urlscan.io logo urlscan.io
SecurityTrails logo

research.checkpoint.com Open in urlscan Pro
141.193.213.21  Public Scan

Go To Rescan Add Verdict Report
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-a...
Submission: On September 10 via api from DE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 32 IPs in 6 countries across 25 domains to perform 94 HTTP transactions. The main IP is 141.193.213.21, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is research.checkpoint.com.
TLS certificate: Issued by R3 on July 6th 2022. Valid for: 3 months.
This is the only time research.checkpoint.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
21 141.193.213.21 209242 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2001:4de0:ac1... 20446 (STACKPATH...)
1 2a00:1450:400... 15169 (GOOGLE)
8 104.122.24.32 16625 (AKAMAI-AS)
1 13.32.99.34 16509 (AMAZON-02)
5 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:206... 16509 (AMAZON-02)
1 3.127.1.244 16509 (AMAZON-02)
9 104.91.4.216 16625 (AKAMAI-AS)
3 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2001:4860:480... 15169 (GOOGLE)
1 37.252.173.38 29990 (ASN-APPNEX)
1 2a02:26f0:10e... 20940 (AKAMAI-ASN1)
1 199.232.136.157 54113 (FASTLY)
2 104.96.148.88 16625 (AKAMAI-AS)
2 2a03:2880:f08... 32934 (FACEBOOK)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
10 2600:9000:21f... 16509 (AMAZON-02)
3 3 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 192.28.144.124 15224 (OMNITURE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 18.195.70.228 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a03:2880:f10... 32934 (FACEBOOK)
1 104.244.42.197 13414 (TWITTER)
1 104.244.42.3 13414 (TWITTER)
2 18.66.122.15 16509 (AMAZON-02)
7 54.208.178.119 14618 (AMAZON-AES)
94 32
21    141.193.213.21 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)
research.checkpoint.com
1    2606:4700:3032::ac43:a9f7 (United States)

ASN13335 (CLOUDFLARENET, US)
use.fontawesome.com
1    2001:4de0:ac18::1:a:2a (Netherlands)

ASN20446 (STACKPATH-CDN, US)
code.jquery.com
1    2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
8    104.122.24.32 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-122-24-32.deploy.static.akamaitechnologies.com
sc1.checkpoint.com
1    13.32.99.34 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-34.fra60.r.cloudfront.net
platform-api.sharethis.com
5    2606:4700::6812:e234 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.onesignal.com
onesignal.com
img.onesignal.com
2    2a00:1450:4001:82a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2600:9000:206e:c200:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)
buttons-config.sharethis.com
1    3.127.1.244 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-127-1-244.eu-central-1.compute.amazonaws.com
l.sharethis.com
9    104.91.4.216 (Milan, Italy)

ASN16625 (AKAMAI-AS, US)
PTR: a104-91-4-216.deploy.static.akamaitechnologies.com
j.6sc.co
c.6sc.co
b.6sc.co
3    2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2a00:1450:400c:c07::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
1    37.252.173.38 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
secure.adnxs.com
1    2a02:26f0:10e::6860:5bba (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)
snap.licdn.com
1    199.232.136.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
static.ads-twitter.com
2    104.96.148.88 (Vienna, Austria)

ASN16625 (AKAMAI-AS, US)
PTR: a104-96-148-88.deploy.static.akamaitechnologies.com
munchkin.marketo.net
2    2a03:2880:f080:9:face:b00c:0:3 (Amsterdam, Netherlands)

ASN32934 (FACEBOOK, US)
connect.facebook.net
1    2a00:1450:4001:806::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
10    2600:9000:21fa:5000:1d:85c3:6640:93a1 (United States)

ASN16509 (AMAZON-02, US)
platform-cdn.sharethis.com
3    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
www.linkedin.com
1    13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px4.ads.linkedin.com
1    192.28.144.124 (United States)

ASN15224 (OMNITURE, US)
750-dqh-528.mktoresp.com
1    2606:4700::6812:e134 (United States)

ASN13335 (CLOUDFLARENET, US)
onesignal.com
2    18.195.70.228 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-70-228.eu-central-1.compute.amazonaws.com
epsilon.6sense.com
1    2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
2    2a03:2880:f107:83:face:b00c:0:25de (Vienna, Austria)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    104.244.42.197 (United States)

ASN13414 (TWITTER, US)
t.co
1    104.244.42.3 (United States)

ASN13414 (TWITTER, US)
analytics.twitter.com
2    18.66.122.15 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-15.fra60.r.cloudfront.net
assets.trendemon.com
7    54.208.178.119 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-208-178-119.compute-1.amazonaws.com
trackingapi.trendemon.com
Apex Domain
Subdomains		 Transfer
29 checkpoint.com
research.checkpoint.com
sc1.checkpoint.com — Cisco Umbrella Rank: 27850
1 MB
13 sharethis.com
platform-api.sharethis.com — Cisco Umbrella Rank: 6169
buttons-config.sharethis.com — Cisco Umbrella Rank: 7262
l.sharethis.com — Cisco Umbrella Rank: 6111
platform-cdn.sharethis.com — Cisco Umbrella Rank: 13511
54 KB
9 trendemon.com
assets.trendemon.com — Cisco Umbrella Rank: 182085
trackingapi.trendemon.com — Cisco Umbrella Rank: 180472
51 KB
9 6sc.co
j.6sc.co — Cisco Umbrella Rank: 16308
c.6sc.co — Cisco Umbrella Rank: 23029
b.6sc.co — Cisco Umbrella Rank: 8700
13 KB
6 onesignal.com
cdn.onesignal.com — Cisco Umbrella Rank: 3423
onesignal.com — Cisco Umbrella Rank: 947
img.onesignal.com — Cisco Umbrella Rank: 6452
86 KB
4 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 894
www.linkedin.com — Cisco Umbrella Rank: 847
px4.ads.linkedin.com — Cisco Umbrella Rank: 6869
3 KB
4 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 94
region1.google-analytics.com — Cisco Umbrella Rank: 2119
20 KB
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 111
315 B
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 30334
425 B
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 208
111 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 6777
6 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 141
154 KB
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 870
355 B
1 t.co
t.co — Cisco Umbrella Rank: 600
338 B
1 gstatic.com
fonts.gstatic.com
16 KB
1 mktoresp.com
750-dqh-528.mktoresp.com
318 B
1 google.de
www.google.de — Cisco Umbrella Rank: 3469
501 B
1 google.com
www.google.com — Cisco Umbrella Rank: 19
501 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 996
15 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 1614
3 KB
1 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 725
709 B
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 188
447 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 120
1 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 976
30 KB
1 fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 1565
12 KB
94 25
Domain Requested by
21 research.checkpoint.com research.checkpoint.com
10 platform-cdn.sharethis.com
8 sc1.checkpoint.com research.checkpoint.com
7 trackingapi.trendemon.com assets.trendemon.com
7 b.6sc.co
3 onesignal.com cdn.onesignal.com
3 www.google-analytics.com www.googletagmanager.com
research.checkpoint.com
2 assets.trendemon.com research.checkpoint.com
assets.trendemon.com
2 www.facebook.com
2 epsilon.6sense.com j.6sc.co
2 px.ads.linkedin.com 2 redirects
2 connect.facebook.net research.checkpoint.com
connect.facebook.net
2 munchkin.marketo.net research.checkpoint.com
munchkin.marketo.net
2 www.googletagmanager.com research.checkpoint.com
www.googletagmanager.com
2 cdn.onesignal.com research.checkpoint.com
cdn.onesignal.com
1 analytics.twitter.com
1 t.co
1 fonts.gstatic.com fonts.googleapis.com
1 img.onesignal.com
1 750-dqh-528.mktoresp.com munchkin.marketo.net
1 px4.ads.linkedin.com
1 www.linkedin.com 1 redirects
1 www.google.de
1 www.google.com
1 static.ads-twitter.com www.googletagmanager.com
1 snap.licdn.com www.googletagmanager.com
1 c.6sc.co j.6sc.co
1 secure.adnxs.com j.6sc.co
1 region1.google-analytics.com www.googletagmanager.com
1 stats.g.doubleclick.net www.google-analytics.com
1 j.6sc.co research.checkpoint.com
1 l.sharethis.com platform-api.sharethis.com
1 buttons-config.sharethis.com platform-api.sharethis.com
1 platform-api.sharethis.com research.checkpoint.com
1 fonts.googleapis.com research.checkpoint.com
1 code.jquery.com research.checkpoint.com
1 use.fontawesome.com research.checkpoint.com
94 37
Subject Issuer Validity Valid
research.checkpoint.com
R3		 2022-07-06 -
2022-10-04		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-06-06 -
2023-06-05		 a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2022-08-03 -
2023-07-14		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
*.checkpoint.com
GlobalSign GCC R3 DV TLS CA 2020		 2021-12-07 -
2023-01-08		 a year crt.sh
sharethis.com
Amazon		 2022-06-19 -
2023-07-18		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
*.6sc.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-03-08 -
2023-03-11		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2022-02-11 -
2023-03-14		 a year crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA		 2022-03-01 -
2023-03-01		 a year crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-07-22 -
2023-08-22		 a year crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA		 2022-02-06 -
2023-02-07		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2022-06-19 -
2022-09-17		 3 months crt.sh
www.google.com
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
www.google.de
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-11-30 -
2022-11-30		 a year crt.sh
*.6sense.com
Amazon		 2022-05-31 -
2023-06-29		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-03-07 -
2023-03-06		 a year crt.sh
*.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-03-07 -
2023-03-06		 a year crt.sh
*.trendemon.com
SSL.com RSA SSL subCA		 2022-07-12 -
2023-06-26		 a year crt.sh

