.com/?p=23817>; rel=shortlink
server
cloudflare
vary
Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache
HIT: 2
x-cache-group
normal
x-cacheable
SHORT
x-frame-options
SAMEORIGIN
x-powered-by
WP Engine
x-xss-protection
1; mode=block
style.min.css
research.checkpoint.com/wp-includes/css/dist/block-library/
81 KB
11 KB
Stylesheet
General
Full URL
https://research.checkpoint.com/wp-includes/css/dist/block-library/style.min.css?ver=5.9.3
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cdbdaa122823601390c7dcbdd1afde33c2f1a432b8c5ff025c6137ee99ba541a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 02 May 2022 20:52:24 GMT
server
cloudflare
age
2139457
etag
W/"62704488-145db"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
71205d6f9c8090d4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
style.css
research.checkpoint.com/wp-content/themes/research/
18 KB
4 KB
Stylesheet
General
Full URL
https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.31
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
545a29e66fc91b142e516a21647233caa8e55fe2d3cd86b84475ce2f6ace21c7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 11 Mar 2022 16:42:02 GMT
server
cloudflare
age
6652492
etag
W/"622b7bda-496b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
71205d6f9c8290d4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
bootstrap.min.css
research.checkpoint.com/wp-content/themes/research/css/
137 KB
22 KB
Stylesheet
General
Full URL
https://research.checkpoint.com/wp-content/themes/research/css/bootstrap.min.css?ver=4.1
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:49 GMT
server
cloudflare
age
3751602
etag
W/"5dc49a65-22485"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
71205d6f9c8c90d4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
flickity.min.css
research.checkpoint.com/wp-content/themes/research/css/
2 KB
677 B
Stylesheet
General
Full URL
https://research.checkpoint.com/wp-content/themes/research/css/flickity.min.css?ver=1.1
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a8da941d8a446516c824ebc9fb77b42e6b92c6deed1daed266bd821ed27bc516

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
10572454
etag
W/"5dc49a64-71d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
71205d6f9c8e90d4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
all.css
use.fontawesome.com/releases/v5.6.3/css/
52 KB
12 KB
Stylesheet
General
Full URL
https://use.fontawesome.com/releases/v5.6.3/css/all.css?ver=5.6.3
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
481a0574246e281316ffa0e15399bf5388bb81ae550ce0401a0353b6bb2d1e5a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:36 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
10669822
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
7VRQ2SYH98AK9TBW
x-amz-id-2
5Vi3+fZiQDBVqyOT/I9cAxSQKo72tRky7vEq1i/YaKr4RcpeOZZLn5QZG/SaRZJ7Huk36IDzsm0=
last-modified
Wed, 30 Jun 2021 15:44:33 GMT
server
cloudflare
etag
W/"dc93d584e41f8417f6b7163320d34329"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gdwg%2FY1u0iCaeuafM0nNWQ8Zz4aEk8vq9tF7bznlfFpHzd0OUqZj24zhnfWA71y23V4vuxm6INe6cXIhg%2BaLxJ4MPw%2BlY6FEMSpOLpHie25kl4BENyKhoaZQls0Qz%2Bhf9OvhHdC23Cb8DnmZ5lEiAsKG"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=31556926
cf-ray
71205d6fbed45c85-FRA
enlighterjs.min.css
research.checkpoint.com/wp-content/plugins/enlighter/cache/
78 KB
9 KB
Stylesheet
General
Full URL
https://research.checkpoint.com/wp-content/plugins/enlighter/cache/enlighterjs.min.css?ver=TJ0/7+iAWMKbDKS
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6048e330c0f362be46b20de45d35a5ace57a04be04a29da10448d6949f6f69ce

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 15 Feb 2021 20:35:46 GMT
server
cloudflare
age
7603793
etag
W/"602adb22-13686"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
71205d6f9c9090d4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
jquery-3.4.0.min.js
code.jquery.com/
86 KB
30 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.4.0.min.js?ver=5.9.3
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:36 GMT
content-encoding
gzip
last-modified
Fri, 20 Aug 2021 17:47:53 GMT
server
nginx
etag
W/"611feac9-15857"
vary
Accept-Encoding
x-hw
1653671436.dop008.am5.t,1653671436.cds273.am5.hn,1653671436.cds150.am5.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30632
bootstrap.bundle.min.js
research.checkpoint.com/wp-content/themes/research/js/lib/
66 KB
19 KB
Script
General
Full URL
https://research.checkpoint.com/wp-content/themes/research/js/lib/bootstrap.bundle.min.js?ver=4.1
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bb3d017273ed487674d9766d8401cf458228596adcc0c3a6024f44ae715090db

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
7612436
etag
W/"5dc49a64-1089e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
71205d6f9c9190d4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
flickity.pkgd.min.js
research.checkpoint.com/wp-content/themes/research/js/lib/
54 KB
14 KB
Script
General
Full URL
https://research.checkpoint.com/wp-content/themes/research/js/lib/flickity.pkgd.min.js?ver=1.0.1
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe2df9f6df4b4a8d7174d259f563b8d9e28e4c03f8f4092fd9db6044e0e64c32

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
57299
etag
W/"5dc49a64-d7c9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
71205d6f9c9390d4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
single-post.js
research.checkpoint.com/wp-content/themes/research/js/
422 B
300 B
Script
General
Full URL
https://research.checkpoint.com/wp-content/themes/research/js/single-post.js?ver=1.0.4
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f5bd223eafa1c6d1aff21c91c6bfb825f7f36830d97eef41c432681ed671f85

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 14 Jan 2020 00:00:05 GMT
server
cloudflare
age
6444546
etag
W/"5e1d0485-1a6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
71205d6f9c9590d4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
inc-header.js
research.checkpoint.com/wp-content/themes/research/header/
1 KB
541 B
Script
General
Full URL
https://research.checkpoint.com/wp-content/themes/research/header/inc-header.js?v=1.1
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ae3754c54a0880a98a94c423d3e67f39b5b6f3c63516dafa33866e3e74c9f97d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
7612436
etag
W/"5dc49a64-47a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
71205d6f9c9690d4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
style.css
research.checkpoint.com/wp-content/themes/research/header/
9 KB
2 KB
Stylesheet
General
Full URL
https://research.checkpoint.com/wp-content/themes/research/header/style.css
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0fe8bcbcd24ab838fbbd773001253fc0353956e81c5ba9c8e23951ebdbae305a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
68319
etag
W/"5dc49a64-25cb"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
71205d6f9c9290d4-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
css
fonts.googleapis.com/
2 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e80a28e260de3fa02ff629d2ae4a84c50a5e159f40807ca8c61b108cb2899880
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 27 May 2022 15:37:07 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Fri, 27 May 2022 17:10:36 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 27 May 2022 17:10:36 GMT
facebook.gif
sc1.checkpoint.com/sc1/inc/html/images/social/
1 KB
2 KB
Image
General
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/facebook.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.89.43.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-89-43-125.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
791d8c8cb135d3d53915096e999d3857b6ee16966c20a019f38699f09f6aa2ff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:37 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"7eb7015574801089503dd7095e1d4313:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1254
google-plus.gif
sc1.checkpoint.com/sc1/inc/html/images/social/
2 KB
2 KB
Image
General
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/google-plus.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.89.43.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-89-43-125.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
1998582382fbf956231d65be84b76e08c0c86e5ced8a99c703bdec416d876d76

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:37 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"eedd0b2cde10b6b1930d57a10c6d0422:1612322629.149034"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1653
linkedin.gif
sc1.checkpoint.com/sc1/inc/html/images/social/
1 KB
2 KB
Image
General
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/linkedin.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.89.43.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-89-43-125.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a22d6b8782097b7cd9588ab582e119bfd6290278275661e9d0f96b2baec0cb8e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:37 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"6789b034de6591b26bbd9b5fa6b451ca:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1416
email.gif
sc1.checkpoint.com/sc1/inc/html/images/social/
1 KB
2 KB
Image
General
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/email.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.89.43.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-89-43-125.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
3643b2c826a615065303aa44b8f463eb854d77934f5f25dc1f74f60d4698f9f0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:37 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"15f1e1004accdbc019365e658249f334:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1407
rss.gif
sc1.checkpoint.com/sc1/inc/html/images/social/
2 KB
2 KB
Image
General
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/rss.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.89.43.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-89-43-125.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
b7cfb1c9430d90b22b3f4497543a4cfef719dc40a3cce130cad766171abe8bbe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:37 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"8cc18e3677ea53cc679e33e82bf9497a:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1620
twitter.gif
sc1.checkpoint.com/sc1/inc/html/images/social/
2 KB
2 KB
Image
General
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/twitter.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.89.43.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-89-43-125.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a59bba774218f207179b30aa8bbd21bad0f7355a52321e08138bd77a308c27d5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:37 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"6b05f4fc9522afa0cdbeb1a2c0bccc2c:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1608
check-point-research-logo.gif
sc1.checkpoint.com/sc1/inc/html/images/
3 KB
3 KB
Image
General
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/check-point-research-logo.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.89.43.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-89-43-125.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:37 GMT
Last-Modified
Mon, 09 Jul 2018 21:15:16 GMT
Server
AkamaiNetStorage
ETag
"c425f4400a5c9dfbaecb24275f494931:1531172224"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
2901
under-attack.gif
research.checkpoint.com/wp-content/themes/research/img/lib/
458 B
793 B
Image
General
Full URL
https://research.checkpoint.com/wp-content/themes/research/img/lib/under-attack.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c0f7ef8329ae6da56bd269492901fb024a05d7b67e977995a82b506af4b3b030

