research.checkpoint.com Open in urlscan Pro
2a02:26f0:6c00:19e::38f0 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://research.checkpoint.com/2019-resurgence-of-smokeloader/
Submission: On July 09 via api (July 9th 2019, 4:27:36 pm UTC) from US

Summary HTTP 55 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 11 IPs in 6 countries across 16 domains to perform 55 HTTP transactions. The main IP is 2a02:26f0:6c00:19e::38f0, located in Ascension Island and belongs to AKAMAI-ASN1, US. The main domain is research.checkpoint.com.
TLS certificate: Issued by DigiCert ECC Secure Server CA on October 29th 2018. Valid for: a year.

This is the only time research.checkpoint.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
27	2a02:26f0:6c0... 2a02:26f0:6c00:19e::38f0	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
8	23.37.56.8 23.37.56.8	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	2a00:1450:400... 2a00:1450:4001:81c::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
4	2a00:1450:400... 2a00:1450:4001:81a::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a02:26f0:10c... 2a02:26f0:10c:38f::3adf	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700::68... 2606:4700::6813:9308	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY - Fastly)
2 2	2a00:1450:400... 2a00:1450:400c:c07::9b	15169 (GOOGLE) (GOOGLE - Google LLC)
2 2	2a00:1450:400... 2a00:1450:4001:808::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:819::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
3	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK - Facebook)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK - Facebook)
55	11

27 2a02:26f0:6c00:19e::38f0 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

research.checkpoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 23.37.56.8 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-37-56-8.deploy.static.akamaitechnologies.com

sc1.checkpoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:81a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:10c:38f::3adf (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

sjs.bizographics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:9308 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c07::9b (Brussels, Belgium) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:819::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
35	checkpoint.com research.checkpoint.com sc1.checkpoint.com	3 MB
4	google-analytics.com www.google-analytics.com	39 KB
3	facebook.net connect.facebook.net	77 KB
2	facebook.com www.facebook.com	299 B
2	google.de www.google.de	483 B
2	google.com 2 redirects www.google.com	631 B
2	doubleclick.net 2 redirects stats.g.doubleclick.net	509 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	crazyegg.com script.crazyegg.com	4 KB
1	bizographics.com sjs.bizographics.com	5 KB
1	googletagmanager.com www.googletagmanager.com	35 KB
0	outbrain.com Failed amplify.outbrain.com Failed
0	t.co Failed t.co Failed
0	sharethis.com Failed platform-api.sharethis.com Failed
0	jquery.com Failed code.jquery.com Failed
0	fontawesome.com Failed use.fontawesome.com Failed
55	16

	Domain	Requested by
27	research.checkpoint.com	research.checkpoint.com
8	sc1.checkpoint.com	research.checkpoint.com
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com research.checkpoint.com
3	connect.facebook.net	research.checkpoint.com connect.facebook.net
2	www.facebook.com	research.checkpoint.com
2	www.google.de	research.checkpoint.com
2	www.google.com	2 redirects
2	stats.g.doubleclick.net	2 redirects
1	static.ads-twitter.com	www.googletagmanager.com
1	script.crazyegg.com	www.googletagmanager.com
1	sjs.bizographics.com	www.googletagmanager.com
1	www.googletagmanager.com	research.checkpoint.com
0	amplify.outbrain.com Failed	research.checkpoint.com
0	t.co Failed	research.checkpoint.com
0	platform-api.sharethis.com Failed	research.checkpoint.com
0	code.jquery.com Failed	research.checkpoint.com
0	use.fontawesome.com Failed	research.checkpoint.com
55	17

This site contains links to these domains. Also see Links.

Domain
www.checkpoint.com
www.facebook.com
plus.google.com
www.linkedin.com
twitter.com
threatemulation.checkpoint.com
www.cpcheckme.com
threatmap.checkpoint.com
blog.malwarebytes.com
www.crowdstrike.com

Subject Issuer	Validity	Valid
*.checkpoint.com DigiCert ECC Secure Server CA	`2018-10-29` - `2020-01-28`	a year	crt.sh
*.google-analytics.com Google Internet Authority G3	`2019-06-18` - `2019-09-10`	3 months	crt.sh
js.bizographics.com DigiCert SHA2 Secure Server CA	`2018-04-13` - `2020-04-17`	2 years	crt.sh
ssl945600.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2018-12-20` - `2019-09-18`	9 months	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2018-08-16` - `2019-08-21`	a year	crt.sh
www.google.de Google Internet Authority G3	`2019-06-18` - `2019-09-10`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2019-06-06` - `2019-09-04`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
Frame ID: 410B3F20D8B241B8D4366A01D66AAB20
Requests: 55 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /script\.crazyegg\.com\/pages\/scripts\/\d+\/\d+\.js/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Flickity (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/flickity(?:\.pkgd)?(?:\.min)?\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

html /googletagmanager\.com\/ns\.html[^>]+><\/iframe>/i
html //i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

55
Requests

91 %
HTTPS

83 %
IPv6

16
Domains

17
Subdomains

11
IPs

6
Countries

3455 kB
Transfer

4121 kB
Size

0
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://www.checkpoint.com/
Title: CheckPoint.com

Search URL Search Domain Scan URL

URL: https://www.facebook.com/checkpointsoftware

Search URL Search Domain Scan URL

URL: https://plus.google.com/+checkpoint/posts

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/check-point-software-technologies