This page contains 2 frames:

Primary Page: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Frame ID: 60247F0E94EC42FE2CA1C86D3EEB53BE
Requests: 92 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 8017F25E227A73210BB39D2F727FAB94
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

DangerousSavanna: Two-year long campaign targets financial institutions in French-speaking Africa - Check Point Research

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <link rel="amphtml"
Overall confidence: 100%
Detected patterns
  • <!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • /flickity(?:\.pkgd)?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js
Overall confidence: 100%
Detected patterns
  • cdn\.onesignal\.com
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

94
Requests

99 %
HTTPS

55 %
IPv6

25
Domains

37
Subdomains

32
IPs

6
Countries

1962 kB
Transfer

3833 kB
Size

32
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 65
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1662786084418&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D51830%26time%3D1662786084418%26url%3Dhttps%253A%252F%252Fresearch.checkpoint.com%252F2022%252Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%252F%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1662786084418&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1662786084418&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&liSync=true&e_ipv6=AQKAkHH1OlmvgwAAAYMlxiA-nSqR2UDpeQpuzWr4ReObeYgHDSKTKYrxEKOtWnSZ

94 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/ 		66 KB
20 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / WP Engine
Resource Hash
8aa6dae0555f1413ad84d7df7405db607d76abc4a50d8277ee224b96db3bb9df
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
max-age=600, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
74859aff78655b6e-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sat, 10 Sep 2022 05:01:23 GMT
link
<https://research.checkpoint.com/?p=26425>; rel=shortlink
server
cloudflare
vary
Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache
HIT: 22
x-cache-group
normal
x-cacheable
SHORT
x-frame-options
SAMEORIGIN
x-powered-by
WP Engine
x-xss-protection
1; mode=block
style.min.css
research.checkpoint.com/wp-includes/css/dist/block-library/ 		87 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-includes/css/dist/block-library/style.min.css?ver=6.0.2
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:23 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 04 Jul 2022 12:10:37 GMT
server
cloudflare
age
110006
etag
W/"62c2d8bd-15b64"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74859b0099045b6e-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
style.css
research.checkpoint.com/wp-content/themes/research/ 		18 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.32
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef9e48bd5f604cd8d52ac00607fc60c2f4276a7e88c3f2bce907c7aaec90ed41

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:23 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 10 Aug 2022 01:47:46 GMT
server
cloudflare
age
2688614
etag
W/"62f30e42-4972"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74859b0099065b6e-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
bootstrap.min.css
research.checkpoint.com/wp-content/themes/research/css/ 		137 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/css/bootstrap.min.css?ver=4.1
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:23 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:49 GMT
server
cloudflare
age
15225199
etag
W/"5dc49a65-22485"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74859b0099075b6e-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
flickity.min.css
research.checkpoint.com/wp-content/themes/research/css/ 		2 KB
732 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/css/flickity.min.css?ver=1.1
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a8da941d8a446516c824ebc9fb77b42e6b92c6deed1daed266bd821ed27bc516

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:23 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
16736898
etag
W/"5dc49a64-71d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74859b0099085b6e-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
all.css
use.fontawesome.com/releases/v5.6.3/css/ 		52 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/releases/v5.6.3/css/all.css?ver=5.6.3
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:a9f7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
481a0574246e281316ffa0e15399bf5388bb81ae550ce0401a0353b6bb2d1e5a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:23 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
19691804
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
KFZAYRZ5DM8VRSPX
x-amz-id-2
DsAt4bsxtarxn/SDOJbVXVabWq6z1ypXnvdHyb49ztjP0uZZHLGc+RiPvRENPRUxTN+4IX8oWNc=
last-modified
Wed, 30 Jun 2021 15:44:33 GMT
server
cloudflare
etag
W/"dc93d584e41f8417f6b7163320d34329"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nCY2CLBhtf9yyclkomHO385GIrIx4p6uF%2BkZ72sAwfhKV%2BsJEL0SbX6ztxaZLKk1A3FopwYInrRlbzWQtUd45bsf%2FkA3DED%2BVafQC2pebes5Sc%2FD4wSBThu7QewNkJl1iuoI9JLvdLeHQq03eHKjFzMP"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=31556926
cf-ray
74859b00cc199c01-FRA
enlighterjs.min.css
research.checkpoint.com/wp-content/plugins/enlighter/cache/ 		78 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/plugins/enlighter/cache/enlighterjs.min.css?ver=TJ0/7+iAWMKbDKS
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6048e330c0f362be46b20de45d35a5ace57a04be04a29da10448d6949f6f69ce

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:23 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 15 Feb 2021 20:35:46 GMT
server
cloudflare
age
17012051
etag
W/"602adb22-13686"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74859b0099095b6e-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
jquery-3.4.0.min.js
code.jquery.com/ 		86 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.4.0.min.js?ver=6.0.2
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:23 GMT
content-encoding
gzip
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
etag
W/"28feccc0-15857"
vary
Accept-Encoding
x-hw
1662786083.dop164.fr8.t,1662786083.cds247.fr8.hn,1662786083.cds215.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30632
bootstrap.bundle.min.js
research.checkpoint.com/wp-content/themes/research/js/lib/ 		66 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/js/lib/bootstrap.bundle.min.js?ver=4.1
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bb3d017273ed487674d9766d8401cf458228596adcc0c3a6024f44ae715090db

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:23 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
27577856
etag
W/"5dc49a64-1089e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74859b00990c5b6e-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
flickity.pkgd.min.js
research.checkpoint.com/wp-content/themes/research/js/lib/ 		54 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/js/lib/flickity.pkgd.min.js?ver=1.0.1
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe2df9f6df4b4a8d7174d259f563b8d9e28e4c03f8f4092fd9db6044e0e64c32

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:23 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
16736898
etag
W/"5dc49a64-d7c9"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74859b00990e5b6e-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
single-post.js
research.checkpoint.com/wp-content/themes/research/js/ 		422 B
316 B 		Script
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/js/single-post.js?ver=1.0.4
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f5bd223eafa1c6d1aff21c91c6bfb825f7f36830d97eef41c432681ed671f85

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:23 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 14 Jan 2020 00:00:05 GMT
server
cloudflare
age
19686960
etag
W/"5e1d0485-1a6"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74859b00990f5b6e-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
inc-header.js
research.checkpoint.com/wp-content/themes/research/header/ 		1 KB
501 B 		Script
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/header/inc-header.js?v=1.1
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ae3754c54a0880a98a94c423d3e67f39b5b6f3c63516dafa33866e3e74c9f97d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:23 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
19687700
etag
W/"5dc49a64-47a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74859b0099105b6e-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
style.css
research.checkpoint.com/wp-content/themes/research/header/ 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/header/style.css
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0fe8bcbcd24ab838fbbd773001253fc0353956e81c5ba9c8e23951ebdbae305a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:23 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
17046521
etag
W/"5dc49a64-25cb"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74859b00990b5b6e-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
css
fonts.googleapis.com/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
234b9bab83aa0c52e9e5192995427a2bc44876cf1a11545ed631f369b8dc6534
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sat, 10 Sep 2022 05:01:09 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Sat, 10 Sep 2022 05:01:23 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 10 Sep 2022 05:01:23 GMT
facebook.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/facebook.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.122.24.32 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-122-24-32.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
791d8c8cb135d3d53915096e999d3857b6ee16966c20a019f38699f09f6aa2ff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Unused62
8096267
Date
Sat, 10 Sep 2022 05:01:24 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"7eb7015574801089503dd7095e1d4313:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1254
google-plus.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/google-plus.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.122.24.32 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-122-24-32.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
1998582382fbf956231d65be84b76e08c0c86e5ced8a99c703bdec416d876d76

