urlscan.io logo urlscan.io
SecurityTrails logo

blog.checkpoint.com Open in urlscan Pro
18.173.154.70  Public Scan

Go To Rescan Add Verdict Report
URL: https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/
Submission: On June 21 via api from TR — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 1 countries across 2 domains to perform 14 HTTP transactions. The main IP is 18.173.154.70, located in United States and belongs to AMAZON-02, US. The main domain is blog.checkpoint.com. The Cisco Umbrella rank of the primary domain is 802800.
TLS certificate: Issued by GlobalSign GCC R3 DV TLS CA 2020 on May 30th 2024. Valid for: a year.
This is the only time blog.checkpoint.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
4 18.173.154.70 16509 (AMAZON-02)
6 18.173.187.34 16509 (AMAZON-02)
1 54.230.228.95 16509 (AMAZON-02)
1 108.138.36.3 16509 (AMAZON-02)
14 5
Apex Domain
Subdomains		 Transfer
8 awswaf.com
a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com
a56a6a6f5963.f623b70f.eu-west-1.captcha.awswaf.com
static.captcha.awswaf.com — Cisco Umbrella Rank: 167928
356 KB
4 checkpoint.com
blog.checkpoint.com — Cisco Umbrella Rank: 802800
9 KB
14 2
Domain Requested by
6 a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com blog.checkpoint.com
a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com
4 blog.checkpoint.com blog.checkpoint.com
1 static.captcha.awswaf.com a56a6a6f5963.f623b70f.eu-west-1.captcha.awswaf.com
static.captcha.awswaf.com
1 a56a6a6f5963.f623b70f.eu-west-1.captcha.awswaf.com blog.checkpoint.com
14 4

This site contains no links.

Subject Issuer Validity Valid
*.checkpoint.com
GlobalSign GCC R3 DV TLS CA 2020		 2024-05-30 -
2025-07-01		 a year crt.sh
*.f623b70f.eu-west-1.token.awswaf.com
Amazon RSA 2048 M02		 2023-09-05 -
2024-10-03		 a year crt.sh
*.f623b70f.eu-west-1.captcha.awswaf.com
Amazon RSA 2048 M01		 2023-09-06 -
2024-10-05		 a year crt.sh
static.captcha.awswaf.com
Amazon RSA 2048 M01		 2023-07-25 -
2024-08-22		 a year crt.sh

This page contains 1 frames:

Primary Page: https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/
Frame ID: 35BB301D4AFDD50F1695879D3E628647
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Human Verification

Page URL History Show full URLs

  1. https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/ Page URL
  2. https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/ Page URL

Page Statistics

14
Requests

86 %
HTTPS

0 %
IPv6

2
Domains

4
Subdomains

5
IPs

1
Countries

364 kB
Transfer

2317 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/ Page URL
  2. https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/ 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.154.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-154-70.muc50.r.cloudfront.net
Software
CloudFront /
Resource Hash
eb3ddb2d3553d6045cce41e86753dbfc0e80702a1b54cd1780dd8bb7ada1ba21

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-methods
OPTIONS,GET,POST
access-control-allow-origin
*
access-control-max-age
86400
cache-control
no-store, max-age=0
content-length
2080
content-type
text/html; charset=UTF-8
date
Fri, 21 Jun 2024 02:13:16 GMT
server
CloudFront
via
1.1 55965767fb32678a90a721ccc878aa86.cloudfront.net (CloudFront)
x-amz-cf-id
mfvenCpslgdMCqezbxz7Uu657C1s1f9rpQPtg5yGnrtxHfBepy736Q==
x-amz-cf-pop
MUC50-P3
x-amzn-waf-action
challenge
x-cache
Error from cloudfront
challenge.js
a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com/a56a6a6f5963/c3e8f71e82c9/928d8296191b/ 		1 MB
286 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com/a56a6a6f5963/c3e8f71e82c9/928d8296191b/challenge.js
Requested by
Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-34.muc50.r.cloudfront.net
Software
/
Resource Hash
48d65b9e5b80cb03fa6ce2023b38659945d8e985d5fb5182656438abc0758b0f