Search URL Search Domain Scan URL

URL: https://twitter.com/_cpresearch_

Search URL Search Domain Scan URL

URL: https://threatemulation.checkpoint.com/
Title: SandBlast File Analysis

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/urlcat/
Title: URL Categorization

Search URL Search Domain Scan URL

URL: http://www.cpcheckme.com/checkme/
Title: Instant Security Assessment

Search URL Search Domain Scan URL

URL: https://threatmap.checkpoint.com/ThreatPortal/livemap.html
Title: Live Threat Map

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/support-services/threatcloud-incident-response/

Search URL Search Domain Scan URL

URL: https://blog.malwarebytes.com/threat-analysis/2018/03/hancitor-fileless-attack-with-a-copy-trick/
Title: MalwareBytes

Search URL Search Domain Scan URL

URL: https://www.crowdstrike.com/blog/through-window-creative-code-invocation/
Title: here

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 43

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j77&tid=UA-194688-1&cid=1396185160.1562689631&jid=109231008&gjid=1086678692&_gid=440810140.1562689631&_u=aGBAgEADQ~&z=744527316 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-1&cid=1396185160.1562689631&jid=109231008&_v=j77&z=744527316 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-1&cid=1396185160.1562689631&jid=109231008&_v=j77&z=744527316&slf_rd=1&random=2557892871

Request Chain 45

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j77&tid=UA-194688-3&cid=1396185160.1562689631&jid=7032538&gjid=1449092852&_gid=440810140.1562689631&_u=aGDAgEADQ~&z=2054031192 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-3&cid=1396185160.1562689631&jid=7032538&_v=j77&z=2054031192 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-3&cid=1396185160.1562689631&jid=7032538&_v=j77&z=2054031192&slf_rd=1&random=4045841630

55 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
research.checkpoint.com/2019-resurgence-of-smokeloader/ 35 KB
10 KB 54ms
8ms Document
text/html 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

a00b1e396712348afc9807014f50aebe521a702a11a0df178433395c51f3ecb8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Host: research.checkpoint.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: Apache
Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Link: <http://research.checkpoint.com/?p=21800>; rel=shortlink
Cache-Control: private, max-age=600, must-revalidate
Content-Type: text/html; charset=UTF-8
X-XSS-Protection: 1; mode=block
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Tue, 09 Jul 2019 16:27:00 GMT
Content-Length: 10186
Connection: keep-alive

GET
H/1.1 200
OK style.min.css
research.checkpoint.com/wp-includes/css/dist/block-library/ 29 KB
5 KB 18ms
6ms Stylesheet
text/css 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-includes/css/dist/block-library/style.min.css?ver=5.2.2

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Thu, 13 Jun 2019 20:38:04 GMT
Server: Apache
ETag: "726f-58b3a81b46300"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: text/css
Cache-Control: public,max-age=600000, must-revalidate
Date: Tue, 09 Jul 2019 16:27:00 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4767
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK style.css
research.checkpoint.com/wp-content/themes/research/ 16 KB
4 KB 18ms
6ms Stylesheet
text/css 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.16

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

f6dafbf3df2e63d4f82554dd65d1746c683caebcef703efc7ca6443e5822378f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 03 May 2019 18:11:59 GMT
Server: Apache
ETag: "40e9-587ffafc6b9c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: text/css
Cache-Control: public,max-age=600000, must-revalidate
Date: Tue, 09 Jul 2019 16:27:00 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4009
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK bootstrap.min.css
research.checkpoint.com/wp-content/themes/research/css/ 137 KB
21 KB 18ms
6ms Stylesheet
text/css 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/css/bootstrap.min.css?ver=4.1

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 27 Jul 2018 21:29:10 GMT
Server: Apache
ETag: "22485-57201cd647580"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: text/css
Cache-Control: public,max-age=600000, must-revalidate
Date: Tue, 09 Jul 2019 16:27:00 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 21024
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK flickity.min.css
research.checkpoint.com/wp-content/themes/research/css/ 2 KB
1 KB 88ms
75ms Stylesheet
text/css 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/css/flickity.min.css?ver=1.1

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

a8da941d8a446516c824ebc9fb77b42e6b92c6deed1daed266bd821ed27bc516

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 27 Jul 2018 21:29:10 GMT
Server: Apache
ETag: "71d-57201cd647580"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: text/css
Cache-Control: public,max-age=600000, must-revalidate
Date: Tue, 09 Jul 2019 16:27:00 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 648
X-XSS-Protection: 1; mode=block

GET all.css
use.fontawesome.com/releases/v5.6.3/css/ 0
0

GET jquery-3.4.0.min.js
code.jquery.com/ 0
0

GET
H/1.1 200
OK bootstrap.bundle.min.js Show response
research.checkpoint.com/wp-content/themes/research/js/lib/ 66 KB
19 KB 19ms
6ms Script
application/javascript 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/js/lib/bootstrap.bundle.min.js?ver=4.1

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

bb3d017273ed487674d9766d8401cf458228596adcc0c3a6024f44ae715090db

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 27 Jul 2018 21:29:12 GMT
Server: Apache
ETag: "1089e-57201cd82fa00"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: private, max-age=200000, must-revalidate
Date: Tue, 09 Jul 2019 16:27:00 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 19244
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK flickity.pkgd.min.js Show response
research.checkpoint.com/wp-content/themes/research/js/lib/ 54 KB
14 KB 26ms
6ms Script
application/javascript 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/js/lib/flickity.pkgd.min.js?ver=1.0.1