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:36 GMT
cf-cache-status
HIT
age
762928
cf-polished
origFmt=gif, origSize=1666
content-disposition
inline; filename="under-attack.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
458
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
etag
"5dc49a64-682"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
71205d702a296943-FRA
cf-bgj
imgq:100,h2pri
ado-1.png
research.checkpoint.com/wp-content/uploads/2020/06/
38 KB
38 KB
Image
General
Full URL
https://research.checkpoint.com/wp-content/uploads/2020/06/ado-1.png
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bdfd287424a979819871e38d09821982228fb6ac12e51d1a29d81d0ff5e6a0ae

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:37 GMT
cf-cache-status
MISS
last-modified
Wed, 17 Jun 2020 10:41:18 GMT
server
cloudflare
etag
"5ee9f34e-96b1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
71205d702a2b6943-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
38577
email-decode.min.js
research.checkpoint.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
937 B
Script
General
Full URL
https://research.checkpoint.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 25 May 2022 09:50:37 GMT
server
cloudflare
etag
W/"628dfbed-4d7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
DENY
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
71205d7009fa6943-FRA
vary
Accept-Encoding
expires
Sun, 29 May 2022 17:10:36 GMT
sharethis.js
platform-api.sharethis.com/js/
187 KB
42 KB
Script
General
Full URL
https://platform-api.sharethis.com/js/sharethis.js
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-51.fra60.r.cloudfront.net
Software
/
Resource Hash
aeef17cb37c9f11b40b147b04e3f16ee3a2fdaa90bae2d503a7e3e99399ea682
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:05:18 GMT
content-encoding
gzip
vary
Accept-Encoding
age
318
etag
W/"2ed4f-4+kfuOk8lynXIin2Z82IybFv7jo"
x-frame-options
SAMEORIGIN
x-cache
Hit from cloudfront
content-type
text/javascript; charset=utf-8
via
1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront)
edge-control
cache-maxage=60m,downstream-ttl=60m
cache-control
max-age=600, public
x-amz-cf-pop
FRA60-P3
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-id
kcm55ZdA-TBdnAuUcTZUQmxm5mAcuhEUh5Q_yFtnTcZjr2S3d7AlBQ==
CfP_1021x580_A.jpg
research.checkpoint.com/wp-content/uploads/2018/11/
128 KB
128 KB
Image
General
Full URL
https://research.checkpoint.com/wp-content/uploads/2018/11/CfP_1021x580_A.jpg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
408ddad0ef179adef886bffc95c5851680e2e1a3d9f04a03f5bb8d1efb73344c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:36 GMT
cf-cache-status
HIT
age
7931873
cf-polished
origSize=134980, status=webp_bigger
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
130561
last-modified
Thu, 07 Nov 2019 22:27:41 GMT
server
cloudflare
etag
"5dc49a5d-20f44"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
71205d702a2d6943-FRA
cf-bgj
imgq:100,h2pri
enlighterjs.min.js
research.checkpoint.com/wp-content/plugins/enlighter/cache/
57 KB
17 KB
Script
General
Full URL
https://research.checkpoint.com/wp-content/plugins/enlighter/cache/enlighterjs.min.js?ver=TJ0/7+iAWMKbDKS
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7e0c4a1ed3d232553d98c82ea0e04cee8975d0a67df819e161f96e7c32179e8c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:36 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 15 Feb 2021 20:35:46 GMT
server
cloudflare
age
12277336
etag
W/"602adb22-e33f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
71205d702a276943-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
OneSignalSDK.js
cdn.onesignal.com/sdks/
9 KB
3 KB
Script
General
Full URL
https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=5.9.3
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5df9eee36a61ef8f89d39c04ff402ded30aa9c627b6ef2134f55fa0e8b537153

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

cf-ray
71205d706b575bf5-FRA
date
Fri, 27 May 2022 17:10:36 GMT
via
1.1 google
cf-cache-status
HIT
server
cloudflare
age
946
etag
W/"a393ad4e03deeab316f7121a80708ce6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=259200
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Mon, 30 May 2022 17:10:36 GMT
gtm.js
www.googletagmanager.com/
261 KB
76 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
145d7e6982ea14023e72f2ca858f86ca8bcb33c8680c87296c610bec43ffc52c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:36 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
77666
x-xss-protection
0
last-modified
Fri, 27 May 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 27 May 2022 17:10:36 GMT
5a3031770f16c70012a3c297.js
buttons-config.sharethis.com/js/
525 B
922 B
Script
General
Full URL
https://buttons-config.sharethis.com/js/5a3031770f16c70012a3c297.js
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223c:d600:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
eee6d8fe37122ba1538560131fe5c95f9a4b6c45e2059076a7a92513fcb12f20
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:38 GMT
via
1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
last-modified
Tue, 12 Dec 2017 19:43:54 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P2
etag
"29c30155cdf2eaa96943948b94d537b6"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
RefreshHit from cloudfront
content-type
text/javascript
cache-control
max-age=60,public
accept-ranges
bytes
content-length
525
x-amz-cf-id
scXUJY8KAAV-8CjG9Ompd3nH9rovPoRMHzObYlKj5bO16e4BMKIAxQ==
pview
l.sharethis.com/
0
410 B
XHR
General
Full URL
https://l.sharethis.com/pview?event=pview&hostname=research.checkpoint.com&location=%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&product=sticky-share-buttons&url=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&source=sharethis.js&fcmp=false&fcmpv2=false&has_segmentio=false&title=Office%20365%20Phishing%20Campaign%20Exploits%20Samsung%2C%20Adobe%20and%20Oxford%20Servers%20-%20Check%20Point%20Research&cms=unknown&publisher=5a3031770f16c70012a3c297&sop=true&version=st_sop.js&lang=en&description=Introduction%20Over%20the%20last%20few%20years%2C%20the%20adoption%20of%20Office%20365%20in%20the%20corporate%20sector%20has%20significantly%20increased.%20Its%20popularity%20has%20attracted%20the%20attention%20of%20cybercriminals%20who%20launch%20phishing%20campaigns%20specifically%20to%20attack%20the%20platform.%20As%2090%25%20of%20cyber-attacks%20start%20with%20a%20phishing%20campaign%2C%20Office%20365%20is%20an%20attractive%20target%20for%20threat%20actors%20who%20work...%20Click%20to%20Read%20More
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.65.251.65 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-65-251-65.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:36 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains;
Access-Control-Allow-Origin
https://research.checkpoint.com
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Access-Control-Max-Age
1728000
Connection
keep-alive
Access-Control-Allow-Headers
*
search-icon.gif
sc1.checkpoint.com/sc1/inc/html/images/
2 KB
2 KB
Image
General
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/search-icon.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/wp-content/themes/research/header/style.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.89.43.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-89-43-125.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
953d6908ab55929254e46c77e5c751a6e2df7ab84430f134edc3bb62d8f7d32f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:37 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"2e1aa25e7e77e6a393fd38efb413370f:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1755
34CA47_6_0.woff2
research.checkpoint.com/wp-content/themes/research/fonts/
58 KB
58 KB
Font
General
Full URL
https://research.checkpoint.com/wp-content/themes/research/fonts/34CA47_6_0.woff2
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.31
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0fc686423c26cb1030032fd7e4f2dd664c4b08517a8990c0b46269dd4e01910b

Request headers

Referer
https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.31
Origin
https://research.checkpoint.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:36 GMT
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
8537563
etag
"5dc49a64-e890"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
71205d708ad96943-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
59536
PhishingServers_blog_header.jpg
research.checkpoint.com/wp-content/uploads/2020/06/
211 KB
212 KB
Image
General
Full URL
https://research.checkpoint.com/wp-content/uploads/2020/06/PhishingServers_blog_header.jpg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a810a8a528f44a2294b25e1e790a0c98905431fed395b01e8c3fd452c75f15f3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:37 GMT
cf-cache-status
MISS
last-modified
Thu, 18 Jun 2020 07:15:47 GMT
server
cloudflare
etag
"5eeb14a3-34cea"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
71205d70eb556943-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
216298
ado-2.png
research.checkpoint.com/wp-content/uploads/2020/06/
60 KB
60 KB
Image
General
Full URL
https://research.checkpoint.com/wp-content/uploads/2020/06/ado-2.png
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
53d4eef6e46ad628907d6f667663d3792e11805a1c8aa5a103ff76e9f35e9f33

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:37 GMT
cf-cache-status
MISS
last-modified
Wed, 17 Jun 2020 10:42:26 GMT
server
cloudflare
etag
"5ee9f392-ee0f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
71205d70eb596943-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
60943
OneSignalPageSDKES6.js
cdn.onesignal.com/sdks/
283 KB
68 KB
Script
General
Full URL
https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151513
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=5.9.3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7512bf3b9ec62642bc0800d0ca3c5b8b37a1384814cc7a29d31f6823740fd403

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

cf-ray
71205d71bd7b91ff-FRA
date
Fri, 27 May 2022 17:10:37 GMT
via
1.1 google
cf-cache-status
HIT
server
cloudflare
age
3593
etag
W/"0e269028feac530d16f00d8dad8ece74"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=259200
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Mon, 30 May 2022 17:10:37 GMT
6si.min.js
j.6sc.co/
31 KB
10 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
8e038b564510a45dc11799f74da367733f3db7f9c0a0434f1e90c44ec5168278
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:37 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
9715
Pragma
no-cache
Last-Modified
Thu, 05 May 2022 03:45:17 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"6273484d-7b02"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
application/javascript
Access-Control-Allow-Origin
Cache-Control
private, no-cache, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Fri, 27 May 2022 17:10:37 GMT
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Apr 2022 21:02:38 GMT
server
Golfe2
age
3089
date
Fri, 27 May 2022 16:19:08 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Fri, 27 May 2022 18:19:08 GMT
getuidj
secure.adnxs.com/
11 B
713 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 27 May 2022 17:10:37 GMT
X-Proxy-Origin
185.213.155.169; 185.213.155.169; 399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
7717dcf0-e677-4e50-ad93-0a2883b8dbf7
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://research.checkpoint.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/
47 B
379 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
260958a69477ef6739a08e7c178eb491831f6be05451637c804a2c89314a125a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:37 GMT
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
text/plain
Access-Control-Allow-Origin
https://research.checkpoint.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
47
/
ipv6.6sc.co/
20 B
260 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:1700:18c::1c91 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
ab387a27fa712c46def740a80752bbc8f22e48f2fe710eb13311b38ef1807e97

