blog.checkpoint.com Open in urlscan Pro
141.193.213.20 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
Submission: On January 05 via api (January 5th 2022, 2:21:07 pm UTC) from US — Scanned from DE

Summary HTTP 108 Redirects Links 132 Behaviour Indicators

Summary

This website contacted 28 IPs in 5 countries across 25 domains to perform 108 HTTP transactions. The main IP is 141.193.213.20, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is blog.checkpoint.com.
TLS certificate: Issued by R3 on November 19th 2021. Valid for: 3 months.

This is the only time blog.checkpoint.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
31	141.193.213.20 141.193.213.20	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
2	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2a	20446 (HIGHWINDS3) (HIGHWINDS3)
5	2a02:26f0:6c0... 2a02:26f0:6c00:297::38f0	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
5	2606:4700::68... 2606:4700::6812:e134	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.80.228.119 104.80.228.119	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2.18.235.40 2.18.235.40	16625 (AKAMAI-AS) (AKAMAI-AS)
2	104.84.56.126 104.84.56.126	16625 (AKAMAI-AS) (AKAMAI-AS)
8	104.111.233.140 104.111.233.140	16625 (AKAMAI-AS) (AKAMAI-AS)
3	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c08::9d	15169 (GOOGLE) (GOOGLE)
1	185.33.221.88 185.33.221.88	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2a00:1450:400... 2a00:1450:4001:803::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
2	35.158.252.9 35.158.252.9	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6812:e234	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:6b:... 2a02:26f0:6b::5f64:615a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	199.232.148.157 199.232.148.157	54113 (FASTLY) (FASTLY)
2	23.2.173.2 23.2.173.2	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2a03:2880:f04... 2a03:2880:f045:10:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
1 2	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
2	2a03:2880:f15... 2a03:2880:f158:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
18	18.66.112.41 18.66.112.41	() ()
108	28

31 141.193.213.20 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

blog.checkpoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:26f0:6c00:297::38f0 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

www.checkpoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6812:e134 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.80.228.119 (Haarlem, Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-80-228-119.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.235.40 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.84.56.126 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-84-56-126.deploy.static.akamaitechnologies.com

v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 104.111.233.140 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-233-140.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.33.221.88 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.158.252.9 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-158-252-9.eu-central-1.compute.amazonaws.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:e234 (United States)

ASN13335 (CLOUDFLARENET, US)

onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6b::5f64:615a (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.148.157 (Amsterdam, Netherlands)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.2.173.2 (Haarlem, Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-2-173-2.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f045:10:face:b00c:0:3 (Amsterdam, Netherlands)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

750-dqh-528.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f158:181:face:b00c:0:25de (London, United Kingdom)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 18.66.112.41 (None, )

ASN- ()

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
36	checkpoint.com blog.checkpoint.com www.checkpoint.com	1 MB
18	driftt.com js.driftt.com	231 KB
8	6sc.co j.6sc.co c.6sc.co b.6sc.co	14 KB
6	onesignal.com cdn.onesignal.com onesignal.com img.onesignal.com	108 KB
4	addthis.com s7.addthis.com m.addthis.com	217 KB
3	google-analytics.com www.google-analytics.com	20 KB
2	facebook.com www.facebook.com	313 B
2	linkedin.com 1 redirects px.ads.linkedin.com www.linkedin.com	1 KB
2	facebook.net connect.facebook.net	113 KB
2	marketo.net munchkin.marketo.net	6 KB
2	6sense.com epsilon.6sense.com	812 B
2	bootstrapcdn.com maxcdn.bootstrapcdn.com	70 KB
1	mktoresp.com 750-dqh-528.mktoresp.com	311 B
1	t.co t.co	471 B
1	twitter.com analytics.twitter.com	675 B
1	ads-twitter.com static.ads-twitter.com	6 KB
1	licdn.com snap.licdn.com	2 KB
1	google.de www.google.de	501 B
1	google.com www.google.com	501 B
1	adnxs.com secure.adnxs.com	693 B
1	doubleclick.net stats.g.doubleclick.net	444 B
1	addthisedge.com v1.addthisedge.com	726 B
1	moatads.com z.moatads.com	1 KB
1	googletagmanager.com www.googletagmanager.com	73 KB
1	jquery.com code.jquery.com	30 KB
108	25