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.checkpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Fri, 21 Jun 2024 02:13:16 GMT
content-encoding
gzip
via
1.1 b2825f5e779aaa7a75e20fcfeee23920.cloudfront.net (CloudFront)
last-modified
Fri, 21 Jun 2024 02:13:16 +0000
x-amz-cf-pop
MUC50-P4
vary
Accept-Encoding
x-cache
Miss from cloudfront
x-amzn-waf-challenge-id
Root=1-6674e1bc-7627c1b04339da661c050947
content-type
text/javascript
cache-control
private, max-age=86400, stale-while-revalidate=604800
alt-svc
h3=":443"; ma=86400
x-amz-cf-id
xdIuZPEYyI_RY5m66P1qLMyk08Nfwb2-DZ7QHusa-oP-09_kkolsQg==
expires
0
favicon.ico
blog.checkpoint.com/ 		0
366 B 		Other
General
Check archive.org
Download Go to
Full URL
https://blog.checkpoint.com/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.154.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-154-70.muc50.r.cloudfront.net
Software
CloudFront /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 21 Jun 2024 02:13:16 GMT
via
1.1 55965767fb32678a90a721ccc878aa86.cloudfront.net (CloudFront)
server
CloudFront
x-amzn-waf-action
challenge
x-amz-cf-pop
MUC50-P3
access-control-max-age
86400
access-control-allow-methods
OPTIONS,GET,POST
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
x-cache
Error from cloudfront
cache-control
no-store, max-age=0
content-length
0
x-amz-cf-id
od5B-yRjNlemfvPNzjb6FJ693vmmfQwJds7LawVY348urPul4xbZMQ==
verify
a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com/a56a6a6f5963/c3e8f71e82c9/928d8296191b/ 		300 B
645 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com/a56a6a6f5963/c3e8f71e82c9/928d8296191b/verify
Requested by
Host: a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com
URL: https://a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com/a56a6a6f5963/c3e8f71e82c9/928d8296191b/challenge.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.173.187.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-34.muc50.r.cloudfront.net
Software
/
Resource Hash
60639025bccebf86dabe9b006ad789f4568c2fd83367983c5f7d7d2c147dd5b2

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://blog.checkpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 21 Jun 2024 02:13:17 GMT
via
1.1 86df4d22c97ec96360d46cef55fb5f2a.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-P4
access-control-max-age
86400
access-control-allow-methods
OPTIONS,GET,POST
content-type
application/json
access-control-allow-origin
*
x-cache
Miss from cloudfront
x-amzn-waf-challenge-id
Root=1-6674e1bd-20d31d68294a6b593b8a6725
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=86400
content-length
300
x-amz-cf-id
uRq1cyy5EZUAC4adHsFgFhaW8xukTATQ0lTYK8681ah48LcL9A-t4g==
expires
0
telemetry
a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com/a56a6a6f5963/c3e8f71e82c9/928d8296191b/ 		864 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com/a56a6a6f5963/c3e8f71e82c9/928d8296191b/telemetry
Requested by
Host: a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com
URL: https://a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com/a56a6a6f5963/c3e8f71e82c9/928d8296191b/challenge.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.173.187.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-34.muc50.r.cloudfront.net
Software
/
Resource Hash
ecf93e4275e2eb23b23945a637c67432b13cfc0c502b6b8a4f3b33764d25259f

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://blog.checkpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 21 Jun 2024 02:13:17 GMT
via
1.1 86df4d22c97ec96360d46cef55fb5f2a.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-P4
access-control-max-age
86400
access-control-allow-methods
OPTIONS,GET,POST
content-type
application/json
access-control-allow-origin
*
x-cache
Miss from cloudfront
x-amzn-waf-challenge-id
Root=1-6674e1bd-23b0b9f93207db2c33a5938d
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=86400
content-length
864
x-amz-cf-id
c2rOa6fOYx2yyDR1A9IbD1X3huRRSdT8g1G3IQf6vS91i_ojKBkXlA==
expires
0
Primary Request /
blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/ 		3 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/
Requested by
Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.154.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-154-70.muc50.r.cloudfront.net
Software
CloudFront /
Resource Hash
6d6efb068db89d38552c4c12bd7a55e111545f0f5e6f3796180e72f4d83c357d

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-methods
OPTIONS,GET,POST
access-control-allow-origin
*
access-control-max-age
86400
cache-control
no-store, max-age=0
content-length
2590
content-type
text/html; charset=UTF-8
date
Fri, 21 Jun 2024 02:13:17 GMT
server
CloudFront
via
1.1 55965767fb32678a90a721ccc878aa86.cloudfront.net (CloudFront)
x-amz-cf-id
4IBmGaE8SstVfToppxJm5uGaIp9noWp691VkDYQ-Tt-6O3TaYLOhdA==
x-amz-cf-pop
MUC50-P3
x-amzn-waf-action
captcha
x-cache
Error from cloudfront
challenge.js
a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com/a56a6a6f5963/c3e8f71e82c9/928d8296191b/ 		1 MB
400 B 		Script
General
Check archive.org
Download Go to
Full URL
https://a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com/a56a6a6f5963/c3e8f71e82c9/928d8296191b/challenge.js
Requested by
Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.187.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-34.muc50.r.cloudfront.net
Software
/
Resource Hash
48d65b9e5b80cb03fa6ce2023b38659945d8e985d5fb5182656438abc0758b0f