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

fe2df9f6df4b4a8d7174d259f563b8d9e28e4c03f8f4092fd9db6044e0e64c32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 27 Jul 2018 21:29:12 GMT
Server: Apache
ETag: "d7c9-57201cd82fa00"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: private, max-age=200000, must-revalidate
Date: Tue, 09 Jul 2019 16:27:00 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 13838
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK single-post.js Show response
research.checkpoint.com/wp-content/themes/research/js/ 397 B
719 B 59ms
39ms Script
application/javascript 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/js/single-post.js?ver=1.0.2

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

cbfee73101feaeb8d3fb0c18c79b5b0b953cdbd32549473339e742d96886b5a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Tue, 14 Aug 2018 07:21:35 GMT
Server: Apache
ETag: "18d-573600f577dc0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: private, max-age=200000, must-revalidate
Date: Tue, 09 Jul 2019 16:27:00 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 218
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK inc-header.js Show response
research.checkpoint.com/wp-content/themes/research/header/ 1 KB
956 B 26ms
6ms Script
application/javascript 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/header/inc-header.js?v=1.1

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

ae3754c54a0880a98a94c423d3e67f39b5b6f3c63516dafa33866e3e74c9f97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Thu, 15 Nov 2018 13:37:28 GMT
Server: Apache
ETag: "47a-57ab426d8d600"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: private, max-age=200000, must-revalidate
Date: Tue, 09 Jul 2019 16:27:00 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 455
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK style.css
research.checkpoint.com/wp-content/themes/research/header/ 9 KB
2 KB 19ms
6ms Stylesheet
text/css 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/header/style.css

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

0fe8bcbcd24ab838fbbd773001253fc0353956e81c5ba9c8e23951ebdbae305a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 27 Jul 2018 21:29:11 GMT
Server: Apache
ETag: "25cb-57201cd73b7c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: text/css
Cache-Control: public,max-age=600000, must-revalidate
Date: Tue, 09 Jul 2019 16:27:00 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1900
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK facebook.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 1 KB
2 KB 1219ms
22ms Image
image/gif 23.37.56.8
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/facebook.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.56.8 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-56-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 791d8c8cb135d3d53915096e999d3857b6ee16966c20a019f38699f09f6aa2ff

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 09 Jul 2019 16:27:01 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: Apache
ETag: "7eb7015574801089503dd7095e1d4313:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1254

GET
H/1.1 200
OK google-plus.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 2 KB
2 KB 1245ms
26ms Image
image/gif 23.37.56.8
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/google-plus.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.56.8 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-56-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 1998582382fbf956231d65be84b76e08c0c86e5ced8a99c703bdec416d876d76

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 09 Jul 2019 16:27:01 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: Apache
ETag: "eedd0b2cde10b6b1930d57a10c6d0422:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1653

GET
H/1.1 200
OK linkedin.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 1 KB
2 KB 153ms
57ms Image
image/gif 23.37.56.8
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/linkedin.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.56.8 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-56-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a22d6b8782097b7cd9588ab582e119bfd6290278275661e9d0f96b2baec0cb8e

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 09 Jul 2019 16:27:01 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: Apache
ETag: "6789b034de6591b26bbd9b5fa6b451ca:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1416

GET
H/1.1 200
OK email.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 1 KB
2 KB 169ms
52ms Image
image/gif 23.37.56.8
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/email.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.56.8 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-56-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 3643b2c826a615065303aa44b8f463eb854d77934f5f25dc1f74f60d4698f9f0

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 09 Jul 2019 16:27:01 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: Apache
ETag: "15f1e1004accdbc019365e658249f334:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1407

GET
H/1.1 200
OK rss.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 2 KB
2 KB 169ms
58ms Image
image/gif 23.37.56.8
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/rss.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.56.8 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-56-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b7cfb1c9430d90b22b3f4497543a4cfef719dc40a3cce130cad766171abe8bbe

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 09 Jul 2019 16:27:02 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: Apache
ETag: "8cc18e3677ea53cc679e33e82bf9497a:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1620

GET
H/1.1 200
OK twitter.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 2 KB
2 KB 165ms
63ms Image
image/gif 23.37.56.8
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/twitter.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.56.8 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-56-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a59bba774218f207179b30aa8bbd21bad0f7355a52321e08138bd77a308c27d5

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 09 Jul 2019 16:27:02 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: Apache
ETag: "6b05f4fc9522afa0cdbeb1a2c0bccc2c:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1608

GET
H/1.1 200
OK check-point-research-logo.gif
sc1.checkpoint.com/sc1/inc/html/images/ 3 KB
3 KB 399ms
51ms Image
image/gif 23.37.56.8
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/check-point-research-logo.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.56.8 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-56-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 09 Jul 2019 16:27:02 GMT
Last-Modified: Mon, 09 Jul 2018 21:15:16 GMT
Server: Apache
ETag: "c425f4400a5c9dfbaecb24275f494931:1531172224"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2901

GET
H/1.1 200
OK under-attack.gif
research.checkpoint.com/wp-content/themes/research/img/lib/ 2 KB
2 KB 8ms
7ms Image
image/gif 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/themes/research/img/lib/under-attack.gif