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 May 2022 17:10:37 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://research.checkpoint.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a03:1b20:6:f011::9e
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
20
expires
Fri, 27 May 2022 17:10:37 GMT
details
epsilon.6sense.com/v3/company/
431 B
424 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.195.65 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-57-195-65.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
43b21a37ead752a35feeeb473aecb119bc2b63800594adc825bcb903b81f23da

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Referer
https://research.checkpoint.com/
accept-language
de-DE,de;q=0.9
Authorization
Token 87c67a7c5a9e9b4dd1824f6727ed4e43fadadde4
EpsilonCookie
cfd5ce17e94900000d06916249000000f1e15d00

Response headers

date
Fri, 27 May 2022 17:10:37 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://research.checkpoint.com
access-control-allow-credentials
true
content-length
234
details
epsilon.6sense.com/v3/company/
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.195.65 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-57-195-65.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,epsiloncookie
Access-Control-Request-Method
GET
Origin
https://research.checkpoint.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization,epsiloncookie
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://research.checkpoint.com
access-control-max-age
1800
date
Fri, 27 May 2022 17:10:37 GMT
server
nginx
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=cfd5ce17e94900000d06916249000000f1e15d00&session=c2336b45-09bc-4ae2-82f5-2b859ef136af&event=ipv6&q=%7B%22address%22%3A%222a03%3A1b20%3A6%3Af011%3A%3A9e%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Office%20365%20Phishing%20Campaign%20Exploits%20Samsung%2C%20Adobe%20and%20Oxford%20Servers%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&pageViewId=c5b47eec-a44b-4cec-8b61-2b60f81195cd
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:37 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
web
onesignal.com/api/v1/sync/3ba17c77-81bb-4a83-8917-7b62de3d6e22/
3 KB
2 KB
Script
General
Full URL
https://onesignal.com/api/v1/sync/3ba17c77-81bb-4a83-8917-7b62de3d6e22/web?callback=__jp0
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151513
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
434ecabcb0f7535df19a2774b9e1262b1ebfc9c8a738c93e16077cf5878a615a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:37 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
EXPIRED
x-permitted-cross-domain-policies
none
status
200 OK
x-envoy-upstream-service-time
62
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
x-request-id
bf7b1aeb-7f9f-4e18-92f0-0c0a365295ed
x-runtime
0.060530
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"434ecabcb0f7535df19a2774b9e1262b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-download-options
noopen
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=3600
cf-ray
71205d721ea65bf5-FRA
access-control-allow-headers
SDK-Version
expires
Fri, 27 May 2022 18:10:37 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=cfd5ce17e94900000d06916249000000f1e15d00&session=c2336b45-09bc-4ae2-82f5-2b859ef136af&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Fri%2C%2027%20May%202022%2017%3A10%3A37%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Office%20365%20Phishing%20Campaign%20Exploits%20Samsung%2C%20Adobe%20and%20Oxford%20Servers%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&pageViewId=c5b47eec-a44b-4cec-8b61-2b60f81195cd&an_uid=0
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:37 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
447 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-194688-3&cid=252029888.1653671437&jid=689181688&gjid=1284392423&_gid=1137315816.1653671437&_u=YGBAgEABAAAAAE~&z=996842173
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c07::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://research.checkpoint.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Fri, 27 May 2022 17:10:37 GMT
content-type
text/plain
access-control-allow-origin
https://research.checkpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=377182901&t=pageview&_s=1&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&ul=en-us&de=UTF-8&dt=Office%20365%20Phishing%20Campaign%20Exploits%20Samsung%2C%20Adobe%20and%20Oxford%20Servers%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgEAB~&jid=689181688&gjid=1284392423&cid=252029888.1653671437&tid=UA-194688-3&_gid=1137315816.1653671437&gtm=2wg5p15JCRGP&z=1023782629
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 May 2022 15:29:35 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
6062
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=377182901&t=event&ni=1&_s=1&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&ul=en-us&de=UTF-8&dt=Office%20365%20Phishing%20Campaign%20Exploits%20Samsung%2C%20Adobe%20and%20Oxford%20Servers%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=YGDAgEABAAAAAE~&jid=&gjid=&cid=252029888.1653671437&tid=UA-194688-3&_gid=1137315816.1653671437&gtm=2wg5p15JCRGP&cd9=&cd10=&cd11=&cd12=&cd13=&cd14=&cd16=&cd17=Sweden&z=515576823
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 May 2022 15:29:35 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
6062
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
501 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-194688-3&cid=252029888.1653671437&jid=689181688&_u=YGBAgEABAAAAAE~&z=1805742904
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 May 2022 17:10:37 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
501 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-194688-3&cid=252029888.1653671437&jid=689181688&_u=YGBAgEABAAAAAE~&z=1805742904
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 May 2022 17:10:37 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
OneSignalSDKStyles.css
onesignal.com/sdks/
82 KB
9 KB
Stylesheet
General
Full URL
https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151513
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

cf-ray
71205d72efa691ff-FRA
date
Fri, 27 May 2022 17:10:37 GMT
via
1.1 google
cf-cache-status
HIT
server
cloudflare
age
721
etag
W/"4e9aaefffd5f8ae7dc83361aa2294190"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=2592000
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Sun, 26 Jun 2022 17:10:37 GMT
icon
onesignal.com/api/v1/apps/3ba17c77-81bb-4a83-8917-7b62de3d6e22/
176 B
631 B
Fetch
General
Full URL
https://onesignal.com/api/v1/apps/3ba17c77-81bb-4a83-8917-7b62de3d6e22/icon
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151513
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57e48df5586242df165fa8424ae8cb9e360c8e81b6a711736bf1f395a2c02a2f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:37 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
MISS
x-permitted-cross-domain-policies
none
status
200 OK
x-envoy-upstream-service-time
12
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
x-request-id
30ddbb2e-8f78-40f5-816e-29838768a380
x-runtime
0.010510
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"57e48df5586242df165fa8424ae8cb9e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-download-options
noopen
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=0, private, must-revalidate
cf-ray
71205d73cc778fd6-FRA
access-control-allow-headers
SDK-Version
twitter.svg
platform-cdn.sharethis.com/img/
731 B
1 KB
Image
General
Full URL
https://platform-cdn.sharethis.com/img/twitter.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:236e:c200:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7c93346d4f681a0be90d1dfc19346382a4700f1810f41caa54415688dee1777f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Mon, 09 May 2022 05:12:46 GMT
via
1.1 d7433132a7c6595c9aab2dc2272e7060.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
age
1598272
etag
"0af2fb38987598376c99e21af17ade45"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA60-P1
accept-ranges
bytes
content-length
731
x-amz-cf-id
fqvssWdeKsiuotRQ0-YyUYvoeGLJ_uYHFAbUuKYkODWtEqsJlUlkYA==
whatsapp.svg
platform-cdn.sharethis.com/img/
832 B
1 KB
Image
General
Full URL
https://platform-cdn.sharethis.com/img/whatsapp.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:236e:c200:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
847eb36b4dc4b05f94052dcd98077319e74d882334a106bb9ca451ba211c9c2c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Thu, 26 May 2022 05:55:32 GMT
via
1.1 d7433132a7c6595c9aab2dc2272e7060.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
age
2062849
etag
"afe7fc60ed757db39a88d2950fce69c9"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA60-P1
accept-ranges
bytes
content-length
832
x-amz-cf-id
O12ImFBMvj-dOOaLfpkur9Ae7BEyYYLXDqCM5quP27M1aRTKHUoSew==
facebook.svg
platform-cdn.sharethis.com/img/
301 B
726 B
Image
General
Full URL
https://platform-cdn.sharethis.com/img/facebook.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:236e:c200:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Mon, 16 May 2022 03:32:12 GMT
via
1.1 d7433132a7c6595c9aab2dc2272e7060.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
age
999506
etag
"c6e9be45643e197ce1db1d7e24a99adc"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA60-P1
accept-ranges
bytes
content-length
301
x-amz-cf-id
zmm7JnWmWRNBqCSZXNdNadMHIGXZd5WX8DOIB_D8xhHqV1i1uSFIvg==
linkedin.svg
platform-cdn.sharethis.com/img/
456 B
880 B
Image
General
Full URL
https://platform-cdn.sharethis.com/img/linkedin.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:236e:c200:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Wed, 04 May 2022 07:51:49 GMT
via
1.1 d7433132a7c6595c9aab2dc2272e7060.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
age
2020729
etag
"fa43b4ede18498b114fc7185993f6da7"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA60-P1
accept-ranges
bytes
content-length
456
x-amz-cf-id
F8HBzeRBy84TkV7KBHd52VdC3NIm0KxO_kkNIxCU2_so-v3977itcQ==
email.svg
platform-cdn.sharethis.com/img/
343 B
768 B
Image
General
Full URL
https://platform-cdn.sharethis.com/img/email.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:236e:c200:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Wed, 04 May 2022 01:31:04 GMT
via
1.1 d7433132a7c6595c9aab2dc2272e7060.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
age
2043573
etag
"5977437466e857c7ddcadda6f6d88c2a"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA60-P1
accept-ranges
bytes
content-length
343
x-amz-cf-id
RhH5D6nY3pJ2BKqS25J3nCx95GyLQHKW67C0ByCzFQa-Qxcjd3mbNg==
pinterest.svg
platform-cdn.sharethis.com/img/
771 B
1 KB
Image
General
Full URL
https://platform-cdn.sharethis.com/img/pinterest.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:236e:c200:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
efc737b4f58cfe73a9bd0e57d7570365701381da31e628b269e7217a0ce3359d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Wed, 18 May 2022 06:12:33 GMT
via
1.1 d7433132a7c6595c9aab2dc2272e7060.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
age
817085
etag
"2b10a062e719c64b686e2e8fcdc216dc"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA60-P1
accept-ranges
bytes
content-length
771
x-amz-cf-id
aexHS9yTX1KcAjwQSXv4BD0ZkBHtbl9E8eLrdweewhr-Ug_yzDOw_g==
sharethis.svg
platform-cdn.sharethis.com/img/
514 B
937 B
Image
General
Full URL
https://platform-cdn.sharethis.com/img/sharethis.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:236e:c200:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Fri, 29 Apr 2022 01:59:15 GMT
via
1.1 d7433132a7c6595c9aab2dc2272e7060.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
age
2473882
etag
"deecdaa377907db5cc1722fc831670a1"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA60-P1
accept-ranges
bytes
content-length
514
x-amz-cf-id
EjWuxMB4gQEOymQkhfzFatBlmS_Fe029ihApZUHB89njjKFcbnWX6g==
reddit.svg
platform-cdn.sharethis.com/img/
910 B
1 KB
Image
General
Full URL
https://platform-cdn.sharethis.com/img/reddit.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:236e:c200:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
dadbb59b37bfea4c78c6e15c8cbb96dfba84526e43a0767dc244fd062a841aba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Fri, 13 May 2022 03:40:13 GMT
via
1.1 d7433132a7c6595c9aab2dc2272e7060.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
age
1258225
etag
"78d796ca648d8a5e665b48ed0217c56a"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA60-P1
accept-ranges
bytes
content-length
910
x-amz-cf-id
q3R8LC9BQEvf7I379p3iJaVBGrR3iuQsCmrbpCOvNdHOoYjPJCvQKA==
arrow_left.svg
platform-cdn.sharethis.com/img/
565 B
990 B
Image
General
Full URL
https://platform-cdn.sharethis.com/img/arrow_left.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:236e:c200:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Sun, 15 May 2022 03:12:55 GMT
via
1.1 d7433132a7c6595c9aab2dc2272e7060.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
age
1087063
etag
"b55d8d2b9321e381a3c38a4bddb74037"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA60-P1
accept-ranges
bytes
content-length
565
x-amz-cf-id
84ml58iQg6MyfnKxDey5NAEz-IX2IUSlSUz4eCWjZZKkRkPWr0fdew==
arrow_right.svg
platform-cdn.sharethis.com/img/
565 B
987 B
Image
General
Full URL
https://platform-cdn.sharethis.com/img/arrow_right.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:236e:c200:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Tue, 17 May 2022 04:06:55 GMT
via
1.1 d7433132a7c6595c9aab2dc2272e7060.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
age
911023
etag
"9928d025bd5792b718ee0a185f62e67c"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA60-P1
accept-ranges
bytes
content-length
565
x-amz-cf-id
8rzAwvMkl3Neunyr6xkahS-_l5qvLT5TRStPvffkry0cvzFf3buA6g==
7ec0ceb7-c110-40e8-9782-73562b05b110.gif
img.onesignal.com/t/
3 KB
3 KB
Image
General
Full URL
https://img.onesignal.com/t/7ec0ceb7-c110-40e8-9782-73562b05b110.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:37 GMT
cf-cache-status
REVALIDATED
x-amz-request-id
V4GNWA1BSQ2GA8EE
x-amz-meta-cache-control
public, maxage=604800
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2901
x-amz-id-2
SELcrxpfHqsVNnoAYNFg5qbAlWe7wD9V3njcc2mS+f63LeontO1+/9cLTLKvREnEfXgnBZj/bHQ=
last-modified
Mon, 26 Aug 2019 20:17:26 GMT
server
cloudflare
etag
"c425f4400a5c9dfbaecb24275f494931"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
cache-control
public, max-age=2678400
accept-ranges
bytes
cf-ray
71205d742a995bf5-FRA
expires
Mon, 27 Jun 2022 17:10:37 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://research.checkpoint.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Mon, 23 May 2022 11:07:47 GMT
x-content-type-options
nosniff
age
367370
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 23 May 2023 11:07:47 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/
8 KB
3 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:f7::5c7b:e024 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