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Unused62
8096267
Date
Sat, 10 Sep 2022 05:01:24 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"eedd0b2cde10b6b1930d57a10c6d0422:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1653
linkedin.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/linkedin.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.122.24.32 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-122-24-32.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a22d6b8782097b7cd9588ab582e119bfd6290278275661e9d0f96b2baec0cb8e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Unused62
8096267
Date
Sat, 10 Sep 2022 05:01:24 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"6789b034de6591b26bbd9b5fa6b451ca:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1416
email.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/email.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.122.24.32 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-122-24-32.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
3643b2c826a615065303aa44b8f463eb854d77934f5f25dc1f74f60d4698f9f0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Unused62
8096267
Date
Sat, 10 Sep 2022 05:01:24 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"15f1e1004accdbc019365e658249f334:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1407
rss.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/rss.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.122.24.32 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-122-24-32.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
b7cfb1c9430d90b22b3f4497543a4cfef719dc40a3cce130cad766171abe8bbe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Unused62
8096267
Date
Sat, 10 Sep 2022 05:01:24 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"8cc18e3677ea53cc679e33e82bf9497a:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1620
twitter.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/twitter.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.122.24.32 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-122-24-32.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a59bba774218f207179b30aa8bbd21bad0f7355a52321e08138bd77a308c27d5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Unused62
8096267
Date
Sat, 10 Sep 2022 05:01:24 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"6b05f4fc9522afa0cdbeb1a2c0bccc2c:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1608
check-point-research-logo.gif
sc1.checkpoint.com/sc1/inc/html/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/check-point-research-logo.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.122.24.32 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-122-24-32.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 05:01:24 GMT
Last-Modified
Mon, 09 Jul 2018 21:15:16 GMT
Server
AkamaiNetStorage
ETag
"c425f4400a5c9dfbaecb24275f494931:1531172224"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
2901
under-attack.gif
research.checkpoint.com/wp-content/themes/research/img/lib/ 		458 B
727 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/themes/research/img/lib/under-attack.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c0f7ef8329ae6da56bd269492901fb024a05d7b67e977995a82b506af4b3b030

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
cf-cache-status
HIT
age
9269032
cf-polished
origFmt=gif, origSize=1666
content-disposition
inline; filename="under-attack.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
458
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
etag
"5dc49a64-682"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
74859b011c1cbba7-FRA
cf-bgj
imgq:100,h2pri
Picture4.png
research.checkpoint.com/wp-content/uploads/2022/09/ 		64 KB
65 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2022/09/Picture4.png
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
de4d31515e1280c47f66df3bdab49aaa96eb3898f7588e60fff485f3750eb9c1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
cf-cache-status
MISS
last-modified
Mon, 05 Sep 2022 08:13:59 GMT
server
cloudflare
etag
"6315afc7-10176"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
74859b011c1dbba7-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
65910
email-decode.min.js
research.checkpoint.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 		1 KB
871 B 		Script
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 06 Sep 2022 17:30:56 GMT
server
cloudflare
x-frame-options
DENY
etag
W/"631783d0-4d7"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
74859b00fc02bba7-FRA
expires
Mon, 12 Sep 2022 05:01:24 GMT
sharethis.js
platform-api.sharethis.com/js/ 		190 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform-api.sharethis.com/js/sharethis.js
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-34.fra60.r.cloudfront.net
Software
/
Resource Hash
2b02c99b94bd29097fd168548bea6dfc28c9ffd3c2d751c1f375c9da902d8f63
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 04:57:19 GMT
content-encoding
gzip
vary
Accept-Encoding
age
247
etag
W/"2f749-jZtDoLQECLv0cAmOiJJ6B61Kdic"
x-frame-options
SAMEORIGIN
x-cache
Hit from cloudfront
content-type
text/javascript; charset=utf-8
via
1.1 89f400f550feb1d74a18ecb2070103ac.cloudfront.net (CloudFront)
edge-control
cache-maxage=60m,downstream-ttl=60m
cache-control
max-age=600, public
x-amz-cf-pop
FRA60-P3
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-id
dYzm9_wmtJ4CKc-8k7-x8GEa-TRYO_7Vxsz_zWbuVcpZ_tf3Yls9aA==
CfP_1021x580_A.jpg
research.checkpoint.com/wp-content/uploads/2018/11/ 		128 KB
128 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2018/11/CfP_1021x580_A.jpg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
408ddad0ef179adef886bffc95c5851680e2e1a3d9f04a03f5bb8d1efb73344c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
cf-cache-status
HIT
age
6811649
cf-polished
origSize=134980, status=webp_bigger
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
130561
last-modified
Thu, 07 Nov 2019 22:27:41 GMT
server
cloudflare
etag
"5dc49a5d-20f44"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
74859b011c1ebba7-FRA
cf-bgj
imgq:100,h2pri
enlighterjs.min.js
research.checkpoint.com/wp-content/plugins/enlighter/cache/ 		57 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/plugins/enlighter/cache/enlighterjs.min.js?ver=TJ0/7+iAWMKbDKS
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7e0c4a1ed3d232553d98c82ea0e04cee8975d0a67df819e161f96e7c32179e8c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 15 Feb 2021 20:35:46 GMT
server
cloudflare
age
6812741
etag
W/"602adb22-e33f"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
74859b011c1abba7-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
OneSignalSDK.js
cdn.onesignal.com/sdks/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=6.0.2
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d12c6745eca14e06d4dea70f4c2bd875769b349770d04300477ab18d0db005d4
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

cf-ray
74859b014b47bb89-FRA
date
Sat, 10 Sep 2022 05:01:24 GMT
via
1.1 google
cf-cache-status
HIT
server
cloudflare
age
218
etag
W/"ae63ef8ff03da61fffaa7f165729897a"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=259200
strict-transport-security
max-age=15552000; includeSubDomains
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Tue, 13 Sep 2022 05:01:24 GMT
gtm.js
www.googletagmanager.com/ 		272 KB
81 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
2cfa0839c33bbefa1f78cafb8749b4b2fb7fb2a154e57587f59feb7087457e7d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
81939
x-xss-protection
0
last-modified
Sat, 10 Sep 2022 03:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 10 Sep 2022 05:01:24 GMT
search-icon.gif
sc1.checkpoint.com/sc1/inc/html/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/search-icon.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/wp-content/themes/research/header/style.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.122.24.32 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-122-24-32.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
953d6908ab55929254e46c77e5c751a6e2df7ab84430f134edc3bb62d8f7d32f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Unused62
8096267
Date
Sat, 10 Sep 2022 05:01:24 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"2e1aa25e7e77e6a393fd38efb413370f:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1755
34CA47_6_0.woff2
research.checkpoint.com/wp-content/themes/research/fonts/ 		58 KB
58 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/fonts/34CA47_6_0.woff2
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.32
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0fc686423c26cb1030032fd7e4f2dd664c4b08517a8990c0b46269dd4e01910b

Request headers

Referer
https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.32
Origin
https://research.checkpoint.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
718770
etag
"5dc49a64-e890"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
74859b012c23bba7-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
59536
CPR_Africa_Blog_Article-1.jpg
research.checkpoint.com/wp-content/uploads/2022/09/ 		222 KB
223 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2022/09/CPR_Africa_Blog_Article-1.jpg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
88cbb2cb1c1bb1b74f1c390cf890f9b0a025e07b612c84e587e1763010919632

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
cf-cache-status
HIT
age
128994
cf-polished
origFmt=jpeg, origSize=514045
content-disposition
inline; filename="CPR_Africa_Blog_Article-1.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
227556
last-modified
Tue, 06 Sep 2022 06:35:14 GMT
server
cloudflare
etag
"6316ea22-7d7fd"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
74859b013c37bba7-FRA
cf-bgj
imgq:100,h2pri
image2.png
research.checkpoint.com/wp-content/uploads/2022/09/ 		81 KB
82 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2022/09/image2.png
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5a90d69cd6935fb0ae38d3a8776360832f85cd7f95b93bbbeb13ff524e394426

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
cf-cache-status
MISS
last-modified
Mon, 05 Sep 2022 21:48:54 GMT
server
cloudflare
etag
"63166ec6-145ce"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
74859b01acaabba7-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
83406
image3.png
research.checkpoint.com/wp-content/uploads/2022/09/ 		192 KB
192 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2022/09/image3.png
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f377a3e89420810b6b1ced2534d5dfdc41da58e0602cad130f5240fd39a45bbd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
cf-cache-status
HIT
age
98634
cf-polished
origFmt=png, origSize=417038
content-disposition
inline; filename="image3.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
196210
last-modified
Mon, 05 Sep 2022 21:48:55 GMT
server
cloudflare
etag
"63166ec7-65d0e"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
74859b01acadbba7-FRA
cf-bgj
imgq:100,h2pri
image4.png
research.checkpoint.com/wp-content/uploads/2022/09/ 		498 KB
498 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2022/09/image4.png
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8490547c212fdf6c5a4e1137b0c411d98942bcd2fb664449f94dd0c864544b45