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

fab08b60fa81a228f3dd0eb7678669844a4de6a1fd68683a28df73007fd74efa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 27 Jul 2018 21:29:12 GMT
Server: Apache
ETag: "682-57201cd82fa00"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/gif
Cache-Control: public,max-age=2500000
Date: Tue, 09 Jul 2019 16:27:02 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1666
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK SmokeLoader_blog_1021x580.jpg
research.checkpoint.com/wp-content/uploads/2019/07/ 289 KB
289 KB 16ms
16ms Image
image/jpeg 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/07/SmokeLoader_blog_1021x580.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

3ce11dc6605bd345ea83f24d8a0326681582846b648acce931c12757b2a09fd2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Tue, 09 Jul 2019 12:58:43 GMT
Server: Apache
ETag: "4820a-58d3f1ed0a6c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Tue, 09 Jul 2019 16:27:02 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 295434
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig2.png
research.checkpoint.com/wp-content/uploads/2019/07/ 17 KB
17 KB 7ms
6ms Image
image/png 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/07/fig2.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

b8ebd0e164afd0e22cd53e1e5926f033a5375f0336bced0b6af8bce729a7015d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Tue, 09 Jul 2019 13:01:50 GMT
Server: Apache
ETag: "4357-58d3f29f60b80"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Tue, 09 Jul 2019 16:27:02 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 17239
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig1.png
research.checkpoint.com/wp-content/uploads/2019/07/ 17 KB
17 KB 6ms
6ms Image
image/png 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/07/fig1.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

d31c693dc8892f3fea965352a665379df2f4ecf95d826871cf27b93232c7c4c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Tue, 09 Jul 2019 13:01:49 GMT
Server: Apache
ETag: "4298-58d3f29e6c940"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Tue, 09 Jul 2019 16:27:02 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 17048
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig3.png
research.checkpoint.com/wp-content/uploads/2019/07/ 7 KB
8 KB 21ms
20ms Image
image/png 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/07/fig3.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

6d667001121d193ac53dd2a86e61db98685f41d6778a630d4da9c6d4b9df3524

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Tue, 09 Jul 2019 13:03:08 GMT
Server: Apache
ETag: "1da1-58d3f2e9c3b00"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Tue, 09 Jul 2019 16:27:02 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7585
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig4.png
research.checkpoint.com/wp-content/uploads/2019/07/ 39 KB
40 KB 6ms
6ms Image
image/png 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/07/fig4.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

d616bba3c8bf460fb3dfd0860ad6e13fc70ab0acd9d19e469dd4ee686e69aae9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Tue, 09 Jul 2019 13:03:42 GMT
Server: Apache
ETag: "9dc7-58d3f30a30780"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Tue, 09 Jul 2019 16:27:02 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 40391
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig5.png
research.checkpoint.com/wp-content/uploads/2019/07/ 25 KB
25 KB 7ms
7ms Image
image/png 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/07/fig5.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

89943a24f7bbf68a366e46ef4919e1e22fb11ae90d942e0c0617e266dde8b7bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Tue, 09 Jul 2019 13:04:24 GMT
Server: Apache
ETag: "644f-58d3f3323e600"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Tue, 09 Jul 2019 16:27:02 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 25679
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig6.png
research.checkpoint.com/wp-content/uploads/2019/07/ 27 KB
27 KB 7ms
7ms Image
image/png 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/07/fig6.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

654064783604628a1e528d8be37ea178a54ee5a62123c2faa5337237f458ac12

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Tue, 09 Jul 2019 13:04:47 GMT
Server: Apache
ETag: "6b18-58d3f3482d9c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Tue, 09 Jul 2019 16:27:02 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 27416
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig7.jpg
research.checkpoint.com/wp-content/uploads/2019/07/ 89 KB
90 KB 29ms
29ms Image
image/jpeg 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/07/fig7.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

7a60b63396ba15f17e29e69689f58189f17e2f8e67c9fada552a7d52e89069a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Tue, 09 Jul 2019 13:05:46 GMT
Server: Apache
ETag: "16474-58d3f38071e80"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Tue, 09 Jul 2019 16:27:02 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 91252
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig8.png
research.checkpoint.com/wp-content/uploads/2019/07/ 214 KB
215 KB 6ms
6ms Image
image/png 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/07/fig8.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

52a3eb79c4ed54eb646bed42a3cef60dfa633d7aa6c9640002e746578d7d6007

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Tue, 09 Jul 2019 13:07:09 GMT
Server: Apache
ETag: "359d5-58d3f3cf99940"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Tue, 09 Jul 2019 16:27:02 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 219605
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK Blog_Lybia.jpg
research.checkpoint.com/wp-content/uploads/2019/06/ 385 KB
385 KB 7ms
7ms Image
image/jpeg 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/06/Blog_Lybia.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

a65b41973876134cd36fa91f80ce088e3f00ef0f1d09eb9c207b511592ef310d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Sun, 30 Jun 2019 11:29:19 GMT
Server: Apache
ETag: "6035c-58c88d28621c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Tue, 09 Jul 2019 16:27:02 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 394076
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK LibraryVulnerable_blog_1021x580.jpg
research.checkpoint.com/wp-content/uploads/2019/05/ 143 KB
143 KB 53ms
53ms Image
image/jpeg 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/05/LibraryVulnerable_blog_1021x580.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