	Domain	Requested by
31	blog.checkpoint.com	blog.checkpoint.com
18	js.driftt.com	blog.checkpoint.com js.driftt.com
6	b.6sc.co	blog.checkpoint.com
5	www.checkpoint.com	blog.checkpoint.com
3	onesignal.com	cdn.onesignal.com
3	www.google-analytics.com	www.googletagmanager.com blog.checkpoint.com
3	s7.addthis.com	blog.checkpoint.com s7.addthis.com
2	www.facebook.com
2	connect.facebook.net	blog.checkpoint.com connect.facebook.net
2	munchkin.marketo.net	blog.checkpoint.com munchkin.marketo.net
2	epsilon.6sense.com	j.6sc.co
2	cdn.onesignal.com	blog.checkpoint.com cdn.onesignal.com
2	maxcdn.bootstrapcdn.com	blog.checkpoint.com maxcdn.bootstrapcdn.com
1	750-dqh-528.mktoresp.com	munchkin.marketo.net
1	www.linkedin.com
1	px.ads.linkedin.com	1 redirects
1	img.onesignal.com
1	t.co
1	analytics.twitter.com	static.ads-twitter.com
1	static.ads-twitter.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	www.google.de	blog.checkpoint.com
1	www.google.com	blog.checkpoint.com
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	stats.g.doubleclick.net	www.google-analytics.com
1	j.6sc.co	blog.checkpoint.com
1	m.addthis.com	s7.addthis.com
1	v1.addthisedge.com	s7.addthis.com
1	z.moatads.com	s7.addthis.com
1	www.googletagmanager.com	blog.checkpoint.com
1	code.jquery.com	blog.checkpoint.com
108	32

This site contains links to these domains. Also see Links.

Domain
www.checkpoint.com
supportcenter.checkpoint.com
usercenter.checkpoint.com
www.checkpoint.com.cn
help.checkpoint.com
training-certifications.checkpoint.com
cyberpark.checkpoint.com
partnerlocator.checkpoint.com
www.youtube.com
resources.checkpoint.com
catalog.checkpoint.com
research.checkpoint.com
www.cybertalk.org
community.checkpoint.com
pages.checkpoint.com
developer.checkpoint.com
www.facebook.com
twitter.com
www.linkedin.com
www.addthis.com

Subject Issuer	Validity	Valid
blog.checkpoint.com R3	`2021-11-19` - `2022-02-17`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-03-01` - `2022-02-28`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
*.checkpoint.com DigiCert SHA2 Secure Server CA	`2021-03-02` - `2022-03-06`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
odc-addthis-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2021-04-25` - `2022-04-27`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2021-01-21` - `2022-01-25`	a year	crt.sh
*.6sc.co DigiCert SHA2 Secure Server CA	`2021-03-09` - `2022-03-16`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
www.google.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.6sense.com Amazon	`2021-06-30` - `2022-07-29`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2021-07-15` - `2022-07-20`	a year	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-21` - `2022-07-26`	a year	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2021-03-29` - `2022-04-06`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-10-14` - `2022-01-12`	3 months	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
*.mktoresp.com DigiCert TLS RSA SHA256 2020 CA1	`2021-11-30` - `2022-11-30`	a year	crt.sh
drift.com Amazon	`2021-09-08` - `2022-10-07`	a year	crt.sh

This page contains 6 frames:

Primary Page: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
Frame ID: CCD6357C115AAB1CB96FB63615D0F2E5
Requests: 81 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 4EF2758656064ABFA0739425F64B3813
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 238460C00895986FF709F7A0509BBA5B
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 7F3666522BA614B1087BFFEF749F80BD
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0a777eb4-0e96-4eb2-a789-df1901ed2cab&sessionStarted=1641392467.248&campaignRefreshToken=58abc3aa-1f0f-4e67-a97b-5d498b6d709e&hideController=false&pageLoadStartTime=1641392461008&mode=CHAT&driftEnableLog=false
Frame ID: 34A6AD2E545ADBFBABEC5767C6F1DD31
Requests: 24 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1641392461008
Frame ID: FAF5BD3857E2D32C194B906402935CB4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

How scammers are hiding their phishing trips in public clouds FacebookTwitterLinkedInRedditEmailFacebookTwitterLinkedInRedditEmail

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

particles.js (JavaScript Graphics) Expand

Overall confidence: 100%
Detected patterns

/particles(?:\.min)?\.js

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AMP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<link rel="amphtml"

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

AddThis (Widgets) Expand

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Flickity (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/flickity(?:\.pkgd)?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Moat (Analytics) Expand

Overall confidence: 100%
Detected patterns

moatads\.com

OneSignal (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

cdn\.onesignal\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

108
Requests

91 %
HTTPS

52 %
IPv6

25
Domains

32
Subdomains

28
IPs

5
Countries

2008 kB
Transfer

4463 kB
Size

21
Cookies

132 Outgoing links

These are links going to different origins than the main page.