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
cf-cache-status
MISS
last-modified
Mon, 05 Sep 2022 21:48:59 GMT
server
cloudflare
etag
"63166ecb-7c898"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
74859b01acafbba7-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
510104
5a3031770f16c70012a3c297.js
buttons-config.sharethis.com/js/ 		525 B
940 B 		Script
General
Check archive.org
Download Go to
Full URL
https://buttons-config.sharethis.com/js/5a3031770f16c70012a3c297.js
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206e:c200:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
eee6d8fe37122ba1538560131fe5c95f9a4b6c45e2059076a7a92513fcb12f20
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:25 GMT
via
1.1 03f23a59e296041c07602d699fc87484.cloudfront.net (CloudFront)
last-modified
Tue, 12 Dec 2017 19:43:54 GMT
server
AmazonS3
x-amz-cf-pop
VIE50-C1
etag
"29c30155cdf2eaa96943948b94d537b6"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
text/javascript
cache-control
max-age=60,public
strict-transport-security
max-age=31536000; includeSubDomains
accept-ranges
bytes
content-length
525
x-amz-cf-id
Y6paSZi8qHV96DJld87I-GwQghSk_jtIr7KED2jH6m9-Wvk2FWRqrg==
pview
l.sharethis.com/ 		0
410 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://l.sharethis.com/pview?event=pview&hostname=research.checkpoint.com&location=%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&product=sticky-share-buttons&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&source=sharethis.js&fcmp=false&fcmpv2=false&has_segmentio=false&title=DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research&cms=unknown&publisher=5a3031770f16c70012a3c297&sop=true&version=st_sop.js&lang=en&description=Introduction%20Recent%20studies%20show%20that%20more%20than%2085%25%20of%20financial%20institutions%20in%20Central%20and%20Western%20Africa%20have%20repeatedly%20been%20victimized%20in%20multiple%2C%20damaging%20cyberattacks.%20In%20a%20quarter%20of%20these%20cases%2C%20intrusions%20into%20network%20systems%20resulted%20in%20the%20worst%20possible%20outcomes%20for%20the%20financial%20and%20banking%20sector%3A%20information%20leaks%2C%20identity%20theft%2C%20money%20transfer%20fraud%2C%20and%20bank...%20Click%20to%20Read%20More
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.127.1.244 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-127-1-244.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 05:01:24 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains;
Access-Control-Allow-Origin
https://research.checkpoint.com
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Access-Control-Max-Age
1728000
Connection
keep-alive
Access-Control-Allow-Headers
*
OneSignalPageSDKES6.js
cdn.onesignal.com/sdks/ 		283 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=6.0.2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
843114448aaeeda7e8caa0cf76d61e0c63b8bffccd34517483363fdb15cdc80c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

cf-ray
74859b021b735b32-FRA
date
Sat, 10 Sep 2022 05:01:24 GMT
via
1.1 google
cf-cache-status
HIT
server
cloudflare
age
221
etag
W/"2f96824aee4bf927e734cc519e3e726d"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=259200
strict-transport-security
max-age=15552000; includeSubDomains
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Tue, 13 Sep 2022 05:01:24 GMT
6si.min.js
j.6sc.co/ 		30 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.91.4.216 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-4-216.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
b71f76186117ab510aca8eb8208815da837acdd4b29e171c9897993175c28878
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 05:01:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 22 Aug 2022 22:26:40 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"630402a0-786e"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
9594
expires
Sat, 10 Sep 2022 05:01:24 GMT
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Apr 2022 21:02:38 GMT
server
Golfe2
age
6326
date
Sat, 10 Sep 2022 03:15:58 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Sat, 10 Sep 2022 05:15:58 GMT
js
www.googletagmanager.com/gtag/ 		209 KB
73 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-48VXKGDGCV&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
95d1ac364f9c18ad9701bf6537d51f7d288447663b9577535696b854e3bbee07
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
74803
x-xss-protection
0
expires
Sat, 10 Sep 2022 05:01:24 GMT
web
onesignal.com/api/v1/sync/3ba17c77-81bb-4a83-8917-7b62de3d6e22/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onesignal.com/api/v1/sync/3ba17c77-81bb-4a83-8917-7b62de3d6e22/web?callback=__jp0
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
138afbef0ba35de0630f5d70053c7aa53b3c5bb6b21d9e190df63963854317f4
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
EXPIRED
x-permitted-cross-domain-policies
none
status
200 OK
x-envoy-upstream-service-time
26
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
x-request-id
53360d97-a402-47cf-83ff-b58db5b54fe4
x-runtime
0.024942
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"138afbef0ba35de0630f5d70053c7aa5"
x-download-options
noopen
strict-transport-security
max-age=15552000; includeSubDomains
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=3600
cf-ray
74859b029c90bb89-FRA
access-control-allow-headers
SDK-Version
expires
Sat, 10 Sep 2022 06:01:24 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
447 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-194688-3&cid=399772511.1662786084&jid=1365201007&gjid=602746808&_gid=1186229679.1662786084&_u=YGBAgEABAAAAAE~&z=1174297198
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c07::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://research.checkpoint.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Sat, 10 Sep 2022 05:01:24 GMT
content-type
text/plain
access-control-allow-origin
https://research.checkpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=786877183&t=pageview&_s=1&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&ul=en-us&de=UTF-8&dt=DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgEAB~&jid=1365201007&gjid=602746808&cid=399772511.1662786084&tid=UA-194688-3&_gid=1186229679.1662786084&gtm=2wg9705JCRGP&z=1209449560
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 04:30:19 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1865
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
region1.google-analytics.com/g/ 		0
352 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-48VXKGDGCV&gtm=2oe970&_p=786877183&cid=399772511.1662786084&ul=en-us&sr=1600x1200&_z=ccd.v9B&_s=1&sid=1662786084&sct=1&seg=0&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&dt=DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research&en=page_view&_fv=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-48VXKGDGCV&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 05:01:24 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://research.checkpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
getuidj
secure.adnxs.com/ 		11 B
709 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.38 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 10 Sep 2022 05:01:24 GMT
X-Proxy-Origin
80.255.10.203; 80.255.10.203; 537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
36900377-9285-479e-bcc5-47e7abda030b
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://research.checkpoint.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/ 		7 B
207 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.91.4.216 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-4-216.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://research.checkpoint.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
insight.min.js
snap.licdn.com/li.lms-analytics/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:10e::6860:5bba Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
content-encoding
gzip
last-modified
Fri, 12 Aug 2022 20:23:36 GMT
x-cdn
AKAM
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=69035
accept-ranges
bytes
content-length
3063
uwt.js
static.ads-twitter.com/ 		56 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.136.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
41b758f84ab2dd5da6f7ba488813d17410ebb48bc2074d304c26d63c5ece003d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
content-encoding
gzip
last-modified
Tue, 30 Aug 2022 15:04:19 GMT
etag
"d4de8398858246712016031c834bb061+gzip+gzip"
vary
Accept-Encoding,Host
x-tw-cdn
FT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache
x-cache
MISS, HIT
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
content-length
15317
x-served-by
cache-iad-kjyo7100045-IAD, cache-hhn11540-HHN
munchkin.js
munchkin.marketo.net/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.96.148.88 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-148-88.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
fe62ffc3dd7627c8b0d34b70fe45c7b14dd38c89c66cca13b2e4c71360e42e91