X-EdgeConnect-Origin-MEX-Latency
662
Date
Fri, 27 May 2022 17:10:37 GMT
Content-Encoding
gzip
Last-Modified
Wed, 13 Apr 2022 23:25:22 GMT
X-CDN
AKAM
X-EdgeConnect-MidMile-RTT
0
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=30601
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3085
uwt.js
static.ads-twitter.com/
48 KB
14 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d217d238f3f2648014fb12906dca5366954ffa6256d160726190d9e0e9c8376a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:38 GMT
content-encoding
gzip
last-modified
Wed, 18 May 2022 16:49:30 GMT
etag
"39dd6daafb219ee61305f13521c2d060+gzip+gzip"
vary
Accept-Encoding,Host
x-tw-cdn
FT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache
x-cache
HIT, HIT
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
content-length
14051
x-served-by
cache-iad-kiad7000057-IAD, cache-muc13949-MUC
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.72.193 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-72-193.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:37 GMT
Content-Encoding
gzip
Last-Modified
Fri, 29 Oct 2021 01:24:07 GMT
Server
AkamaiNetStorage
ETag
"461ce1cffaadfebf2e7659745618ba8e:1635470647.434977"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
753
rtp.js
abrtp1-cdn.marketo.com/rtp-api/v1/
153 KB
42 KB
Script
General
Full URL
https://abrtp1-cdn.marketo.com/rtp-api/v1/rtp.js?aid=checkpoint
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.92.90.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-90-132.deploy.static.akamaitechnologies.com
Software
Jetty(7.3.1.v20110307) /
Resource Hash
54e5ce8f8dc92a2cd7ae4b18a9798583a8c6439ffab509b94a1f685a3293182e
Security Headers
Name Value
Strict-Transport-Security max-age=63113904

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=63113904
Content-Encoding
gzip
Last-Modified
Tue, 17 May 2022 18:00:27 GMT
Server
Jetty(7.3.1.v20110307)
Date
Fri, 27 May 2022 17:10:37 GMT
Vary
Accept-Encoding
Content-Type
application/x-javascript; charset=UTF-8
Cache-Control
public, max-age=52
Connection
keep-alive
Content-Length
42695
fbevents.js
connect.facebook.net/en_US/
99 KB
27 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
4a9a6afeba8624295a87efaf0d3c76fa7a55271f310adffcfa683bccacc0fc5d
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
content-security-policy-report-only
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: chrome-extension: 'unsafe-inline' 'unsafe-eval';report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
26310
x-xss-protection
0
pragma
public
x-fb-debug
v76DvxGKImzSvnqEodh4MibwCby+RYhvWKHGnl9RFJynl/uOGxavwDom72+0LGsUPwkwlIY35z5jn1UNq0U/KA==
x-fb-trip-id
917726464
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Fri, 27 May 2022 17:10:37 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
1692853834349189
connect.facebook.net/signals/config/
305 KB
87 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/1692853834349189?v=2.9.61&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
8f8ff336890ffb3e3eafcbe5f3f940b8e4d7c96fa0b7e1848e9585fffb504ce0
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
88773
x-xss-protection
0
pragma
public
x-fb-debug
ipG3/Oe2MTOUu6ukA1h31K5Fo52sgrR2JUbUrBDAPtg4XwqgpMUr+lGHvqu+rPuqg6xwXB6fBp2aqocNyfa0qg==
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Fri, 27 May 2022 17:10:37 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
munchkin.js
munchkin.marketo.net/161/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/161/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.72.193 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-72-193.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:37 GMT
Content-Encoding
gzip
Last-Modified
Wed, 08 Sep 2021 00:38:21 GMT
Server
AkamaiNetStorage
ETag
"0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4681
Expires
Sun, 04 Sep 2022 17:10:37 GMT
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1653671437906&url=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D51830%26time%3D1653671437906%26url%3Dhttps%253A%252F%252Fresearch.checkpoint.com%...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1653671437906&url=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&liSync=...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1653671437906&url=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&liSync...
0
264 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1653671437906&url=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&liSync=true&e_ipv6=AQIyFvfkhSEarQAAAYEGf6eXhtceozlJ3-cnIgCFFS9CXrYoEn7T46TJuq5h81-CiYMvGeq6
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:38 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 514C60F3BA9E4E11A159415D252D8F6C Ref B: FRAEDGE1314 Ref C: 2022-05-27T17:10:38Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-proto
http/2
content-length
0
x-li-uuid
AAXgAWKoc3nkSQfO3o0beg==
x-li-fabric
prod-lva1