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.checkpoint.com/
If-Modified-Since
Fri, 21 Jun 2024 02:13:16 +0000
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Fri, 21 Jun 2024 02:13:18 GMT
via
1.1 b2825f5e779aaa7a75e20fcfeee23920.cloudfront.net (CloudFront)
last-modified
Fri, 21 Jun 2024 02:13:16 +0000
x-amz-cf-pop
MUC50-P4
vary
Accept-Encoding
x-cache
Miss from cloudfront
x-amzn-waf-challenge-id
Root=1-6674e1be-0ace7a723a4877215ed7324c
content-type
text/javascript
cache-control
private, max-age=86400, stale-while-revalidate=604800
alt-svc
h3=":443"; ma=86400
x-amz-cf-id
2SoYGMJ-eTh2eFc7ftqQju-dQv9CJO5zB_3Wcu4hueHnLR9IGIKGxg==
expires
0
captcha.js
a56a6a6f5963.f623b70f.eu-west-1.captcha.awswaf.com/a56a6a6f5963/c3e8f71e82c9/928d8296191b/ 		162 KB
65 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a56a6a6f5963.f623b70f.eu-west-1.captcha.awswaf.com/a56a6a6f5963/c3e8f71e82c9/928d8296191b/captcha.js
Requested by
Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.230.228.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-230-228-95.muc50.r.cloudfront.net
Software
/
Resource Hash
6d2e2db67ad40eb830e6ef3608617d65cd6d39e6d6fb41ecd4e0122749e75fb1

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.checkpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 21 Jun 2024 02:13:18 GMT
content-encoding
gzip
via
1.1 e876a7ec501bf47e275a943cac96c3fe.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-P5
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
text/javascript
x-amzn-waf-captcha-id
Root=1-6674e1be-40de823e1d662cc23145f400
alt-svc
h3=":443"; ma=86400
x-amz-cf-id
2UYnwv6uPHXfAlp3-S3-lVWQKVsIZFd3MyZOWZggUIofOyle8epjyQ==
stylesheet.css
static.captcha.awswaf.com/fonts/AmazonEmberLt/ 		230 B
591 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.captcha.awswaf.com/fonts/AmazonEmberLt/stylesheet.css
Requested by
Host: a56a6a6f5963.f623b70f.eu-west-1.captcha.awswaf.com
URL: https://a56a6a6f5963.f623b70f.eu-west-1.captcha.awswaf.com/a56a6a6f5963/c3e8f71e82c9/928d8296191b/captcha.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.36.3 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-36-3.muc50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2998d81cfd55c682823a732f696790f3745c3c1b394ca6701cc91dda9dc54516

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.checkpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 20 Jun 2024 07:00:27 GMT
via
1.1 902186b72e1ae6ba0d22c4a6abfcf004.cloudfront.net (CloudFront)
last-modified
Tue, 20 Feb 2024 19:30:14 GMT
server
AmazonS3
x-amz-cf-pop
MUC50-P2
age
69172
x-amz-server-side-encryption
AES256
etag
"d8674d16f372c9cdafa1314ef9710c64"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
accept-ranges
bytes
content-length
230
x-amz-cf-id
zb07nBQM49ckh2G8XFWyZFpr4m34UvGsOuu4A7hnJs6M_gtepyFL7w==
truncated
/ 		565 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3e2b5d869c820ae61b5603c4a05ac50f6a2d22a6a8a7a6637b9933e70291e32

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		253 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e02452d207cc5969d8c5ad8b19b35ab7d6f5800ca0ebd78a00aa944999ac0ee6

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		481 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5e5af7cbc4ba6d5e3c5b722393bcae96e599dfad2eca7de444a501e8a1a4a351

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
favicon.ico
blog.checkpoint.com/ 		3 KB
3 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://blog.checkpoint.com/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.154.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-154-70.muc50.r.cloudfront.net
Software
CloudFront /
Resource Hash
dc13dcc26812a7ac6a7a739e20a269d709b879a3967326efd7029a8f5dcaec89

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 21 Jun 2024 02:13:18 GMT
via
1.1 55965767fb32678a90a721ccc878aa86.cloudfront.net (CloudFront)
server
CloudFront
x-amzn-waf-action
captcha
x-amz-cf-pop
MUC50-P3
access-control-max-age
86400
access-control-allow-methods
OPTIONS,GET,POST
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
x-cache
Error from cloudfront
cache-control
no-store, max-age=0
content-length
2590
x-amz-cf-id
u9U6TXTy6vvDOFFlkoUpfZ5mXenmhFTTPi9uUD9sjzmlCLsP3xiTug==
AmazonEmber-Light.woff2
static.captcha.awswaf.com/fonts/AmazonEmberLt/ 		0
0
AmazonEmber-Light.woff
static.captcha.awswaf.com/fonts/AmazonEmberLt/ 		0
0
telemetry
a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com/a56a6a6f5963/c3e8f71e82c9/928d8296191b/ 		864 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com/a56a6a6f5963/c3e8f71e82c9/928d8296191b/telemetry
Requested by
Host: a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com
URL: https://a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com/a56a6a6f5963/c3e8f71e82c9/928d8296191b/challenge.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.173.187.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-34.muc50.r.cloudfront.net
Software
/
Resource Hash
110ad1293164af3d642b2d9cba9668bf5b77da5795738b7c994c3a926f4ccc9d