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 05:01:24 GMT
Content-Encoding
gzip
Last-Modified
Thu, 25 Aug 2022 21:55:11 GMT
Server
AkamaiNetStorage
ETag
"652cf747f68f64e15276c347eb3aef37:1661464511.126488"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
740
fbevents.js
connect.facebook.net/en_US/ 		100 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f080:9:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
5ae95e748ad12444cd760e245c02264cea3e8deb41fabd95f1e0784b81f72783
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
26737
x-xss-protection
0
pragma
public
x-fb-debug
PS26VxjzWODPHe7H0XRh5tjK1nHoR5v0HuMSyCekzW0I0mMjTuv1ACwmcytSumWGd/MHWVtncdpNHZEurDe+Zw==
x-fb-trip-id
1679558926
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Sat, 10 Sep 2022 05:01:24 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-194688-3&cid=399772511.1662786084&jid=1365201007&_u=YGBAgEABAAAAAE~&z=2119411760
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 05:01:24 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-194688-3&cid=399772511.1662786084&jid=1365201007&_u=YGBAgEABAAAAAE~&z=2119411760
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 05:01:24 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
twitter.svg
platform-cdn.sharethis.com/img/ 		731 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/twitter.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21fa:5000:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7c93346d4f681a0be90d1dfc19346382a4700f1810f41caa54415688dee1777f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Thu, 18 Aug 2022 08:55:19 GMT
via
1.1 f43d3fd3b180d6990058c868e5ed1d0c.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
age
1973166
etag
"0af2fb38987598376c99e21af17ade45"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
MSP50-C1
accept-ranges
bytes
content-length
731
x-amz-cf-id
OXYBC9ElGpTv5HXYsSc8wxOdv72ibQVLordo8U-MfY95bF3lMkSTmQ==
whatsapp.svg
platform-cdn.sharethis.com/img/ 		832 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/whatsapp.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21fa:5000:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
847eb36b4dc4b05f94052dcd98077319e74d882334a106bb9ca451ba211c9c2c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Sun, 21 Aug 2022 07:48:17 GMT
via
1.1 f43d3fd3b180d6990058c868e5ed1d0c.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
age
1717988
etag
"afe7fc60ed757db39a88d2950fce69c9"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
MSP50-C1
accept-ranges
bytes
content-length
832
x-amz-cf-id
l6U8qKtpLCLfqn2IKXrcH04etnZZ4BK-c6Fl0SAtiEO9vMv7-L3klA==
facebook.svg
platform-cdn.sharethis.com/img/ 		301 B
725 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/facebook.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21fa:5000:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Sat, 03 Sep 2022 07:19:11 GMT
via
1.1 f43d3fd3b180d6990058c868e5ed1d0c.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
age
596533
etag
"c6e9be45643e197ce1db1d7e24a99adc"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
MSP50-C1
accept-ranges
bytes
content-length
301
x-amz-cf-id
r20ih06koG9Ry_5uNHvEiagCxXJbQ93pDThZhJ4FSDmjdn_ktmjYVw==
linkedin.svg
platform-cdn.sharethis.com/img/ 		456 B
881 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/linkedin.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21fa:5000:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Fri, 19 Aug 2022 11:49:22 GMT
via
1.1 f43d3fd3b180d6990058c868e5ed1d0c.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
age
1876323
etag
"fa43b4ede18498b114fc7185993f6da7"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
MSP50-C1
accept-ranges
bytes
content-length
456
x-amz-cf-id
3uDxbqFMMFJqUX136IIU_2_j-e5anP0Cv-jr2FzYsOBTcOlSIdkS7g==
email.svg
platform-cdn.sharethis.com/img/ 		343 B
768 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/email.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21fa:5000:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Tue, 23 Aug 2022 13:53:31 GMT
via
1.1 f43d3fd3b180d6990058c868e5ed1d0c.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
age
1523274
etag
"5977437466e857c7ddcadda6f6d88c2a"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
MSP50-C1
accept-ranges
bytes
content-length
343
x-amz-cf-id
Ffga1MmmP6VWicoP74snM_U5DZ8R4hcieWHyZXPO83CLW6sQSosFkQ==
pinterest.svg
platform-cdn.sharethis.com/img/ 		771 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/pinterest.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21fa:5000:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
efc737b4f58cfe73a9bd0e57d7570365701381da31e628b269e7217a0ce3359d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Fri, 19 Aug 2022 14:57:40 GMT
via
1.1 f43d3fd3b180d6990058c868e5ed1d0c.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
age
1865025
etag
"2b10a062e719c64b686e2e8fcdc216dc"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
MSP50-C1
accept-ranges
bytes
content-length
771
x-amz-cf-id
kiSVNYyFnDC9TKiMdnRQKycFO6Gl5jBqps6nuq9IW3rVFas6OlndiQ==
sharethis.svg
platform-cdn.sharethis.com/img/ 		514 B
938 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/sharethis.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21fa:5000:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Wed, 24 Aug 2022 08:44:27 GMT
via
1.1 f43d3fd3b180d6990058c868e5ed1d0c.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
age
1455418
etag
"deecdaa377907db5cc1722fc831670a1"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
MSP50-C1
accept-ranges
bytes
content-length
514
x-amz-cf-id
XXkqPDY3Spg1vueGOwm-xkORJpLFZ6kcsJ3nS2alAVpsDLRbhVsLAg==
reddit.svg
platform-cdn.sharethis.com/img/ 		910 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/reddit.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21fa:5000:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
dadbb59b37bfea4c78c6e15c8cbb96dfba84526e43a0767dc244fd062a841aba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Fri, 19 Aug 2022 11:49:22 GMT
via
1.1 f43d3fd3b180d6990058c868e5ed1d0c.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
age
1876323
etag
"78d796ca648d8a5e665b48ed0217c56a"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
MSP50-C1
accept-ranges
bytes
content-length
910
x-amz-cf-id
-PYTm--XU0hEagt0mlXoPdJsG4XGN4PZurJb97YVa7ok272ecn_PPQ==
arrow_left.svg
platform-cdn.sharethis.com/img/ 		565 B
990 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/arrow_left.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21fa:5000:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Sat, 03 Sep 2022 07:07:11 GMT
via
1.1 f43d3fd3b180d6990058c868e5ed1d0c.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
age
597254
etag
"b55d8d2b9321e381a3c38a4bddb74037"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
MSP50-C1
accept-ranges
bytes
content-length
565
x-amz-cf-id
c5SdkYBnT82xYR6hapxyiZvYRkvH-vpL_XkCp0pbicwYwzniH5eJUQ==
arrow_right.svg
platform-cdn.sharethis.com/img/ 		565 B
989 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/arrow_right.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21fa:5000:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Thu, 18 Aug 2022 08:55:19 GMT
via
1.1 f43d3fd3b180d6990058c868e5ed1d0c.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
age
1973166
etag
"9928d025bd5792b718ee0a185f62e67c"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
MSP50-C1
accept-ranges
bytes
content-length
565
x-amz-cf-id
QoRlSsIqKj5oDZ9Snl6gyl3pUbgNmIk3c-O4D-p_GogY8eS5xrhMCw==
img.gif
b.6sc.co/v1/beacon/ 		43 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&visitor=15149d9e-4684-4ba2-86d9-643db540fa4c&session=4d77996a-6f92-460a-8ae6-cdb92dcb8e77&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A01%3A24%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&pageViewId=7da47ef3-849a-4656-8063-f4167ab011fb&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.91.4.216 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-4-216.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
OneSignalSDKStyles.css
onesignal.com/sdks/ 		82 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

cf-ray
74859b039c2e5b32-FRA
date
Sat, 10 Sep 2022 05:01:24 GMT
via
1.1 google
cf-cache-status
HIT
server
cloudflare
age
222
etag
W/"4e9aaefffd5f8ae7dc83361aa2294190"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=2592000
strict-transport-security
max-age=15552000; includeSubDomains
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Mon, 10 Oct 2022 05:01:24 GMT
munchkin.js
munchkin.marketo.net/162/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/162/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.96.148.88 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-148-88.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 05:01:24 GMT
Content-Encoding
gzip
Last-Modified
Fri, 01 Jul 2022 00:59:12 GMT
Server
AkamaiNetStorage
ETag
"75daf56f6191efe42577301908659c29:1656637152.894482"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4677
Expires
Mon, 19 Dec 2022 05:01:24 GMT
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1662786084418&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D51830%26time%3D1662786084418%26url%3Dhttps%253A%252F%252Fresearch.checkpoint.com%...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1662786084418&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1662786084418&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institution...
0
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1662786084418&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&liSync=true&e_ipv6=AQKAkHH1OlmvgwAAAYMlxiA-nSqR2UDpeQpuzWr4ReObeYgHDSKTKYrxEKOtWnSZ
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: F742B15EF2414A1BBF0D00D66C939FDD Ref B: FRAEDGE1105 Ref C: 2022-09-10T05:01:25Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-proto
http/2
content-length
0
x-li-uuid
AAXoS43xHC5dVI9wcfmeLw==
x-li-fabric
prod-lor1

Redirect headers

date
Sat, 10 Sep 2022 05:01:24 GMT
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: D7EC50F68E11402F8A3366DFE2620887 Ref B: FRAEDGE1308 Ref C: 2022-09-10T05:01:24Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lor1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1662786084418&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&liSync=true&e_ipv6=AQKAkHH1OlmvgwAAAYMlxiA-nSqR2UDpeQpuzWr4ReObeYgHDSKTKYrxEKOtWnSZ
x-li-proto
http/2
content-length
0
x-li-uuid
AAXoS43twZsII47VW600ig==
visitWebPage
750-dqh-528.mktoresp.com/webevents/ 		2 B
318 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://750-dqh-528.mktoresp.com/webevents/visitWebPage?_mchNc=1662786084443&_mchCn=&_mchId=750-DQH-528&_mchTk=_mch-checkpoint.com-1662786084442-46420&_mchHo=research.checkpoint.com&_mchPo=&_mchRu=%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&_mchPc=https%3A&_mchVr=162&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/162/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 05:01:24 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
0d6d20c1-fc47-414c-a753-698ef3bb2322
icon
onesignal.com/api/v1/apps/3ba17c77-81bb-4a83-8917-7b62de3d6e22/ 		176 B
599 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://onesignal.com/api/v1/apps/3ba17c77-81bb-4a83-8917-7b62de3d6e22/icon
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57e48df5586242df165fa8424ae8cb9e360c8e81b6a711736bf1f395a2c02a2f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
x-permitted-cross-domain-policies
none
status
200 OK
x-envoy-upstream-service-time
11
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
x-request-id
e69d8639-f717-40e3-aa95-173aa12d9387
x-runtime
0.009301
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"57e48df5586242df165fa8424ae8cb9e"
x-download-options
noopen
strict-transport-security
max-age=15552000; includeSubDomains
content-type
application/json; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
max-age=0, private, must-revalidate
cf-ray
74859b03e9cf9bd6-FRA
access-control-allow-headers
SDK-Version
1692853834349189
connect.facebook.net/signals/config/ 		292 KB
84 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/1692853834349189?v=2.9.79&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f080:9:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
c7987fa399af086aa19748e7504ca702d17233ab72abbb1a078880ac9c3a9cce
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection
0
pragma
public
x-fb-debug
XpPcSBGE1utC/XfZ/sr4eJS9lqgNR0WVGXUWPpPu2ZnZ+bPHBTad6xxKClYBNYsPYPkpuhFmp9r909nzknsLjw==
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Sat, 10 Sep 2022 05:01:24 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
details
epsilon.6sense.com/v3/company/ 		432 B
425 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.70.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-70-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
c56d2e2a7cb5a74f15d01417d51fc16c7b3745f0aaf96496f819d3d04e5391b9