Redirect headers

date
Fri, 27 May 2022 17:10:37 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 11E57C9A2E6A4BDF84CF721432ED50F5 Ref B: FRAEDGE1308 Ref C: 2022-05-27T17:10:38Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1653671437906&url=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&liSync=true&e_ipv6=AQIyFvfkhSEarQAAAYEGf6eXhtceozlJ3-cnIgCFFS9CXrYoEn7T46TJuq5h81-CiYMvGeq6
x-li-proto
http/2
content-length
0
x-li-uuid
AAXgAWKmdJy/P2zlJiF73w==
visitWebPage
750-dqh-528.mktoresp.com/webevents/
2 B
311 B
Ping
General
Full URL
https://750-dqh-528.mktoresp.com/webevents/visitWebPage?_mchNc=1653671437918&_mchCn=&_mchId=750-DQH-528&_mchTk=_mch-checkpoint.com-1653671437917-90987&_mchHo=research.checkpoint.com&_mchPo=&_mchRu=%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/161/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:38 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
388e1664-15cb-4376-9bf4-3dfa33542885
/
www.facebook.com/tr/
44 B
297 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1692853834349189&ev=PageView&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&rl=&if=false&ts=1653671437948&sw=1600&sh=1200&v=2.9.61&r=stable&ec=0&o=30&fbp=fb.1.1653671437946.1946214226&it=1653671437902&coo=false&exp=p0&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:37 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
44
expires
Fri, 27 May 2022 17:10:37 GMT
jquery.min.js
rtp-static.marketo.com/rtp/libs/jquery/1.8.3/
91 KB
33 KB
Script
General
Full URL
https://rtp-static.marketo.com/rtp/libs/jquery/1.8.3/jquery.min.js
Requested by
Host: abrtp1-cdn.marketo.com
URL: https://abrtp1-cdn.marketo.com/rtp-api/v1/rtp.js?aid=checkpoint
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.92.90.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-90-132.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:38 GMT
Content-Encoding
gzip
Last-Modified
Mon, 07 Sep 2015 11:20:15 GMT
Server
AkamaiNetStorage
ETag
"3576a6e73c9dccdbbc4a2cf8ff544ad7:1441624815"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Access-Control-Max-Age
86400
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
33467
jquery-ui-insightera-custom-1.9.6.css
rtp-static.marketo.com/rtp/libs/
22 KB
4 KB
Stylesheet
General
Full URL
https://rtp-static.marketo.com/rtp/libs/jquery-ui-insightera-custom-1.9.6.css
Requested by
Host: abrtp1-cdn.marketo.com
URL: https://abrtp1-cdn.marketo.com/rtp-api/v1/rtp.js?aid=checkpoint
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.92.90.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-90-132.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
339b2b60e94b6dc169fd9e5b68ac16b1ca08ef6a4968e98a0f43c2add405e79a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:38 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Nov 2017 08:57:42 GMT
Server
AkamaiNetStorage
ETag
"7f5b0bee9b1f7af8413b351cbceca223:1510045062"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
text/css
Access-Control-Allow-Origin
*
Access-Control-Max-Age
86400
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
3752
trw
abrtp1.marketo.com/gw1/
0
435 B
Script
General
Full URL
https://abrtp1.marketo.com/gw1/trw?aid=checkpoint&trwv.uid=checkpoint-1653671438030-c82165ba&trwv.vc=1&trwsa.sid=checkpoint-1653671438032-8936d4fc&trwsb.cpv=1&ctzo=-00:00&uri=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&ma=id%3A750-DQH-528%26token%3A_mch-checkpoint.com-1653671437917-90987&pm=&viewedTypes=&rts=1653671438035
Requested by
Host: abrtp1-cdn.marketo.com
URL: https://abrtp1-cdn.marketo.com/rtp-api/v1/rtp.js?aid=checkpoint
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.84 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
Jetty(7.3.1.v20110307) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63113904

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:38 GMT
Cache-Control
no-cache
Server
Jetty(7.3.1.v20110307)
Connection
close
Content-Length
0
Strict-Transport-Security
max-age=63113904
Content-Type
application/x-javascript; charset=UTF-8
ga-integration-2.0.4.js
rtp-static.marketo.com/rtp/libs/
17 KB
6 KB
Script
General
Full URL
https://rtp-static.marketo.com/rtp/libs/ga-integration-2.0.4.js
Requested by
Host: abrtp1-cdn.marketo.com
URL: https://abrtp1-cdn.marketo.com/rtp-api/v1/rtp.js?aid=checkpoint
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.92.90.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-90-132.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
278cd45917f5fee0e5710b34f2c03a3652544fe5a6ccea56cbbd0bd7324bf5e7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:38 GMT
Content-Encoding
gzip
Last-Modified
Thu, 03 Jun 2021 07:56:23 GMT
Server
AkamaiNetStorage
ETag
"cfd84ea6865e772828527b0485a0eb7e:1622706982.648039"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Access-Control-Max-Age
86400
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
5540
trends.min.js
assets.trendemon.com/tag/
216 KB
42 KB
Script
General
Full URL
https://assets.trendemon.com/tag/trends.min.js
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2020/phishing-campaign-exploits-samsung-adobe-and-oxford-servers/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-122-36.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4ae30664ee32c3fa8cf563f0e54db8d4fac1fb5f3b97a1bff75628cc7291c640

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Thu, 26 May 2022 19:53:21 GMT
content-encoding
gzip
last-modified
Tue, 26 Apr 2022 08:14:34 GMT
server
AmazonS3
age
76638
etag
"7cf39d12bc5c7984584f44d575ae1b65"
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 d13436be9e793d00b0273db3f7904816.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P2
accept-ranges
bytes
content-length
42819
x-amz-cf-id
kcrmZ3gTxoaIEu5D4gM_WlVChBfVTm7EYpBk3Jd_FH6lW05u3G_pKw==
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=cfd5ce17e94900000d06916249000000f1e15d00&session=c2336b45-09bc-4ae2-82f5-2b859ef136af&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2027%20May%202022%2017%3A10%3A38%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2027%20May%202022%2017%3A10%3A37%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Office%20365%20Phishing%20Campaign%20Exploits%20Samsung%2C%20Adobe%20and%20Oxford%20Servers%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&pageViewId=c5b47eec-a44b-4cec-8b61-2b60f81195cd&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:38 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
msg
abrtp1.marketo.com/gw1/
0
494 B
Script
General
Full URL
https://abrtp1.marketo.com/gw1/msg?a=2&sid=checkpoint-1653671438032-8936d4fc&aid=checkpoint&ma=id%3A750-DQH-528%26token%3A_mch-checkpoint.com-1653671437917-90987&viewedTypes=&0.02123406001721051&rts=1653671438086
Requested by
Host: abrtp1-cdn.marketo.com
URL: https://abrtp1-cdn.marketo.com/rtp-api/v1/rtp.js?aid=checkpoint
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.84 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
Jetty(7.3.1.v20110307) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63113904

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:38 GMT
Content-Encoding
gzip
Server
Jetty(7.3.1.v20110307)
Transfer-Encoding
chunked
Connection
close
Content-Type
text/javascript; charset=UTF-8
Cache-Control
no-cache
Strict-Transport-Security
max-age=63113904
2336
trackingapi.trendemon.com/api/settings/
745 B
884 B
Script
General
Full URL
https://trackingapi.trendemon.com/api/settings/2336?callback=jsonp41276&vid=
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.157.244.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-157-244-245.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
9c616a20a18a47962df2dd805eb35a387f3ebca86599b1cad62c2c76f446138e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 May 2022 17:10:38 GMT
cache-control
no-store,no-cache
server
Kestrel
content-length
745
content-type
application/x-javascript; charset=UTF-8
jquery-custom-ui.min.js
rtp-static.marketo.com/rtp/libs/jqueryui/1.9.2f/
126 KB
35 KB
Script
General
Full URL
https://rtp-static.marketo.com/rtp/libs/jqueryui/1.9.2f/jquery-custom-ui.min.js
Requested by
Host: abrtp1-cdn.marketo.com
URL: https://abrtp1-cdn.marketo.com/rtp-api/v1/rtp.js?aid=checkpoint
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.92.90.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-90-132.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
35f273e01e70db780ae423347dffecfc27cc348ba4abbd6099331559a7c5cd31

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:38 GMT
Content-Encoding
gzip
Last-Modified
Tue, 09 Jan 2018 12:54:21 GMT
Server
AkamaiNetStorage
ETag
"5a9f8dd85d85afd20544bd437a505338:1515502461"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Access-Control-Max-Age
86400
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
35484
visitor
abrtp1.marketo.com/gw1/rtp/api/v1_1/
632 B
1004 B
XHR
General
Full URL
https://abrtp1.marketo.com/gw1/rtp/api/v1_1/visitor?sid=checkpoint-1653671438032-8936d4fc&aid=checkpoint&1653671438246
Requested by
Host: rtp-static.marketo.com
URL: https://rtp-static.marketo.com/rtp/libs/ga-integration-2.0.4.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.84 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
Jetty(7.3.1.v20110307) /
Resource Hash
7d0604ea753c12bf63aa51c61e5ff656d461e5fc51d58a49a3cc3159a458c42c
Security Headers
Name Value
Strict-Transport-Security max-age=63113904

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 27 May 2022 17:10:38 GMT
Content-Encoding
gzip
Last-Modified
Fri May 27 12:10:38 CDT 2022
Server
Jetty(7.3.1.v20110307)
Strict-Transport-Security
max-age=63113904
Content-Type
application/json;charset=UTF-8
Access-Control-Allow-Origin
https://research.checkpoint.com
Cache-Control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Transfer-Encoding
chunked
Connection
close
Expires
Thu, 01 Jan 1970 00:00:00 GMT
sgm
abrtp1.marketo.com/gw1/ga/
270 B
723 B
XHR
General
Full URL
https://abrtp1.marketo.com/gw1/ga/sgm?sid=checkpoint-1653671438032-8936d4fc&1653671438247
Requested by
Host: rtp-static.marketo.com
URL: https://rtp-static.marketo.com/rtp/libs/ga-integration-2.0.4.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.84 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
Jetty(7.3.1.v20110307) /
Resource Hash
5cf9e763a5847c6ef7ee8b45f241e622ac0df24466888b7f07023699553a4a60
Security Headers
Name Value
Strict-Transport-Security max-age=63113904