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://blog.checkpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 21 Jun 2024 02:13:18 GMT
via
1.1 86df4d22c97ec96360d46cef55fb5f2a.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-P4
access-control-max-age
86400
access-control-allow-methods
OPTIONS,GET,POST
content-type
application/json
access-control-allow-origin
*
x-cache
Miss from cloudfront
x-amzn-waf-challenge-id
Root=1-6674e1be-0f09cd15118d1d55665f722b
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=86400
content-length
864
x-amz-cf-id
v0MrN_4SfJV03a_Z4gQmCqAKIYLw3VIeIIS27VGSkEAAi2Q3_170NQ==
expires
0
telemetry
a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com/a56a6a6f5963/c3e8f71e82c9/928d8296191b/ 		952 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com/a56a6a6f5963/c3e8f71e82c9/928d8296191b/telemetry
Requested by
Host: a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com
URL: https://a56a6a6f5963.f623b70f.eu-west-1.token.awswaf.com/a56a6a6f5963/c3e8f71e82c9/928d8296191b/challenge.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.173.187.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-173-187-34.muc50.r.cloudfront.net
Software
/
Resource Hash
366175fe14b50213086dfaa33e1a54cd2e0865b1f72501ce3d35f307d432b72f

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://blog.checkpoint.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 21 Jun 2024 02:13:19 GMT
via
1.1 86df4d22c97ec96360d46cef55fb5f2a.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-P4
access-control-max-age
86400
access-control-allow-methods
OPTIONS,GET,POST
content-type
application/json
access-control-allow-origin
*
x-cache
Miss from cloudfront
x-amzn-waf-challenge-id
Root=1-6674e1bf-2aa4cd8e5e04e9a74a21c98f
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=86400
content-length
952
x-amz-cf-id
iHDtMi3YVlxFmkLcBEMgzmsP3HzSTitILjS_vmzx146Y6gYTaCh65w==
expires
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
static.captcha.awswaf.com
URL
https://static.captcha.awswaf.com/fonts/AmazonEmberLt/AmazonEmber-Light.woff2
Domain
static.captcha.awswaf.com
URL
https://static.captcha.awswaf.com/fonts/AmazonEmberLt/AmazonEmber-Light.woff

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage object| awsWafCookieDomainList object| gokuProps object| a2_0x3386 function| a2_0x3944 object| AwsWafIntegration object| ChallengeScript object| CaptchaScript

1 Cookies

Domain/Path Name / Value
.checkpoint.com/ Name: aws-waf-token
Value: fb79e82b-233c-485a-95e5-617cd1109431:CgoAdv8OgmozAAAA:BlEBvmlUaO33O4UjfmGYNZPhMVNh/5oE/uNcoSPOQ93fPpgUQpSphYAY+VJUDJduFpuoZQTXW97PpXovAwcPaiePwyqidN8qTFhOfLlfUQvMBMT4rA7469JR5iN5PE4+i5uYMrK2KHtvWmubPcQyPE5huAgonnHXWzPZr1XzOTzH0qcA1HVEjQ/AP/UN02R/2onADZH/z/MyhgCzr+GCkanbCyR0kg5dPZlRB0wNI2pxO10FzXq+T1dD9g2XRBTKu8A9RsWAt93v

6 Console Messages

Source Level URL
Text
network error URL: https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/
Message:
Failed to load resource: the server responded with a status of 405 ()
network error URL: https://blog.checkpoint.com/favicon.ico
Message:
Failed to load resource: the server responded with a status of 405 ()
javascript error URL: https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/
Message:
Access to font at 'https://static.captcha.awswaf.com/fonts/AmazonEmberLt/AmazonEmber-Light.woff2' from origin 'https://blog.checkpoint.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://static.captcha.awswaf.com/fonts/AmazonEmberLt/AmazonEmber-Light.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://blog.checkpoint.com/research/rafel-rat-android-malware-from-espionage-to-ransomware-operations/
Message:
Access to font at 'https://static.captcha.awswaf.com/fonts/AmazonEmberLt/AmazonEmber-Light.woff' from origin 'https://blog.checkpoint.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://static.captcha.awswaf.com/fonts/AmazonEmberLt/AmazonEmber-Light.woff
Message:
Failed to load resource: net::ERR_FAILED