Request headers

Authorization
Token 08e578d30e2119adb1ab60b02b8f1dd15c6b908d
Referer
https://research.checkpoint.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://research.checkpoint.com
access-control-allow-credentials
true
content-length
235
details
epsilon.6sense.com/v3/company/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.70.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-70-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization
Access-Control-Request-Method
GET
Origin
https://research.checkpoint.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://research.checkpoint.com
access-control-max-age
1800
date
Sat, 10 Sep 2022 05:01:24 GMT
server
nginx
7ec0ceb7-c110-40e8-9782-73562b05b110.gif
img.onesignal.com/t/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.onesignal.com/t/7ec0ceb7-c110-40e8-9782-73562b05b110.gif
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
vary
Accept-Encoding
cf-cache-status
EXPIRED
x-amz-request-id
8TX6JZVXZSN4AAPB
x-amz-meta-cache-control
public, maxage=604800
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2901
x-amz-id-2
X+wVODdO7yP37EM41ErtAKLEOB9WSIMt/+cV/64NVBa+sn8J4FdlSqCkR9KiDU0TkPJ+NgAXpX8=
last-modified
Mon, 26 Aug 2019 20:17:26 GMT
server
cloudflare
etag
"c425f4400a5c9dfbaecb24275f494931"
strict-transport-security
max-age=15552000; includeSubDomains
cache-control
public, max-age=2678400
accept-ranges
bytes
cf-ray
74859b042e41bb89-FRA
expires
Tue, 11 Oct 2022 05:01:24 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://research.checkpoint.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Fri, 09 Sep 2022 13:27:29 GMT
x-content-type-options
nosniff
age
56035
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 09 Sep 2023 13:27:29 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=786877183&t=event&ni=1&_s=1&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&ul=en-us&de=UTF-8&dt=DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aGDAgEABAAAAAE~&jid=&gjid=&cid=399772511.1662786084&tid=UA-194688-3&_gid=1186229679.1662786084&gtm=2wg9705JCRGP&cd9=&cd10=&cd11=&cd12=&cd13=&cd14=&cd16=&cd17=Germany&z=652818732
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 04:30:19 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
1865
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/ 		44 B
297 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=1692853834349189&ev=PageView&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&rl=&if=false&ts=1662786084571&sw=1600&sh=1200&v=2.9.79&r=stable&ec=0&o=30&fbp=fb.1.1662786084569.750321042&it=1662786084453&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:24 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
44
expires
Sat, 10 Sep 2022 05:01:24 GMT
adsct
t.co/i/ 		43 B
338 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/i/adsct?bci=3&eci=2&event_id=2897fefd-0122-4af9-9962-e4a8cd92fc6f&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=c82921d3-fcec-443c-9f25-79729a395988&tw_document_href=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxi3o&type=javascript&version=2.3.27
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.197 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-response-time
103
date
Sat, 10 Sep 2022 05:01:23 GMT
server
tsa_o
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
95fd879779b6d95f97d708df2a10a3fe8b6b3e3761c4ca5a42ba44fb7d87176b
content-length
43
adsct
analytics.twitter.com/i/ 		43 B
355 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=2897fefd-0122-4af9-9962-e4a8cd92fc6f&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=c82921d3-fcec-443c-9f25-79729a395988&tw_document_href=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxi3o&type=javascript&version=2.3.27
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-response-time
108
date
Sat, 10 Sep 2022 05:01:24 GMT
server
tsa_o
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
f750fd0d04d42b46002c3d4e968889eeb8d645c74bcc067d9ebce282c6740287
content-length
43
trends.min.js
assets.trendemon.com/tag/ 		220 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.trendemon.com/tag/trends.min.js
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-122-15.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
67affcd8e2f46a4ab641f378e973888030cc93455e54b6a042cb0691056549d2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Fri, 09 Sep 2022 20:08:16 GMT
content-encoding
gzip
last-modified
Mon, 05 Sep 2022 08:38:16 GMT
server
AmazonS3
age
31989
etag
"3d6c5cab0eeb5ffb72700457b43a473e"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 03249875678629095a5ec311a6f1a298.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P2
accept-ranges
bytes
content-length
43730
x-amz-cf-id
LsFF9aPEGFp2KsBgVMCSg_6nSmW8eF7j5r4QSs_d0AjuxaKepN3SBg==
2336
trackingapi.trendemon.com/api/settings/ 		746 B
885 B 		Script
General
Check archive.org
Download Go to
Full URL
https://trackingapi.trendemon.com/api/settings/2336?callback=jsonp486262&vid=
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.208.178.119 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-208-178-119.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
af3124bc33b3343bb06d0d83d86906aaa55c888a84b981568b512de93f012969

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 05:01:25 GMT
cache-control
no-store,no-cache
server
Kestrel
content-length
746
content-type
application/x-javascript; charset=UTF-8
/
www.facebook.com/tr/ Frame 8017 		0
18 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://research.checkpoint.com
Referer
https://research.checkpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://research.checkpoint.com
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Sat, 10 Sep 2022 05:01:25 GMT
priority
u=0
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
identity.min.js
assets.trendemon.com/global/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.trendemon.com/global/identity.min.js
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-122-15.fra60.r.cloudfront.net
Software
/ Express
Resource Hash
c66036f1288dcf003502e4f687e102a7ec6afe8bfa29daa9a5bb5ab62eb3567c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 00:46:56 GMT
content-encoding
gzip
age
15276
x-powered-by
Express
x-cache
Hit from cloudfront
via
1.1 03249875678629095a5ec311a6f1a298.cloudfront.net (CloudFront)
trd-ts
2022-09-07T00:46:47.641Z
last-modified
Mon, 05 Sep 2022 08:36:43 GMT
etag
W/"46f8-1830ccb7178"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
x-amz-cf-pop
FRA60-P2
accept-ranges
bytes
x-amz-cf-id
NbLcGtOltF375HUth8otH_N4z_RHNJWbhzCzfkUZxROGREpQdEDWqg==
me
trackingapi.trendemon.com/api/Identity/ 		94 B
507 B 		Script
General
Check archive.org
Download Go to
Full URL
https://trackingapi.trendemon.com/api/Identity/me?accountId=2336&DomainCookie=16627860851484437&fingerPrint=d26d751f1986e8bb55982e80b2c0dd74&callback=jsonp297194&vid=
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.208.178.119 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-208-178-119.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
7b41997bf3c63f03fad303f713ddf4fdda1f09f1bd7fb11ff32ac11bb9316610

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 05:01:25 GMT
cache-control
no-store,no-cache
server
Kestrel
content-length
94
content-type
application/x-javascript; charset=UTF-8
img.gif
b.6sc.co/v1/beacon/ 		43 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&visitor=15149d9e-4684-4ba2-86d9-643db540fa4c&session=4d77996a-6f92-460a-8ae6-cdb92dcb8e77&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A01%3A25%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A01%3A24%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&pageViewId=7da47ef3-849a-4656-8063-f4167ab011fb&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.91.4.216 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-4-216.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:25 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
marketingautomation
trackingapi.trendemon.com/api/ 		94 B
231 B 		Script
General
Check archive.org
Download Go to
Full URL
https://trackingapi.trendemon.com/api/marketingautomation?AccountId=2336&ClientUrl=aHR0cHM6Ly9yZXNlYXJjaC5jaGVja3BvaW50LmNvbS8yMDIyL2Rhbmdlcm91c3NhdmFubmEtdHdvLXllYXItbG9uZy1jYW1wYWlnbi10YXJnZXRzLWZpbmFuY2lhbC1pbnN0aXR1dGlvbnMtaW4tZnJlbmNoLXNwZWFraW5nLWFmcmljYS8%3D&CookieId=16627860851484437&MaCookie=aWQ6NzUwLURRSC01MjgmdG9rZW46X21jaC1jaGVja3BvaW50LmNvbS0xNjYyNzg2MDg0NDQyLTQ2NDIw&MaCookieName=X21rdG9fdHJr&MaName=marketo&callback=jsonp590357&vid=2336:16627516222030970
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.208.178.119 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-208-178-119.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
67b1355c746a5d617611d98604d99cbdb12547b3364739448d7b0aca557fd492

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 05:01:25 GMT
cache-control
no-store,no-cache
server
Kestrel
content-length
94
content-type
application/x-javascript; charset=UTF-8
personal
trackingapi.trendemon.com/api/experience/ 		15 B
114 B 		Script
General
Check archive.org
Download Go to
Full URL
https://trackingapi.trendemon.com/api/experience/personal?AccountId=2336&ClientUrl=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&MarketingAutomationCookie=id%3A750-DQH-528%26token%3A_mch-checkpoint.com-1662786084442-46420&ExcludeUnitsJson=%5B%5D&callback=jsonp123054&vid=2336:16627516222030970
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.208.178.119 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-208-178-119.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
a328489d69aaf7c5abcbeffcfd97620ff043f1dc523afda0a5288680e4836c07