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:38 GMT
Server
Jetty(7.3.1.v20110307)
Strict-Transport-Security
max-age=63113904
Content-Type
text/json;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
close
Content-Length
270
adsct
analytics.twitter.com/i/
43 B
354 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?type=javascript&version=2.3.12&p_id=Twitter&p_user_id=0&txn_id=nxi3o&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_order_quantity=0&tw_sale_amount=0&tw_iframe_status=0&event_id=3988eb64-d3e9-49a7-829c-3f9eacbbd054&tw_document_href=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-response-time
112
date
Fri, 27 May 2022 17:10:37 GMT
server
tsa_o
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
ecd193d953ebb98ff8e38e5cffb6a540012e35612700e08d2b58d51b5f828ae7
content-length
43
adsct
t.co/i/
43 B
337 B
Image
General
Full URL
https://t.co/i/adsct?type=javascript&version=2.3.12&p_id=Twitter&p_user_id=0&txn_id=nxi3o&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_order_quantity=0&tw_sale_amount=0&tw_iframe_status=0&event_id=3988eb64-d3e9-49a7-829c-3f9eacbbd054&tw_document_href=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-response-time
112
date
Fri, 27 May 2022 17:10:37 GMT
server
tsa_o
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
8c083f57cee60e1d364fedf6ffdcd4373b0148f01568364d1116e398c2c72801
content-length
43
/
www.facebook.com/tr/
44 B
91 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1692853834349189&ev=Microdata&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&rl=&if=false&ts=1653671438450&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Office%20365%20Phishing%20Campaign%20Exploits%20Samsung%2C%20Adobe%20and%20Oxford%20Servers%20-%20Check%20Point%20Research%22%2C%22meta%3Adescription%22%3A%22Latest%20Research%20by%20our%20Team%22%7D&cd[OpenGraph]=%7B%22og%3Alocale%22%3A%22en_US%22%2C%22og%3Atype%22%3A%22article%22%2C%22og%3Atitle%22%3A%22Office%20365%20Phishing%20Campaign%20Exploits%20Samsung%2C%20Adobe%20and%20Oxford%20Servers%20-%20Check%20Point%20Research%22%2C%22og%3Adescription%22%3A%22Introduction%20Over%20the%20last%20few%20years%2C%20the%20adoption%20of%20Office%20365%20in%20the%20corporate%20sector%20has%20significantly%20increased.%20Its%20popularity%20has%20attracted%20the%20attention%20of%20cybercriminals%20who%20launch%20phishing%20campaigns%20specifically%20to%20attack%20the%20platform.%20As%2090%25%20of%20cyber-attacks%20start%20with%20a%20phishing%20campaign%2C%20Office%20365%20is%20an%20attractive%20target%20for%20threat%20actors%20who%20work...%20Click%20to%20Read%20More%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F%22%2C%22og%3Asite_name%22%3A%22Check%20Point%20Research%22%2C%22article%3Apublished_time%22%3A%222020-06-18T10%3A05%3A03%2B00%3A00%22%2C%22article%3Amodified_time%22%3A%222021-03-30T19%3A29%3A10%2B00%3A00%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fresearch.checkpoint.com%2Fwp-content%2Fuploads%2F2020%2F06%2FPhishingServers_blog_header.jpg%22%2C%22og%3Aimage%3Awidth%22%3A%221021%22%2C%22og%3Aimage%3Aheight%22%3A%22580%22%2C%22og%3Aimage%3Atype%22%3A%22image%2Fjpeg%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.61&r=stable&ec=1&o=30&fbp=fb.1.1653671437946.1946214226&it=1653671437902&coo=false&es=automatic&tm=3&exp=p0&rqm=GET
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:38 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
content-length
44
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority
u=3,i
expires
Fri, 27 May 2022 17:10:38 GMT
identity.min.js
assets.trendemon.com/global/
17 KB
6 KB
Script
General
Full URL
https://assets.trendemon.com/global/identity.min.js
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-122-36.fra60.r.cloudfront.net
Software
/ Express
Resource Hash
2a5818fde3ebf72d87983e461992e10484ac717b5ebb07c8735ed34fd13dc37c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 01:23:30 GMT
content-encoding
gzip
age
56883
x-powered-by
Express
x-cache
Hit from cloudfront
via
1.1 d13436be9e793d00b0273db3f7904816.cloudfront.net (CloudFront)
trd-ts
2022-05-26T01:22:21.557Z
last-modified
Tue, 26 Apr 2022 08:12:59 GMT
etag
W/"46f8-18064ee46f8"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
x-amz-cf-pop
FRA60-P2
accept-ranges
bytes
x-amz-cf-id
bE_hn1pDH5XbMde_9b15M1ms7snJZHAOCBl7OvEPwz3jzF8i_WDb6A==
msg
abrtp1.marketo.com/gw1/
0
494 B
Script
General
Full URL
https://abrtp1.marketo.com/gw1/msg?a=2&sid=checkpoint-1653671438032-8936d4fc&aid=checkpoint&ma=id%3A750-DQH-528%26token%3A_mch-checkpoint.com-1653671437917-90987&viewedTypes=&0.293486257992035&rts=1653671438573
Requested by
Host: abrtp1-cdn.marketo.com
URL: https://abrtp1-cdn.marketo.com/rtp-api/v1/rtp.js?aid=checkpoint
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.84 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
Jetty(7.3.1.v20110307) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63113904

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:38 GMT
Content-Encoding
gzip
Server
Jetty(7.3.1.v20110307)
Transfer-Encoding
chunked
Connection
close
Content-Type
text/javascript; charset=UTF-8
Cache-Control
no-cache
Strict-Transport-Security
max-age=63113904
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=377182901&t=event&ni=1&_s=2&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&ul=en-us&de=UTF-8&dt=Office%20365%20Phishing%20Campaign%20Exploits%20Samsung%2C%20Adobe%20and%20Oxford%20Servers%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=RTP&ea=Organization&el=31173%20Services%20AB&_u=aHDAgEABAAAAAE~&jid=&gjid=&cid=252029888.1653671437&tid=UA-194688-3&_gid=1137315816.1653671437&gtm=2wg5p15JCRGP&cd1=31173%20Services%20AB&z=206307769
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 May 2022 15:29:35 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
6063
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=377182901&t=event&ni=1&_s=2&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&ul=en-us&de=UTF-8&dt=Office%20365%20Phishing%20Campaign%20Exploits%20Samsung%2C%20Adobe%20and%20Oxford%20Servers%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=RTP&ea=Organization&el=31173%20Services%20AB&_u=aHDAgEABAAAAAE~&jid=&gjid=&cid=252029888.1653671437&tid=UA-194688-3&_gid=1137315816.1653671437&gtm=2wg5p15JCRGP&cd9=&cd10=&cd11=&cd12=&cd13=&cd14=&cd16=&cd17=Sweden&cd1=31173%20Services%20AB&z=1831552999
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 May 2022 15:29:35 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
6063
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
me
trackingapi.trendemon.com/api/Identity/
95 B
511 B
Script
General
Full URL
https://trackingapi.trendemon.com/api/Identity/me?accountId=2336&DomainCookie=16536714384744519&fingerPrint=fbbd5f6b56d9834a9579d45bc7e4b0ea&callback=jsonp624876&vid=
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.157.244.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-157-244-245.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
33e84e1989ff3c0c95ac5f15a67113be09682d16fd37ee9d1671bbdf2e322ee4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 May 2022 17:10:38 GMT
cache-control
no-store,no-cache
server
Kestrel
content-length
95
content-type
application/x-javascript; charset=UTF-8
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=377182901&t=event&ni=1&_s=3&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&ul=en-us&de=UTF-8&dt=Office%20365%20Phishing%20Campaign%20Exploits%20Samsung%2C%20Adobe%20and%20Oxford%20Servers%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=RTP-Segments&ea=Global&el=31173%20Services%20AB&_u=aHDAgEABAAAAAE~&jid=&gjid=&cid=252029888.1653671437&tid=UA-194688-3&_gid=1137315816.1653671437&gtm=2wg5p15JCRGP&cd1=31173%20Services%20AB&z=51126704
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 May 2022 15:29:35 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
6063
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=377182901&t=event&ni=1&_s=3&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&ul=en-us&de=UTF-8&dt=Office%20365%20Phishing%20Campaign%20Exploits%20Samsung%2C%20Adobe%20and%20Oxford%20Servers%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=RTP-Segments&ea=Global&el=31173%20Services%20AB&_u=aHDAgEABAAAAAE~&jid=&gjid=&cid=252029888.1653671437&tid=UA-194688-3&_gid=1137315816.1653671437&gtm=2wg5p15JCRGP&cd9=&cd10=&cd11=&cd12=&cd13=&cd14=&cd16=&cd17=Sweden&cd1=31173%20Services%20AB&z=665973907
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 May 2022 15:29:35 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
6063
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
marketingautomation
trackingapi.trendemon.com/api/
95 B
232 B
Script
General
Full URL
https://trackingapi.trendemon.com/api/marketingautomation?AccountId=2336&ClientUrl=aHR0cHM6Ly9yZXNlYXJjaC5jaGVja3BvaW50LmNvbS8yMDIwL3BoaXNoaW5nLWNhbXBhaWduLWV4cGxvaXRzLXNhbXN1bmctYWRvYmUtYW5kLW94Zm9yZC1zZXJ2ZXJzLw%3D%3D&CookieId=16536714384744519&MaCookie=aWQ6NzUwLURRSC01MjgmdG9rZW46X21jaC1jaGVja3BvaW50LmNvbS0xNjUzNjcxNDM3OTE3LTkwOTg3&MaCookieName=X21rdG9fdHJr&MaName=marketo&callback=jsonp743798&vid=2336:16536714384744519
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.157.244.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-157-244-245.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
174f25c07ae65aad4e0d3b3d6df7100b776742e5a120f1559bb7ee3b6e705859

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 May 2022 17:10:38 GMT
cache-control
no-store,no-cache
server
Kestrel
content-length
95
content-type
application/x-javascript; charset=UTF-8
personal
trackingapi.trendemon.com/api/experience/
14 B
113 B
Script
General
Full URL
https://trackingapi.trendemon.com/api/experience/personal?AccountId=2336&ClientUrl=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&MarketingAutomationCookie=id%3A750-DQH-528%26token%3A_mch-checkpoint.com-1653671437917-90987&ExcludeUnitsJson=%5B%5D&callback=jsonp92239&vid=2336:16536714384744519
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.157.244.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-157-244-245.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
36b93eb8b57ecd321f115fb99deaf74d19fb877339eb4203bf0d4bc6c1ade604