URL: https://www.checkpoint.com/latest-cyber-attacks/ransomware-pandemic/
Title: Learn more on how to stay protected from the latest Ransomware Pandemic

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/demos/
Title: Free Demo

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/about-us/contact-us/
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://supportcenter.checkpoint.com/
Title: Support Center

Search URL Search Domain Scan URL

URL: https://usercenter.checkpoint.com/usercenter/index.jsp
Title: Sign In

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/support-services/threatcloud-incident-response/
Title: <img src="https://www.checkpoint.com/wp-content/themes/checkpoint-theme-v2/images/under-attack.png" />

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/
Title: English (English)

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/es/
Title: Spanish (Español)

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/fr/
Title: French (Français)

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/de/
Title: German (Deutsch)

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/it/
Title: Italian (Italiano)

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/pt/
Title: Portuguese (Português)

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/ru/
Title: Russian (Русский)

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/jp/
Title: Japanese (日本語)

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com.cn/
Title: Chinese (中文)

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/quantum/
Title: Quantum

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/quantum/maestro-hyperscale-network-security/
Title: Quantum Maestro

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/quantum/next-generation-firewall/
Title: Quantum Security Gateway

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/quantum/next-generation-firewall/small-business-security/
Title: Quantum Spark

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/quantum/next-generation-firewall/high-performance-scalable-platforms/
Title: Quantum Scalable Chassis

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/quantum/edge-branch-virtual-security-gateway/
Title: Quantum Edge

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/quantum/iot-protect/
Title: Quantum IoT Protect

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/quantum/remote-access-vpn/
Title: Quantum VPN

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/quantum/unified-cyber-security-platform/smart-1-appliances/
Title: Quantum Smart-1

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/quantum/unified-cyber-security-platform/smart-1-cloud/
Title: Quantum Smart-1 Cloud

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/cloudguard/
Title: CloudGuard

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/cloudguard/cloud-network-security/
Title: CloudGuard Network

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/cloudguard/cloud-security-posture-management/
Title: CloudGuard Posture Management

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/cloudguard/workload-protection/
Title: CloudGuard Workload

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/cloudguard/appsec/
Title: CloudGuard AppSec

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/cloudguard/cloud-intelligence-threat-hunting/
Title: CloudGuard Intelligence

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/harmony/
Title: Harmony

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/harmony/advanced-endpoint-protection/
Title: Harmony Endpoint

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/harmony/connect-sase/
Title: Harmony Connect (SASE)

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/harmony/browse/
Title: Harmony Browse

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/harmony/email-security/email-office/
Title: Harmony Email & Collaboration

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/harmony/mobile-security/mobile/
Title: Harmony Mobile

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/infinity-vision/
Title: Infinity-Vision

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/infinity-vision/infinity-portal/
Title: Infinity Portal

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/infinity-vision/infinity-soc/
Title: Infinity SOC

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/quantum/unified-cyber-security-platform/
Title: Infinity Unified Management

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/infinity-vision/threatcloud/
Title: ThreatCloud

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/products/
Title: View All Products

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/cloudguard/cloud-security-solutions/
Title: Cloud Security

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/cloudguard/serverless-security/
Title: Serverless Security

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/cloudguard/container-security/
Title: Container Security

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/cloudguard/cloud-network-security/public-cloud-compliance-governance/
Title: Cloud Compliance & Governance

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/cloudguard/devsecops/
Title: DevOps Security

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/cloudguard/cloud-network-security/iaas-private-cloud-security/
Title: Private Cloud Network Security

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/cloudguard/amazon-aws-security/
Title: AWS Security

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/cloudguard/microsoft-azure-security/
Title: Azure Security

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/cloudguard/google-cloud-platform-security/
Title: Google Cloud Security

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/quantum/network-security-solutions/
Title: Network Security

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/solutions/data-center-security/
Title: Hybrid Data Center

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/solutions/sd-wan-security/
Title: SD-WAN Security