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:25 GMT
server
Kestrel
content-length
15
content-type
application/x-javascript; charset=UTF-8
pageview
trackingapi.trendemon.com/api/events/ 		43 B
234 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trackingapi.trendemon.com/api/events/pageview?accountId=2336&url=aHR0cHM6Ly9yZXNlYXJjaC5jaGVja3BvaW50LmNvbS8yMDIyL2Rhbmdlcm91c3NhdmFubmEtdHdvLXllYXItbG9uZy1jYW1wYWlnbi10YXJnZXRzLWZpbmFuY2lhbC1pbnN0aXR1dGlvbnMtaW4tZnJlbmNoLXNwZWFraW5nLWFmcmljYS8%3D&cookie=16627860851484437&referral=&vid=2336:16627516222030970&r=1662786085329
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.208.178.119 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-208-178-119.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 05:01:25 GMT
server
Kestrel
age
1691358
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
content-length
43
expires
Mon, 01 Jan 1990 00:00:00 GMT
multiple
trackingapi.trendemon.com/api/events/client-app/ 		43 B
234 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trackingapi.trendemon.com/api/events/client-app/multiple?accountId=2336&url=aHR0cHM6Ly9yZXNlYXJjaC5jaGVja3BvaW50LmNvbS8yMDIyL2Rhbmdlcm91c3NhdmFubmEtdHdvLXllYXItbG9uZy1jYW1wYWlnbi10YXJnZXRzLWZpbmFuY2lhbC1pbnN0aXR1dGlvbnMtaW4tZnJlbmNoLXNwZWFraW5nLWFmcmljYS8%3D&app=sixsense&names=%5B%5D&vid=2336:16627516222030970&r=1662786085349
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.208.178.119 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-208-178-119.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 05:01:25 GMT
server
Kestrel
age
1691358
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
content-length
43
expires
Mon, 01 Jan 1990 00:00:00 GMT
personal-embedded
trackingapi.trendemon.com/api/experience/ 		15 B
114 B 		Script
General
Check archive.org
Download Go to
Full URL
https://trackingapi.trendemon.com/api/experience/personal-embedded?AccountId=2336&ClientUrl=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&MarketingAutomationCookie=id%3A750-DQH-528%26token%3A_mch-checkpoint.com-1662786084442-46420&Ids=%5B%5D&Groups=%5B%5D&callback=jsonp999622&vid=2336:16627516222030970
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.208.178.119 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-208-178-119.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
4e5d4f38b58a8c02d61cbd6c83d176b5a1fd64ddbdc4cad6f69fd1596f9f73e8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:25 GMT
server
Kestrel
content-length
15
content-type
application/x-javascript; charset=UTF-8
img.gif
b.6sc.co/v1/beacon/ 		43 B
494 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&visitor=15149d9e-4684-4ba2-86d9-643db540fa4c&session=4d77996a-6f92-460a-8ae6-cdb92dcb8e77&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A01%3A26%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A01%3A25%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&pageViewId=7da47ef3-849a-4656-8063-f4167ab011fb&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.91.4.216 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-4-216.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:26 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&visitor=15149d9e-4684-4ba2-86d9-643db540fa4c&session=4d77996a-6f92-460a-8ae6-cdb92dcb8e77&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A01%3A27%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A01%3A26%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&pageViewId=7da47ef3-849a-4656-8063-f4167ab011fb&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.91.4.216 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-4-216.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:27 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&visitor=15149d9e-4684-4ba2-86d9-643db540fa4c&session=4d77996a-6f92-460a-8ae6-cdb92dcb8e77&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A01%3A28%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A01%3A27%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&pageViewId=7da47ef3-849a-4656-8063-f4167ab011fb&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.91.4.216 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-4-216.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:28 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&visitor=15149d9e-4684-4ba2-86d9-643db540fa4c&session=4d77996a-6f92-460a-8ae6-cdb92dcb8e77&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A01%3A29%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A01%3A28%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&pageViewId=7da47ef3-849a-4656-8063-f4167ab011fb&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.91.4.216 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-4-216.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:29 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
494 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&visitor=15149d9e-4684-4ba2-86d9-643db540fa4c&session=4d77996a-6f92-460a-8ae6-cdb92dcb8e77&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A01%3A30%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A01%3A29%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226006%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&pageViewId=7da47ef3-849a-4656-8063-f4167ab011fb&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.91.4.216 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-4-216.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:01:30 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

127 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| dataLayer function| $ function| jQuery object| bootstrap function| jQueryBridget function| EvEmitter function| getSize function| matchesSelector object| fizzyUIUtils function| Flickity function| Unipointer function| Unidragger function| TapListener function| imagesLoaded function| documentInitOneSignal function| OneSignal object| st object| __stdos__ boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus function| __sharethis__docReady object| __sharethis__ object| EnlighterJS function| EnlighterJSINIT object| google_tag_manager function| postscribe object| google_tag_manager_external function| processEpsilonData string| epsilonName boolean| enabled function| callback number| version object| _6si object| google_tag_data string| GoogleAnalyticsObject function| ga number| TRD_ACC_ID number| __oneSignalSdkLoadCount object| _oneSignalInitOptions function| __jp0 object| gaplugins object| gaGlobal object| gaData function| onYouTubeIframeAPIReady string| _linkedin_data_partner_id function| twq function| fbq function| _fbq function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin function| lintrk boolean| _already_called_lintrk object| MunchkinTracker boolean| _storagePopulated object| regeneratorRuntime object| twttr function| $Trd_Base64 function| $Trd_i18n function| __awaiter function| __generator function| $Trd_Utils function| $Trd_Tools function| $Trd_Logger function| RecordsService function| __extends function| $Trd_UserPageHistory_Cook object| enRenderModes object| $Trd_InternalEventsTypes object| $Trd_TriggersEventsTypes function| mapBackendTriggers function| $Trd_Context function| $Trd_EnvironmentSettings function| $Trd_ClientCookie function| $Trd_CtaClientCookie function| $Trd_ButtonSelector object| Frequency object| UnitVisibiltyType object| UnitTypeId string| LOCAL_STORAGE_ITEM_NAME function| $Trd_FormListener object| COOKIE_NAMES function| $Trd_Visitor function| $Trd_UrlGrabber function| $Trd_Events function| $Trd_Pageview function| $Trd_Newvisitor function| $Trd_Cookmanager string| $TRD_MA_COOKIE_NAME object| $TRD_MA_COOKIE_NAME_MAP function| $Trd_MarketingAutomation function| $TRD_CtaComponent function| $TRD_CtaContentComponent function| $TRD_GenericLayoutComponent function| $TRD_FormLayoutComponent function| $TRD_RecommendationLayoutComponent function| $TRD_GenericScriptComponent function| $TRD_FastTextLayoutComponent function| $TRD_SurveyLayoutComponent function| __assign function| __spreadArray number| COOLOFF_DAYS_AFTER_CLOSE number| COOLOFF_MS_AFTER_CLOSE function| $Trd_ExperienceManager function| $TRD_ClientAppFactory function| $TRD_ClientApp function| $TRD_ClientAppDrift function| $TRD_ClientAppSixSense object| trdContext undefined| src function| $Trd_Lift function| $Trd_Embedded function| $Trd_NApi object| TrendemonContext object| $trd_Context object| trd_api object| IdentityConfig function| $Trd_Identity

32 Cookies

Domain/Path Name / Value
.checkpoint.com/ Name: referralURL
Value:
.checkpoint.com/ Name: _gid
Value: GA1.2.1186229679.1662786084
.checkpoint.com/ Name: _dc_gtm_UA-194688-3
Value: 1
.checkpoint.com/ Name: _ga_48VXKGDGCV
Value: GS1.1.1662786084.1.0.1662786084.0.0.0
research.checkpoint.com/ Name: _an_uid
Value: 0
research.checkpoint.com/ Name: _gd_visitor
Value: 15149d9e-4684-4ba2-86d9-643db540fa4c
research.checkpoint.com/ Name: _gd_session
Value: 4d77996a-6f92-460a-8ae6-cdb92dcb8e77
.checkpoint.com/ Name: _mkto_trk
Value: id:750-DQH-528&token:_mch-checkpoint.com-1662786084442-46420
.checkpoint.com/ Name: _ga
Value: GA1.2.399772511.1662786084
.checkpoint.com/ Name: _fbp
Value: fb.1.1662786084569.750321042
.6sc.co/ Name: 6suuid
Value: 44657b5c994d0000241a1c637002000002e10b00
.linkedin.com/ Name: UserMatchHistory
Value: AQLnriLyaiYg_AAAAYMlxh7Kj5ZuXiew0p6IrsI4k8INHpbKQZSSirkwvP94afMBF04vbvR9pVvQoQ
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQL6D5ul7XmQYAAAAYMlxh7Kt--U5ycpkw_FTcdGBkTVuHCN4KzSpTW9PekyWLwgCT96p13ZmfNZE3HsMNJagw
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&eea8af8e-3597-46a2-8a00-7a71f8b7f44c"
.linkedin.com/ Name: lidc
Value: "b=OGST09:s=O:r=O:a=O:p=O:g=2341:u=1:x=1:i=1662786084:t=1662872484:v=2:sig=AQHIX2onBWWvK3iJLgnUsnOwIy_mxziB"
.t.co/ Name: muc_ads
Value: e6b86366-dea3-4dba-b931-e60ae6573cf6
.twitter.com/ Name: personalization_id
Value: "v1_Sjekf6xhtwWxJHG0iBh0mg=="
.linkedin.com/ Name: lang
Value: v=2&lang=de-de
.www.linkedin.com/ Name: bscookie
Value: "v=1&20220910050124860d12d9-3772-4963-81a0-1352a65d17ebAQF3k-EKX4DbsHajtujgLZZrhQnqYecS"
.linkedin.com/ Name: li_gc
Value: MTswOzE2NjI3ODYwODQ7MjswMjGEWVCn9FteORMpj918gbAFkIRDfwDpq3rwmCT03yDXfw==
.checkpoint.com/ Name: trd_cid
Value: 16627860851484437
trackingapi.trendemon.com/ Name: trd_gavid_2336
Value: 16627516222030970
trackingapi.trendemon.com/ Name: trd_gvid
Value: 16627516222030970
trackingapi.trendemon.com/ Name: trd_vid_2336
Value: 2336%3A16627516222030970
.checkpoint.com/ Name: trd_vid_l
Value: 2336%3A16627516222030970
.checkpoint.com/ Name: trd_vuid_l
Value: 2483817798831328468
.checkpoint.com/ Name: trd_first_visit
Value: 1662786085
.checkpoint.com/ Name: trd_pw
Value: 1
.checkpoint.com/ Name: trd_pws
Value: 1
.checkpoint.com/ Name: trd_sid
Value: 16627860853272522
.checkpoint.com/ Name: trd_ma_cookie
Value: aWQ6NzUwLURRSC01MjgmdG9rZW46X21jaC1jaGVja3BvaW50LmNvbS0xNjYyNzg2MDg0NDQyLTQ2NDIw