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Fri, 27 May 2022 17:10:38 GMT
server
Kestrel
content-length
14
content-type
application/x-javascript; charset=UTF-8
pageview
trackingapi.trendemon.com/api/events/
43 B
234 B
Image
General
Full URL
https://trackingapi.trendemon.com/api/events/pageview?accountId=2336&url=aHR0cHM6Ly9yZXNlYXJjaC5jaGVja3BvaW50LmNvbS8yMDIwL3BoaXNoaW5nLWNhbXBhaWduLWV4cGxvaXRzLXNhbXN1bmctYWRvYmUtYW5kLW94Zm9yZC1zZXJ2ZXJzLw%3D%3D&cookie=16536714384744519&referral=&vid=2336:16536714384744519&r=1653671438800
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.157.244.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-157-244-245.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 May 2022 17:10:38 GMT
server
Kestrel
age
1691358
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
content-length
43
expires
Mon, 01 Jan 1990 00:00:00 GMT
multiple
trackingapi.trendemon.com/api/events/client-app/
43 B
234 B
Image
General
Full URL
https://trackingapi.trendemon.com/api/events/client-app/multiple?accountId=2336&url=aHR0cHM6Ly9yZXNlYXJjaC5jaGVja3BvaW50LmNvbS8yMDIwL3BoaXNoaW5nLWNhbXBhaWduLWV4cGxvaXRzLXNhbXN1bmctYWRvYmUtYW5kLW94Zm9yZC1zZXJ2ZXJzLw%3D%3D&app=sixsense&names=%5B%5D&vid=2336:16536714384744519&r=1653671438875
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.157.244.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-157-244-245.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 27 May 2022 17:10:38 GMT
server
Kestrel
age
1691358
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
content-length
43
expires
Mon, 01 Jan 1990 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=cfd5ce17e94900000d06916249000000f1e15d00&session=c2336b45-09bc-4ae2-82f5-2b859ef136af&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2027%20May%202022%2017%3A10%3A39%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2027%20May%202022%2017%3A10%3A38%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Office%20365%20Phishing%20Campaign%20Exploits%20Samsung%2C%20Adobe%20and%20Oxford%20Servers%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&pageViewId=c5b47eec-a44b-4cec-8b61-2b60f81195cd&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:39 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=cfd5ce17e94900000d06916249000000f1e15d00&session=c2336b45-09bc-4ae2-82f5-2b859ef136af&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2027%20May%202022%2017%3A10%3A40%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2027%20May%202022%2017%3A10%3A39%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Office%20365%20Phishing%20Campaign%20Exploits%20Samsung%2C%20Adobe%20and%20Oxford%20Servers%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&pageViewId=c5b47eec-a44b-4cec-8b61-2b60f81195cd&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:40 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=cfd5ce17e94900000d06916249000000f1e15d00&session=c2336b45-09bc-4ae2-82f5-2b859ef136af&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2027%20May%202022%2017%3A10%3A41%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2027%20May%202022%2017%3A10%3A40%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Office%20365%20Phishing%20Campaign%20Exploits%20Samsung%2C%20Adobe%20and%20Oxford%20Servers%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&pageViewId=c5b47eec-a44b-4cec-8b61-2b60f81195cd&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:41 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=cfd5ce17e94900000d06916249000000f1e15d00&session=c2336b45-09bc-4ae2-82f5-2b859ef136af&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2027%20May%202022%2017%3A10%3A42%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2027%20May%202022%2017%3A10%3A41%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225006%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Office%20365%20Phishing%20Campaign%20Exploits%20Samsung%2C%20Adobe%20and%20Oxford%20Servers%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&pageViewId=c5b47eec-a44b-4cec-8b61-2b60f81195cd&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:42 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=cfd5ce17e94900000d06916249000000f1e15d00&session=c2336b45-09bc-4ae2-82f5-2b859ef136af&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2027%20May%202022%2017%3A10%3A43%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2027%20May%202022%2017%3A10%3A42%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%226010%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Office%20365%20Phishing%20Campaign%20Exploits%20Samsung%2C%20Adobe%20and%20Oxford%20Servers%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2020%2Fphishing-campaign-exploits-samsung-adobe-and-oxford-servers%2F&pageViewId=c5b47eec-a44b-4cec-8b61-2b60f81195cd&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 17:10:43 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Fri, 21 Feb 2020 18:57:20 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"5e502810-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

156 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation object| dataLayer function| $ function| jQuery object| bootstrap function| jQueryBridget function| EvEmitter function| getSize function| matchesSelector object| fizzyUIUtils function| Flickity function| Unipointer function| Unidragger function| TapListener function| imagesLoaded function| documentInitOneSignal function| OneSignal object| st object| __stdos__ boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus function| __sharethis__docReady object| __sharethis__ object| EnlighterJS function| EnlighterJSINIT object| google_tag_manager function| postscribe object| google_tag_manager_external function| processEpsilonData string| epsilonName boolean| enabled function| callback number| version object| _6si object| google_tag_data string| GoogleAnalyticsObject function| ga number| TRD_ACC_ID boolean| _storagePopulated number| __oneSignalSdkLoadCount object| _oneSignalInitOptions function| __jp0 object| gaplugins object| gaGlobal object| gaData string| _linkedin_data_partner_id function| twq function| rtp function| fbq function| _fbq function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin function| lintrk boolean| _already_called_lintrk object| MunchkinTracker function| getInternetExplorerVersion function| consoleMessage function| makeGetRequest function| createCORSRequest object| ITLocalStorageAPI object| InsighteraUtil object| iiq object| ibq object| trackObj function| isCurrentSession function| addDynamicScript function| rtpRCMD object| AITag object| aiq object| AIConfig function| setButtonWidthHeight function| getDirectionForWidgetSide function| updateWidget function| initialize function| showWidgetCampaign function| hide function| injectContent function| execute function| destroy object| InsighteraWidget function| setTimeoutFunction object| exp_2_year function| loadRichMediaImage function| $Trd_Base64 function| $Trd_i18n function| __awaiter function| __generator function| $Trd_Utils function| $Trd_Tools function| $Trd_Logger function| RecordsService function| __extends function| $Trd_UserPageHistory_Cook object| enRenderModes object| $Trd_InternalEventsTypes object| $Trd_TriggersEventsTypes function| mapBackendTriggers function| $Trd_Context function| $Trd_EnvironmentSettings function| $Trd_ClientCookie function| $Trd_CtaClientCookie function| $Trd_ButtonSelector object| Frequency object| UnitVisibiltyType object| UnitTypeId string| LOCAL_STORAGE_ITEM_NAME function| $Trd_FormListener object| COOKIE_NAMES function| $Trd_Visitor function| $Trd_UrlGrabber function| $Trd_Events function| $Trd_Pageview function| $Trd_Newvisitor function| $Trd_Cookmanager string| $TRD_MA_COOKIE_NAME object| $TRD_MA_COOKIE_NAME_MAP function| $Trd_MarketingAutomation function| $TRD_CtaComponent function| $TRD_CtaContentComponent function| $TRD_GenericLayoutComponent function| $TRD_FormLayoutComponent function| $TRD_RecommendationLayoutComponent function| $TRD_GenericScriptComponent function| $TRD_FastTextLayoutComponent function| $TRD_SurveyLayoutComponent function| __assign function| __spreadArray number| COOLOFF_DAYS_AFTER_CLOSE number| COOLOFF_MS_AFTER_CLOSE function| $Trd_ExperienceManager function| $TRD_ClientAppFactory function| $TRD_ClientApp function| $TRD_ClientAppDrift function| $TRD_ClientAppSixSense object| trdContext undefined| src function| $Trd_Lift function| $Trd_Embedded function| $Trd_NApi object| TrendemonContext object| $trd_Context object| trd_api function| alignElementPosition function| applyAttributeHeightToPics function| revertAttributeHeightToPics object| regeneratorRuntime object| twttr object| IdentityConfig function| $Trd_Identity