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/solutions/zero-trust-security/
Title: Zero Trust Security

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/solutions/iot-security/
Title: IoT Security

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/solutions/endpoint-security/
Title: Endpoint Security

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/harmony/mobile-security/
Title: Mobile Security

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/harmony/anti-ransomware/
Title: Anti-Ransomware

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/harmony/anti-phishing/
Title: Anti-Phishing

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/solutions/mdr-services/
Title: Managed Detection & Response

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/infinity-vision/zero-day-protection/
Title: Zero-Day Protection

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/industry/
Title: Industry

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/industry/retail/
Title: Retail

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/industry/financial-services/
Title: Financial Services

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/industry/government-federal-security/
Title: Government

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/industry/healthcare/
Title: Healthcare

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/industry/industrial-control-systems/
Title: Industrial Control Systems ICS & SCADA

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/industry/service-provider/
Title: Telco / Service Provider

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/industry/education/
Title: Education

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/solutions/enterprise-network-security/
Title: Large Enterprise

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/solutions/small-medium-business/
Title: Small & Medium Business

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/solutions/consumer-small-business/
Title: Consumer & Small Business

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/solutions/
Title: Solutions Overview >

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/infinity-vision/total-protection-architecture/
Title: Learn More

Search URL Search Domain Scan URL

URL: https://help.checkpoint.com/s/
Title: Create/View Service Request

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/support-services/contact-support/
Title: Contact Support

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/support-services/pro/
Title: Check Point Pro

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/support-services/support-plans/
Title: Support Programs

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/support-services/support-life-cycle-policy/
Title: Life Cycle Policy

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/support-services/software-license-agreement-limited-hardware-warranty/
Title: License Agreement & Warranty

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/support-services/rma-return-process/
Title: RMA Policy

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/mind/
Title: Mind

Search URL Search Domain Scan URL

URL: https://training-certifications.checkpoint.com/#/
Title: Training & Certification

Search URL Search Domain Scan URL

URL: https://cyberpark.checkpoint.com/
Title: Cyber Park

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/clc/
Title: Learning Credits

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/support-services/secureacademy/
Title: Secure Academy

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/mind/smartawareness/
Title: SmartAwareness

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/elearning/
Title: eLearning

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/professional-services/
Title: Professional Services

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/professional-services/account-management/
Title: Account Management

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/support-services/lifecycle-management/
Title: Lifecycle Management Services

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/support-services/security-consulting/
Title: Security Consulting

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/support-services/threatcloud-managed-security-service/
Title: ThreatCloud Managed Security Service

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/training/hackingpoint/
Title: View Courses

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/partners/channel/
Title: Become a Partner

Search URL Search Domain Scan URL

URL: https://partnerlocator.checkpoint.com/#/
Title: Find a Partner

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/technology-partners/
Title: Technology Partners

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/technology-partners/featured/
Title: Featured Technology Partners

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=gr2f2LqjUAE
Title: Watch Video

Search URL Search Domain Scan URL

URL: https://resources.checkpoint.com/
Title: Content Resource Center

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/trials/
Title: Product Trials

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/customer-stories/
Title: Customer Stories

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/events/
Title: Events

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/webinars/
Title: Webinars

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/videos/
Title: Videos

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/cyber-hub/
Title: Cyber Hub

Search URL Search Domain Scan URL

URL: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowprelanding&all
Title: Downloads & Documentation

Search URL Search Domain Scan URL

URL: https://catalog.checkpoint.com/
Title: Product Catalog

Search URL Search Domain Scan URL

URL: https://usercenter.checkpoint.com/usercenter/portal/media-type/html/role/usercenterUser/page/default.psml/js_pane/PricingToolsId,supportQuoteToolId
Title: Renewal Pricing Tool

Search URL Search Domain Scan URL

URL: https://research.checkpoint.com/
Title: Check Point Research

Search URL Search Domain Scan URL

URL: https://www.cybertalk.org/
Title: Cyber Talk for Executives

Search URL Search Domain Scan URL

URL: https://community.checkpoint.com/
Title: CheckMates Community

Search URL Search Domain Scan URL

URL: https://research.checkpoint.com/2020/threat-actors-migrating-to-the-cloud/
Title: taking advantage of well-known cloud services

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/solutions/zero-day-protection/
Title: prevent zero-day attacks

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/products/email-security/
Title: email security