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

750-dqh-528.mktoresp.com
analytics.twitter.com
assets.trendemon.com
b.6sc.co
buttons-config.sharethis.com
c.6sc.co
cdn.onesignal.com
code.jquery.com
connect.facebook.net
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
img.onesignal.com
j.6sc.co
l.sharethis.com
munchkin.marketo.net
onesignal.com
platform-api.sharethis.com
platform-cdn.sharethis.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
research.checkpoint.com
sc1.checkpoint.com
secure.adnxs.com
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
trackingapi.trendemon.com
use.fontawesome.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
104.122.24.32
104.244.42.197
104.244.42.3
104.91.4.216
104.96.148.88
13.107.42.14
13.32.99.34
141.193.213.21
18.195.70.228
18.66.122.15
192.28.144.124
199.232.136.157
2001:4860:4802:32::36
2001:4de0:ac18::1:a:2a
2600:9000:206e:c200:c:abe:f440:93a1
2600:9000:21fa:5000:1d:85c3:6640:93a1
2606:4700:3032::ac43:a9f7
2606:4700::6812:e134
2606:4700::6812:e234
2620:1ec:21::14
2a00:1450:4001:802::2003
2a00:1450:4001:806::2004
2a00:1450:4001:813::200a
2a00:1450:4001:82a::2003
2a00:1450:4001:82a::2008
2a00:1450:4001:830::200e
2a00:1450:400c:c07::9b
2a02:26f0:10e::6860:5bba
2a03:2880:f080:9:face:b00c:0:3
2a03:2880:f107:83:face:b00c:0:25de
3.127.1.244
37.252.173.38
54.208.178.119
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8
0fc686423c26cb1030032fd7e4f2dd664c4b08517a8990c0b46269dd4e01910b
0fe8bcbcd24ab838fbbd773001253fc0353956e81c5ba9c8e23951ebdbae305a
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
138afbef0ba35de0630f5d70053c7aa53b3c5bb6b21d9e190df63963854317f4
1998582382fbf956231d65be84b76e08c0c86e5ced8a99c703bdec416d876d76
1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e
234b9bab83aa0c52e9e5192995427a2bc44876cf1a11545ed631f369b8dc6534
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2b02c99b94bd29097fd168548bea6dfc28c9ffd3c2d751c1f375c9da902d8f63
2cfa0839c33bbefa1f78cafb8749b4b2fb7fb2a154e57587f59feb7087457e7d
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255
3643b2c826a615065303aa44b8f463eb854d77934f5f25dc1f74f60d4698f9f0
408ddad0ef179adef886bffc95c5851680e2e1a3d9f04a03f5bb8d1efb73344c
41b758f84ab2dd5da6f7ba488813d17410ebb48bc2074d304c26d63c5ece003d
481a0574246e281316ffa0e15399bf5388bb81ae550ce0401a0353b6bb2d1e5a
4e5d4f38b58a8c02d61cbd6c83d176b5a1fd64ddbdc4cad6f69fd1596f9f73e8
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57e48df5586242df165fa8424ae8cb9e360c8e81b6a711736bf1f395a2c02a2f
5a90d69cd6935fb0ae38d3a8776360832f85cd7f95b93bbbeb13ff524e394426
5ae95e748ad12444cd760e245c02264cea3e8deb41fabd95f1e0784b81f72783
5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57
5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009
6048e330c0f362be46b20de45d35a5ace57a04be04a29da10448d6949f6f69ce
67affcd8e2f46a4ab641f378e973888030cc93455e54b6a042cb0691056549d2
67b1355c746a5d617611d98604d99cbdb12547b3364739448d7b0aca557fd492
768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
791d8c8cb135d3d53915096e999d3857b6ee16966c20a019f38699f09f6aa2ff
7b41997bf3c63f03fad303f713ddf4fdda1f09f1bd7fb11ff32ac11bb9316610
7c93346d4f681a0be90d1dfc19346382a4700f1810f41caa54415688dee1777f
7e0c4a1ed3d232553d98c82ea0e04cee8975d0a67df819e161f96e7c32179e8c
7f5bd223eafa1c6d1aff21c91c6bfb825f7f36830d97eef41c432681ed671f85
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
843114448aaeeda7e8caa0cf76d61e0c63b8bffccd34517483363fdb15cdc80c
847eb36b4dc4b05f94052dcd98077319e74d882334a106bb9ca451ba211c9c2c
8490547c212fdf6c5a4e1137b0c411d98942bcd2fb664449f94dd0c864544b45
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
88cbb2cb1c1bb1b74f1c390cf890f9b0a025e07b612c84e587e1763010919632
8aa6dae0555f1413ad84d7df7405db607d76abc4a50d8277ee224b96db3bb9df
953d6908ab55929254e46c77e5c751a6e2df7ab84430f134edc3bb62d8f7d32f
95d1ac364f9c18ad9701bf6537d51f7d288447663b9577535696b854e3bbee07
9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a22d6b8782097b7cd9588ab582e119bfd6290278275661e9d0f96b2baec0cb8e
a328489d69aaf7c5abcbeffcfd97620ff043f1dc523afda0a5288680e4836c07
a59bba774218f207179b30aa8bbd21bad0f7355a52321e08138bd77a308c27d5
a8da941d8a446516c824ebc9fb77b42e6b92c6deed1daed266bd821ed27bc516
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae3754c54a0880a98a94c423d3e67f39b5b6f3c63516dafa33866e3e74c9f97d
af3124bc33b3343bb06d0d83d86906aaa55c888a84b981568b512de93f012969
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242
b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1
b71f76186117ab510aca8eb8208815da837acdd4b29e171c9897993175c28878
b7cfb1c9430d90b22b3f4497543a4cfef719dc40a3cce130cad766171abe8bbe
bb3d017273ed487674d9766d8401cf458228596adcc0c3a6024f44ae715090db
c0f7ef8329ae6da56bd269492901fb024a05d7b67e977995a82b506af4b3b030
c56d2e2a7cb5a74f15d01417d51fc16c7b3745f0aaf96496f819d3d04e5391b9
c66036f1288dcf003502e4f687e102a7ec6afe8bfa29daa9a5bb5ab62eb3567c
c7987fa399af086aa19748e7504ca702d17233ab72abbb1a078880ac9c3a9cce
cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120
d12c6745eca14e06d4dea70f4c2bd875769b349770d04300477ab18d0db005d4
d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51
dadbb59b37bfea4c78c6e15c8cbb96dfba84526e43a0767dc244fd062a841aba
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de4d31515e1280c47f66df3bdab49aaa96eb3898f7588e60fff485f3750eb9c1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eee6d8fe37122ba1538560131fe5c95f9a4b6c45e2059076a7a92513fcb12f20
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef9e48bd5f604cd8d52ac00607fc60c2f4276a7e88c3f2bce907c7aaec90ed41
efc737b4f58cfe73a9bd0e57d7570365701381da31e628b269e7217a0ce3359d
f377a3e89420810b6b1ced2534d5dfdc41da58e0602cad130f5240fd39a45bbd
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe2df9f6df4b4a8d7174d259f563b8d9e28e4c03f8f4092fd9db6044e0e64c32
fe62ffc3dd7627c8b0d34b70fe45c7b14dd38c89c66cca13b2e4c71360e42e91