34 Cookies

Domain/Path Name / Value
.checkpoint.com/ Name: referralURL
Value:
.6sc.co/ Name: 6suuid
Value: cfd5ce17e94900000d06916249000000f1e15d00
research.checkpoint.com/ Name: _gd_svisitor
Value: cfd5ce17e94900000d06916249000000f1e15d00
research.checkpoint.com/ Name: _gd_visitor
Value: 4a2780e7-d756-4ea6-8efe-a1d2e6283a87
research.checkpoint.com/ Name: _gd_session
Value: c2336b45-09bc-4ae2-82f5-2b859ef136af
research.checkpoint.com/ Name: _an_uid
Value: 0
.checkpoint.com/ Name: _ga
Value: GA1.2.252029888.1653671437
.checkpoint.com/ Name: _gid
Value: GA1.2.1137315816.1653671437
.checkpoint.com/ Name: _dc_gtm_UA-194688-3
Value: 1
.checkpoint.com/ Name: _mkto_trk
Value: id:750-DQH-528&token:_mch-checkpoint.com-1653671437917-90987
.checkpoint.com/ Name: _fbp
Value: fb.1.1653671437946.1946214226
.checkpoint.com/ Name: trwv.uid
Value: checkpoint-1653671438030-c82165ba%3A1
.checkpoint.com/ Name: trwsa.sid
Value: checkpoint-1653671438032-8936d4fc%3A1
.linkedin.com/ Name: UserMatchHistory
Value: AQKDPsG9WIhC6QAAAYEGf6alMueJJ9iZtnQGbqsd6nz_sLB5PqHa-HsUEGaZbZ9KohiMES2F1kxJoQ
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQJ5sDLIMkS_jwAAAYEGf6al2jThcZvV1UOk0nTS6bgpFqTFQMcHZil6alvHLJCHvbw69Bfkj6vkCu0LWFZozg
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&b276df32-c488-4140-86cd-84788c9373b5"
.linkedin.com/ Name: lidc
Value: "b=VGST07:s=V:r=V:a=V:p=V:g=2360:u=1:x=1:i=1653671437:t=1653757837:v=2:sig=AQGLm8CY9cBO8QbBNbZ9f3Xqg6qYFDqT"
.linkedin.com/ Name: lang
Value: v=2&lang=de-de
.www.linkedin.com/ Name: bscookie
Value: "v=1&20220527171038c80d9d34-ffb3-454b-867a-178d72b3743fAQEypwZjbJjyxiVeIXrSgEgts0i_VWKp"
.linkedin.com/ Name: li_gc
Value: MTswOzE2NTM2NzE0Mzg7MjswMjHUJb8DaRQzfq7xDZgiuw4SFh7SmcdwF+Moany047erHw==
.t.co/ Name: muc_ads
Value: db6ad446-1e6c-458c-91da-b3223d68310e
.twitter.com/ Name: personalization_id
Value: "v1_TwrbzwyYovDgbqDhQ824MA=="
.checkpoint.com/ Name: trd_cid
Value: 16536714384744519
trackingapi.trendemon.com/ Name: trd_gavid_2336
Value: 16536714384744519
trackingapi.trendemon.com/ Name: trd_gvid
Value: 16536714384744519
trackingapi.trendemon.com/ Name: trd_vid_2336
Value: 2336%3A16536714384744519
.checkpoint.com/ Name: trd_vid_l
Value: 2336%3A16536714384744519
.checkpoint.com/ Name: trd_vuid_l
Value: -2670481006918695977
.checkpoint.com/ Name: trd_first_visit
Value: 1653671439
.checkpoint.com/ Name: trd_pw
Value: 1
.checkpoint.com/ Name: trd_pws
Value: 1
.checkpoint.com/ Name: trd_sid
Value: 16536714387987443
.checkpoint.com/ Name: trd_ma_cookie
Value: aWQ6NzUwLURRSC01MjgmdG9rZW46X21jaC1jaGVja3BvaW50LmNvbS0xNjUzNjcxNDM3OTE3LTkwOTg3

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

750-dqh-528.mktoresp.com
abrtp1-cdn.marketo.com
abrtp1.marketo.com
analytics.twitter.com
assets.trendemon.com
b.6sc.co
buttons-config.sharethis.com
c.6sc.co
cdn.onesignal.com
code.jquery.com
connect.facebook.net
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
img.onesignal.com
ipv6.6sc.co
j.6sc.co
l.sharethis.com
munchkin.marketo.net
onesignal.com
platform-api.sharethis.com
platform-cdn.sharethis.com
px.ads.linkedin.com
px4.ads.linkedin.com
research.checkpoint.com
rtp-static.marketo.com
sc1.checkpoint.com
secure.adnxs.com
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
trackingapi.trendemon.com
use.fontawesome.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
104.244.42.195
104.244.42.69
104.89.43.125
104.92.72.193
104.92.90.132
13.107.42.14
13.32.99.51
141.193.213.21
18.66.122.36
185.33.220.100
192.28.144.124
192.28.144.84
199.232.188.157
2001:4de0:ac18::1:a:3a
2600:9000:223c:d600:c:abe:f440:93a1
2600:9000:236e:c200:1d:85c3:6640:93a1
2606:4700::6812:e134
2606:4700::6812:e234
2620:1ec:21::14
2a00:1450:4001:80e::2003
2a00:1450:4001:812::200a
2a00:1450:4001:813::2004
2a00:1450:4001:827::2003
2a00:1450:4001:827::200e
2a00:1450:4001:828::2008
2a00:1450:400c:c07::9c
2a02:26f0:1700:18c::1c91
2a02:26f0:f7::5c7b:e024
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a06:98c1:3121::3
3.65.251.65
52.57.195.65
54.157.244.245
96.16.137.162
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8
0fc686423c26cb1030032fd7e4f2dd664c4b08517a8990c0b46269dd4e01910b
0fe8bcbcd24ab838fbbd773001253fc0353956e81c5ba9c8e23951ebdbae305a
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
145d7e6982ea14023e72f2ca858f86ca8bcb33c8680c87296c610bec43ffc52c
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c
174f25c07ae65aad4e0d3b3d6df7100b776742e5a120f1559bb7ee3b6e705859
1998582382fbf956231d65be84b76e08c0c86e5ced8a99c703bdec416d876d76
1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
260958a69477ef6739a08e7c178eb491831f6be05451637c804a2c89314a125a
278cd45917f5fee0e5710b34f2c03a3652544fe5a6ccea56cbbd0bd7324bf5e7
2a5818fde3ebf72d87983e461992e10484ac717b5ebb07c8735ed34fd13dc37c
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
339b2b60e94b6dc169fd9e5b68ac16b1ca08ef6a4968e98a0f43c2add405e79a
33e84e1989ff3c0c95ac5f15a67113be09682d16fd37ee9d1671bbdf2e322ee4
34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255
35f273e01e70db780ae423347dffecfc27cc348ba4abbd6099331559a7c5cd31
3643b2c826a615065303aa44b8f463eb854d77934f5f25dc1f74f60d4698f9f0
36b93eb8b57ecd321f115fb99deaf74d19fb877339eb4203bf0d4bc6c1ade604
408ddad0ef179adef886bffc95c5851680e2e1a3d9f04a03f5bb8d1efb73344c
434ecabcb0f7535df19a2774b9e1262b1ebfc9c8a738c93e16077cf5878a615a
43b21a37ead752a35feeeb473aecb119bc2b63800594adc825bcb903b81f23da
481a0574246e281316ffa0e15399bf5388bb81ae550ce0401a0353b6bb2d1e5a
4a9a6afeba8624295a87efaf0d3c76fa7a55271f310adffcfa683bccacc0fc5d
4ae30664ee32c3fa8cf563f0e54db8d4fac1fb5f3b97a1bff75628cc7291c640
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08
53d4eef6e46ad628907d6f667663d3792e11805a1c8aa5a103ff76e9f35e9f33
545a29e66fc91b142e516a21647233caa8e55fe2d3cd86b84475ce2f6ace21c7
54e5ce8f8dc92a2cd7ae4b18a9798583a8c6439ffab509b94a1f685a3293182e
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57e48df5586242df165fa8424ae8cb9e360c8e81b6a711736bf1f395a2c02a2f
5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38
5cf9e763a5847c6ef7ee8b45f241e622ac0df24466888b7f07023699553a4a60
5df9eee36a61ef8f89d39c04ff402ded30aa9c627b6ef2134f55fa0e8b537153
5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009
6048e330c0f362be46b20de45d35a5ace57a04be04a29da10448d6949f6f69ce
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf
7512bf3b9ec62642bc0800d0ca3c5b8b37a1384814cc7a29d31f6823740fd403
768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
791d8c8cb135d3d53915096e999d3857b6ee16966c20a019f38699f09f6aa2ff
7c93346d4f681a0be90d1dfc19346382a4700f1810f41caa54415688dee1777f
7d0604ea753c12bf63aa51c61e5ff656d461e5fc51d58a49a3cc3159a458c42c
7e0c4a1ed3d232553d98c82ea0e04cee8975d0a67df819e161f96e7c32179e8c
7f5bd223eafa1c6d1aff21c91c6bfb825f7f36830d97eef41c432681ed671f85
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
847eb36b4dc4b05f94052dcd98077319e74d882334a106bb9ca451ba211c9c2c
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8e038b564510a45dc11799f74da367733f3db7f9c0a0434f1e90c44ec5168278
8f8ff336890ffb3e3eafcbe5f3f940b8e4d7c96fa0b7e1848e9585fffb504ce0
953d6908ab55929254e46c77e5c751a6e2df7ab84430f134edc3bb62d8f7d32f
9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99
9c616a20a18a47962df2dd805eb35a387f3ebca86599b1cad62c2c76f446138e
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a22d6b8782097b7cd9588ab582e119bfd6290278275661e9d0f96b2baec0cb8e
a59bba774218f207179b30aa8bbd21bad0f7355a52321e08138bd77a308c27d5
a810a8a528f44a2294b25e1e790a0c98905431fed395b01e8c3fd452c75f15f3
a8da941d8a446516c824ebc9fb77b42e6b92c6deed1daed266bd821ed27bc516
ab387a27fa712c46def740a80752bbc8f22e48f2fe710eb13311b38ef1807e97
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae3754c54a0880a98a94c423d3e67f39b5b6f3c63516dafa33866e3e74c9f97d
aeef17cb37c9f11b40b147b04e3f16ee3a2fdaa90bae2d503a7e3e99399ea682
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242
b7cfb1c9430d90b22b3f4497543a4cfef719dc40a3cce130cad766171abe8bbe
bb3d017273ed487674d9766d8401cf458228596adcc0c3a6024f44ae715090db
bdfd287424a979819871e38d09821982228fb6ac12e51d1a29d81d0ff5e6a0ae
c0f7ef8329ae6da56bd269492901fb024a05d7b67e977995a82b506af4b3b030
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537
cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120
cdbdaa122823601390c7dcbdd1afde33c2f1a432b8c5ff025c6137ee99ba541a
d217d238f3f2648014fb12906dca5366954ffa6256d160726190d9e0e9c8376a
d8d530ea777d879cc75225758beb68c3cfd749d377f5bd99dd95b813c759c687
dadbb59b37bfea4c78c6e15c8cbb96dfba84526e43a0767dc244fd062a841aba
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e80a28e260de3fa02ff629d2ae4a84c50a5e159f40807ca8c61b108cb2899880
eee6d8fe37122ba1538560131fe5c95f9a4b6c45e2059076a7a92513fcb12f20
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efc737b4f58cfe73a9bd0e57d7570365701381da31e628b269e7217a0ce3359d
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fe2df9f6df4b4a8d7174d259f563b8d9e28e4c03f8f4092fd9db6044e0e64c32