d35f570e9ce4b511720ec6c3c7d8554494f7f093ec5363f949506589b2b0adb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Thu, 16 May 2019 10:00:52 GMT
Server: Apache
ETag: "23adc-588fe5757dd00"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Tue, 09 Jul 2019 16:27:02 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 146140
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK Data_Breaches.jpg
research.checkpoint.com/wp-content/uploads/2019/04/ 751 KB
751 KB 29ms
27ms Image
image/jpeg 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/Data_Breaches.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

eca3bafa27f8254899afa47d2a9a8bab1c39ac971143c79227332de19dff11f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Tue, 30 Apr 2019 07:51:10 GMT
Server: Apache
ETag: "bba6e-587baaa09f780"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Tue, 09 Jul 2019 16:27:02 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 768622
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK Data_Breaches.jpg
research.checkpoint.com/wp-content/uploads/2019/03/ 751 KB
751 KB 7ms
6ms Image
image/jpeg 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/03/Data_Breaches.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

eca3bafa27f8254899afa47d2a9a8bab1c39ac971143c79227332de19dff11f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Thu, 07 Mar 2019 09:18:27 GMT
Server: Apache
ETag: "bba6e-5837d96c1fec0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Tue, 09 Jul 2019 16:27:03 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 768622
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK EAgames_blog_1021x580.jpg
research.checkpoint.com/wp-content/uploads/2019/06/ 246 KB
246 KB 18ms
18ms Image
image/jpeg 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/06/EAgames_blog_1021x580.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

6365ed729f3c41dadd65ee223ad6d0584e40829ba39d7475e1ee1e2058367349

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Thu, 06 Jun 2019 11:44:13 GMT
Server: Apache
ETag: "3d7ab-58aa63b9e7d40"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Tue, 09 Jul 2019 16:27:03 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 251819
X-XSS-Protection: 1; mode=block

GET sharethis.js
platform-api.sharethis.com/js/ 0
0

GET
H/1.1 200
OK CfP_1021x580_A.jpg
research.checkpoint.com/wp-content/uploads/2018/11/ 132 KB
132 KB 7ms
7ms Image
image/jpeg 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2018/11/CfP_1021x580_A.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

9a6f22e2d9bba0601021ffb3fb8e484336fdd3041f6675f900ffc8c320091f06

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 02 Nov 2018 21:13:47 GMT
Server: Apache
ETag: "20f44-579b502d358c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Tue, 09 Jul 2019 16:27:03 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 134980
X-XSS-Protection: 1; mode=block

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 157 KB
35 KB 30ms
18ms Script
application/javascript 2a00:1450:4001:81c::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8d82cc35dceedba5745683abef222457f940b8f70dcb818a7b90386331e13674

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 09 Jul 2019 16:27:03 GMT
content-encoding: br
last-modified: Tue, 09 Jul 2019 15:00:00 GMT
server: Google Tag Manager
access-control-allow-origin: http://www.googletagmanager.com
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-length: 35533
x-xss-protection: 0
expires: Tue, 09 Jul 2019 16:27:03 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
18 KB 17ms
6ms Script
text/javascript 2a00:1450:4001:81a::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a4883cce814b6793c5bd6dd3639d6048ecab39a93a90b560d39a9fd0aff6e263

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 20 Jun 2019 21:35:04 GMT
server: Golfe2
age: 5995
date: Tue, 09 Jul 2019 14:47:08 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 17707
expires: Tue, 09 Jul 2019 16:47:08 GMT

GET
H/1.1 200
OK insight.min.js Show response
sjs.bizographics.com/ 15 KB
5 KB 27ms
9ms Script
application/x-javascript 2a02:26f0:10c:38f::3adf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sjs.bizographics.com/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:38f::3adf , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 09 Jul 2019 16:27:03 GMT
Content-Encoding: gzip
Last-Modified: Mon, 03 Dec 2018 23:03:30 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=14650
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4571

GET
H2 200 7614.js Show response
script.crazyegg.com/pages/scripts/0041/ 9 KB
4 KB 29ms
15ms Script
application/x-javascript 2606:4700::6813:9308
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0041/7614.js?434080
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d6d34271ad91b122370d33b078dc38b94ccce64883ae0a70c0b22afdd780779

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 09 Jul 2019 16:27:03 GMT
via: 1.1 f2db75b601dc30df73b1beb29596a375.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 8079
cf-polished: origSize=9549
x-cache: Miss from cloudfront
status: 200
content-encoding: gzip
last-modified: Tue, 02 Jul 2019 22:43:39 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: private, max-age=300
x-amz-cf-pop: FRA53-C1
cf-ray: 4f3ba9c0ee3c6431-FRA
x-amz-cf-id: XTN3WGl0fLSYE9FVpf-hIp7hzeeAZItXGJonwoogi8yMInwftPoHrQ==
cf-bgj: minify

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 7629ms
42ms Script
application/javascript 151.101.12.157
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 09 Jul 2019 16:27:10 GMT
content-encoding: gzip
age: 3811
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-fra19166-FRA
last-modified: Tue, 23 Jan 2018 19:05:33 GMT
x-timer: S1562689631.817546,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 js Show response
www.google-analytics.com/gtm/ 54 KB
21 KB 20ms
20ms Script
application/javascript 2a00:1450:4001:81a::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=GTM-5L6CQT3&t=gtm1&cid=1496067594.1562689623

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0b33ddc3d54832b0b2316544063064b01b4f8bec013ba32b55327318a18cc4b5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 09 Jul 2019 16:27:10 GMT
content-encoding: br
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
server: Google Tag Manager
access-control-allow-origin: http://www.googletagmanager.com
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-length: 20901
x-xss-protection: 0
expires: Tue, 09 Jul 2019 16:27:10 GMT

GET adsct
t.co/i/ 0
0

GET
H2 200 collect
www.google-analytics.com/ 35 B
93 B 8ms
7ms Image
image/gif 2a00:1450:4001:81a::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j77&a=1512289029&t=pageview&_s=1&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2019-resurgence-of-smokeloader%2F&ul=en-us&de=UTF-8&dt=The%202019%20Resurgence%20of%20Smokeloader%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAgEADQ~&jid=109231008&gjid=1086678692&cid=1396185160.1562689631&tid=UA-194688-1&_gid=440810140.1562689631&gtm=2wg6k25JCRGP&z=655909422

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Jul 2019 01:58:00 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 52151
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j77&tid=UA-194688-1&cid=1396185160.1562689631&jid=109231008&gjid=1086678692&_gid=440810140.1562689631&_u=aGBAgEADQ~&z=744527316
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-1&cid=1396185160.1562689631&jid=109231008&_v=j77&z=744527316
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-1&cid=1396185160.1562689631&jid=109231008&_v=j77&z=744527316&slf_rd=1&random=2557892871

42 B
109 B

45ms
33ms

Image
image/gif

2a00:1450:4001:819::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-1&cid=1396185160.1562689631&jid=109231008&_v=j77&z=744527316&slf_rd=1&random=2557892871

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Jul 2019 16:27:11 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 09 Jul 2019 16:27:11 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-1&cid=1396185160.1562689631&jid=109231008&_v=j77&z=744527316&slf_rd=1&random=2557892871
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
196 B 8ms
6ms Image
image/gif 2a00:1450:4001:81a::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j77&a=1512289029&t=pageview&_s=1&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2019-resurgence-of-smokeloader%2F&ul=en-us&de=UTF-8&dt=The%202019%20Resurgence%20of%20Smokeloader%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAgEADQ~&jid=7032538&gjid=1449092852&cid=1396185160.1562689631&tid=UA-194688-3&_gid=440810140.1562689631&gtm=2wg6k25JCRGP&z=1297043719

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Jul 2019 01:58:00 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 52151
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j77&tid=UA-194688-3&cid=1396185160.1562689631&jid=7032538&gjid=1449092852&_gid=440810140.1562689631&_u=aGDAgEADQ~&z=2054031192
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-3&cid=1396185160.1562689631&jid=7032538&_v=j77&z=2054031192
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-3&cid=1396185160.1562689631&jid=7032538&_v=j77&z=2054031192&slf_rd=1&random=4045841630

42 B
374 B

47ms
32ms

Image
image/gif

2a00:1450:4001:819::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-3&cid=1396185160.1562689631&jid=7032538&_v=j77&z=2054031192&slf_rd=1&random=4045841630

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Jul 2019 16:27:11 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 09 Jul 2019 16:27:11 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-3&cid=1396185160.1562689631&jid=7032538&_v=j77&z=2054031192&slf_rd=1&random=4045841630
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK search-icon.gif
sc1.checkpoint.com/sc1/inc/html/images/ 2 KB
2 KB 25ms
25ms Image
image/gif 23.37.56.8
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/search-icon.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.56.8 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-56-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 953d6908ab55929254e46c77e5c751a6e2df7ab84430f134edc3bb62d8f7d32f

Request headers

Referer: https://research.checkpoint.com/wp-content/themes/research/header/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 09 Jul 2019 16:27:11 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: Apache
ETag: "2e1aa25e7e77e6a393fd38efb413370f:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1755

GET
H/1.1 200
OK 34CA47_6_0.woff2
research.checkpoint.com/wp-content/themes/research/fonts/ 58 KB
59 KB 133ms
133ms Font
application/octet-stream 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/fonts/34CA47_6_0.woff2

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

0fc686423c26cb1030032fd7e4f2dd664c4b08517a8990c0b46269dd4e01910b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.16
Origin: https://research.checkpoint.com

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 07 Jan 2019 16:17:09 GMT
Server: Apache
ETag: "e890-57ee08f822b40"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Cache-Control: max-age=86400
Date: Tue, 09 Jul 2019 16:27:11 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 59536
X-XSS-Protection: 1; mode=block
Expires: Wed, 10 Jul 2019 16:27:11 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 53 KB
16 KB 20ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

657f79c4d5a6ea502202651151811d195b49cf9cf22fd7f8edaeefe2f8cc8fc4

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Origin, Accept-Encoding
content-length: 16120
x-xss-protection: 0
pragma: public
x-fb-debug: YWSNfhqh7CWrCataQdkgzQMYip5l3pnhUMef9KJcdZshYWzHWYtA0bOQJxNdDvILrOPT2yZXu+vscFZWh58kWA==
x-fb-trip-id: 997090344
date: Tue, 09 Jul 2019 16:27:11 GMT
x-frame-options: DENY
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: public, max-age=1200
access-control-allow-credentials: true
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET obtp.js
amplify.outbrain.com/cp/ 0
0

GET
H2 200 1692853834349189 Show response
connect.facebook.net/signals/config/ 228 KB
60 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1692853834349189?v=2.8.51&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

6d446e1c249cf13d05ac801a75d6d42fe09b185b81e20ddb10b885474b57c3b6

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Origin, Accept-Encoding
content-length: 61415
x-xss-protection: 0
pragma: public
x-fb-debug: 11hLXwreOW+Mc8D74dF253G6f81dJuENP/5LdBNVX5v37Ywjp6o164A7m4YvwsErQu1jTBak+Q3rGWpPiaZgaQ==
x-fb-trip-id: 997090344
date: Tue, 09 Jul 2019 16:27:11 GMT
x-frame-options: DENY
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: public, max-age=1200
access-control-allow-credentials: true
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 inferredEvents.js Show response
connect.facebook.net/signals/plugins/ 1 KB
898 B 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/plugins/inferredEvents.js?v=2.8.51

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

cd1c301a8e7960a1786e2a959226b0b78b56dbea284bd114265f1662d6ca280e

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Origin, Accept-Encoding
content-length: 772
x-xss-protection: 0
pragma: public
x-fb-debug: 4n1WkNRAkn8i1pGZUqzUWzz6WzdmypDb8s6z+5UQAdAszp9d9W52RYhEzKFQQcpBKDmJW1kGnKyjvEoSH7b0MQ==
x-fb-trip-id: 997090344
date: Tue, 09 Jul 2019 16:27:11 GMT
x-frame-options: DENY
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: public, max-age=1200
access-control-allow-credentials: true
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
200 B 8ms
7ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1692853834349189&ev=PageView&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2019-resurgence-of-smokeloader%2F&rl=&if=false&ts=1562689631214&sw=1600&sh=1200&v=2.8.51&r=stable&ec=0&o=30&fbp=fb.1.1562689631202.978966647&it=1562689631179&coo=false&rqm=GET

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 09 Jul 2019 16:27:11 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Tue, 09 Jul 2019 16:27:11 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
99 B 7ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1692853834349189&ev=Microdata&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2019-resurgence-of-smokeloader%2F&rl=&if=false&ts=1562689631716&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22The%202019%20Resurgence%20of%20Smokeloader%20-%20Check%20Point%20Research%22%2C%22meta%3Adescription%22%3A%22Latest%20Research%20by%20our%20Team%22%7D&cd[OpenGraph]=%7B%22og%3Alocale%22%3A%22en_US%22%2C%22og%3Atype%22%3A%22article%22%2C%22og%3Atitle%22%3A%22The%202019%20Resurgence%20of%20Smokeloader%20-%20Check%20Point%20Research%22%2C%22og%3Adescription%22%3A%22A%20View%20into%20New%20Nasty%20Tricks%20and%20Actor%20Activity%20Research%20By%3A%20Israel%20Gubi%20%C2%A0%20Background%20Smokeloader%20is%20a%20popular%20bot%20and%20a%20veteran%20in%20its%20field%20%E2%80%93%20being%20sold%20on%20underground%20cybercriminal%20markets%20since%202011%2C%20this%20piece%20of%20malware%20is%20used%20mainly%20for%20loading%20other%20malicious%20software%2C%20usually%20obtained%20from%20a%20third%20party.%20At%20the...%20Click%20to%20Read%20More%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fresearch.checkpoint.com%2F2019-resurgence-of-smokeloader%2F%22%2C%22og%3Asite_name%22%3A%22Check%20Point%20Research%22%2C%22article%3Asection%22%3A%22Check%20Point%20Research%20Publications%22%2C%22article%3Apublished_time%22%3A%222019-07-09T13%3A19%3A34%2B00%3A00%22%2C%22article%3Amodified_time%22%3A%222019-07-09T13%3A21%3A46%2B00%3A00%22%2C%22og%3Aupdated_time%22%3A%222019-07-09T13%3A21%3A46%2B00%3A00%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fresearch.checkpoint.com%2Fwp-content%2Fuploads%2F2019%2F07%2FSmokeLoader_blog_1021x580.jpg%22%2C%22og%3Aimage%3Asecure_url%22%3A%22https%3A%2F%2Fresearch.checkpoint.com%2Fwp-content%2Fuploads%2F2019%2F07%2FSmokeLoader_blog_1021x580.jpg%22%2C%22og%3Aimage%3Awidth%22%3A%221021%22%2C%22og%3Aimage%3Aheight%22%3A%22580%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.8.51&r=stable&ec=1&o=30&fbp=fb.1.1562689631202.978966647&it=1562689631179&coo=false&es=automatic&rqm=GET

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2019-resurgence-of-smokeloader/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://research.checkpoint.com/2019-resurgence-of-smokeloader/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 09 Jul 2019 16:27:11 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Tue, 09 Jul 2019 16:27:11 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.6.3/css/all.css?ver=5.6.3

Domain: code.jquery.com
URL: https://code.jquery.com/jquery-3.4.0.min.js?ver=5.2.2

Domain: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Domain: t.co
URL: https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nxi3o&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Domain: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Verdicts & Comments Add Verdict or Comment

38 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amplify.outbrain.com
code.jquery.com
connect.facebook.net
platform-api.sharethis.com
research.checkpoint.com
sc1.checkpoint.com
script.crazyegg.com
sjs.bizographics.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
use.fontawesome.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
amplify.outbrain.com
code.jquery.com
platform-api.sharethis.com
t.co
use.fontawesome.com
151.101.12.157
23.37.56.8
2606:4700::6813:9308
2a00:1450:4001:808::2004
2a00:1450:4001:819::2003
2a00:1450:4001:81a::200e
2a00:1450:4001:81c::2008
2a00:1450:400c:c07::9b
2a02:26f0:10c:38f::3adf
2a02:26f0:6c00:19e::38f0
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
0b33ddc3d54832b0b2316544063064b01b4f8bec013ba32b55327318a18cc4b5
0fc686423c26cb1030032fd7e4f2dd664c4b08517a8990c0b46269dd4e01910b
0fe8bcbcd24ab838fbbd773001253fc0353956e81c5ba9c8e23951ebdbae305a
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1998582382fbf956231d65be84b76e08c0c86e5ced8a99c703bdec416d876d76
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255
3643b2c826a615065303aa44b8f463eb854d77934f5f25dc1f74f60d4698f9f0
3ce11dc6605bd345ea83f24d8a0326681582846b648acce931c12757b2a09fd2
4b8fe5c3d0e5ef7a6582185cbf5c535b5d369c8df1da98c03ed69833e55f474d
4d6d34271ad91b122370d33b078dc38b94ccce64883ae0a70c0b22afdd780779
52a3eb79c4ed54eb646bed42a3cef60dfa633d7aa6c9640002e746578d7d6007
6365ed729f3c41dadd65ee223ad6d0584e40829ba39d7475e1ee1e2058367349
654064783604628a1e528d8be37ea178a54ee5a62123c2faa5337237f458ac12
657f79c4d5a6ea502202651151811d195b49cf9cf22fd7f8edaeefe2f8cc8fc4
6d446e1c249cf13d05ac801a75d6d42fe09b185b81e20ddb10b885474b57c3b6
6d667001121d193ac53dd2a86e61db98685f41d6778a630d4da9c6d4b9df3524
791d8c8cb135d3d53915096e999d3857b6ee16966c20a019f38699f09f6aa2ff
7a60b63396ba15f17e29e69689f58189f17e2f8e67c9fada552a7d52e89069a3
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
89943a24f7bbf68a366e46ef4919e1e22fb11ae90d942e0c0617e266dde8b7bc
8d82cc35dceedba5745683abef222457f940b8f70dcb818a7b90386331e13674
953d6908ab55929254e46c77e5c751a6e2df7ab84430f134edc3bb62d8f7d32f
9a6f22e2d9bba0601021ffb3fb8e484336fdd3041f6675f900ffc8c320091f06
a00b1e396712348afc9807014f50aebe521a702a11a0df178433395c51f3ecb8
a22d6b8782097b7cd9588ab582e119bfd6290278275661e9d0f96b2baec0cb8e
a4883cce814b6793c5bd6dd3639d6048ecab39a93a90b560d39a9fd0aff6e263
a59bba774218f207179b30aa8bbd21bad0f7355a52321e08138bd77a308c27d5
a65b41973876134cd36fa91f80ce088e3f00ef0f1d09eb9c207b511592ef310d
a8da941d8a446516c824ebc9fb77b42e6b92c6deed1daed266bd821ed27bc516
ae3754c54a0880a98a94c423d3e67f39b5b6f3c63516dafa33866e3e74c9f97d
b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242
b7cfb1c9430d90b22b3f4497543a4cfef719dc40a3cce130cad766171abe8bbe
b8ebd0e164afd0e22cd53e1e5926f033a5375f0336bced0b6af8bce729a7015d
bb3d017273ed487674d9766d8401cf458228596adcc0c3a6024f44ae715090db
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b
cbfee73101feaeb8d3fb0c18c79b5b0b953cdbd32549473339e742d96886b5a9
cd1c301a8e7960a1786e2a959226b0b78b56dbea284bd114265f1662d6ca280e
d31c693dc8892f3fea965352a665379df2f4ecf95d826871cf27b93232c7c4c8
d35f570e9ce4b511720ec6c3c7d8554494f7f093ec5363f949506589b2b0adb0
d616bba3c8bf460fb3dfd0860ad6e13fc70ab0acd9d19e469dd4ee686e69aae9
eca3bafa27f8254899afa47d2a9a8bab1c39ac971143c79227332de19dff11f0
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f6dafbf3df2e63d4f82554dd65d1746c683caebcef703efc7ca6443e5822378f
fab08b60fa81a228f3dd0eb7678669844a4de6a1fd68683a28df73007fd74efa
fe2df9f6df4b4a8d7174d259f563b8d9e28e4c03f8f4092fd9db6044e0e64c32

research.checkpoint.com Open in urlscan Pro 2a02:26f0:6c00:19e::38f0 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

55 Requests

91 %HTTPS

83 %IPv6

16 Domains

17 Subdomains

11 IPs

6 Countries

3455 kBTransfer

4121 kBSize

0 Cookies

12 Outgoing links

Redirected requests

55 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

research.checkpoint.com Open in urlscan Pro
2a02:26f0:6c00:19e::38f0 Public Scan

Screenshot
Live screenshot

Full Image

55
Requests

91 %
HTTPS

83 %
IPv6

16
Domains

17
Subdomains

11
IPs

6
Countries

3455 kB
Transfer

4121 kB
Size

0
Cookies

55 HTTP transactions
0 data transactions