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/cpx/?utm_source=cp-home&utm_medium=cp-website&utm_campaign=cm_wr_21q4_ww_cpx_360_2022&utm_content=blog-ad

Search URL Search Domain Scan URL

URL: https://pages.checkpoint.com/gartner-magic-quadrant-for-network-firewall-2021.html

Search URL Search Domain Scan URL

URL: https://pages.checkpoint.com/remote-and-hybrid-work-security-report.html?utm_source=blog_thumbnail&utm_medium=email&utm_campaign=pm_wr_21q3_ww_sase_2021_remote_and_hybrid_security_report

Search URL Search Domain Scan URL

URL: https://pages.checkpoint.com/ultimate-iot-security-guide.html

Search URL Search Domain Scan URL

URL: https://pages.checkpoint.com/cyber-security-report-2021.html?utm_source=cp-home&utm_medium=cp-website&utm_campaign=pm_wr_21q1_ww_security_report

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/security-admins-guide-to-secure-remote-workforce/

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/products/cloud-native-security/

Search URL Search Domain Scan URL

URL: https://developer.checkpoint.com/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/checkpointsoftware

Search URL Search Domain Scan URL

URL: https://twitter.com/checkpointsw

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/check-point-software-technologies

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/CPGlobal

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/copyright/
Title: Copyright

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/privacy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.addthis.com/website-tools/overview?utm_source=AddThis%20Tools&utm_medium=image
Title: AddThis

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 73

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1641392462141&url=https%3A%2F%2Fblog.checkpoint.com%2F2020%2F07%2F21%2Fhow-scammers-are-hiding-their-phishing-trips-in-public-clouds%2F HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D51830%26time%3D1641392462141%26url%3Dhttps%253A%252F%252Fblog.checkpoint.com%252F2020%252F07%252F21%252Fhow-scammers-are-hiding-their-phishing-trips-in-public-clouds%252F%26liSync%3Dtrue

108 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/ 68 KB
12 KB 345ms
288ms Document
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / WP Engine

Resource Hash

5cafe00d3c4778d7be3b4c3a7c4f7fa86e4907631162b3127493198fb43a418e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
link: <https://blog.checkpoint.com/?p=25682>; rel=shortlink
x-powered-by: WP Engine
x-cacheable: SHORT
cache-control: max-age=600, must-revalidate
x-cache: HIT: 2
x-cache-group: normal
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=63072000
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6c8d59c3b8a43b91-CDG
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 style.min.css
blog.checkpoint.com/wp-includes/css/dist/block-library/ 79 KB
11 KB 177ms
175ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.checkpoint.com/wp-includes/css/dist/block-library/style.min.css?ver=5.8.2

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 01 Sep 2021 04:05:58 GMT
server: cloudflare
age: 4180098
etag: W/"612efc26-13abe"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
cf-ray: 6c8d59c5ddee3b91-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.2.0/css/ 21 KB
6 KB 82ms
29ms Stylesheet
text/css 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.2.0/css/font-awesome.min.css?ver=3.3.7

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0fb1bbca73646e8e2b93c82e8d8b219647b13d4b440c48e338290b9a685b8de1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.checkpoint.com/
Origin: https://blog.checkpoint.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 601, 617, 617
age: 2887235
cdn-cachedat: 2021-08-02 19:09:15
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:53 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: e740902e892b27d8c89a22112f9a22cc
cf-ray: 6c8d59c62bf059bf-MXP
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 bootstrap.3.min.css
blog.checkpoint.com/wp-content/themes/frontend/css/ 118 KB
20 KB 94ms
92ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.checkpoint.com/wp-content/themes/frontend/css/bootstrap.3.min.css?ver=3.3.7

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b9462c3d8fc4e698687d6fa7efdd3123606f6e235a179e7cb12cdb38f8ed7978

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 25 Mar 2019 17:12:14 GMT
server: cloudflare
age: 4365455
etag: W/"5c990bee-1d942"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
cf-ray: 6c8d59c5ddf53b91-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 cp-header.css
blog.checkpoint.com/wp-content/themes/frontend/css/ 287 KB
38 KB 60ms
58ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.checkpoint.com/wp-content/themes/frontend/css/cp-header.css?ver=1.27

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f100c6915ea9ca5ae0eeb12857bc1a61f22f2c202ee854b3aea760bb9a6d1f71

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 31 Dec 2021 03:50:26 GMT
server: cloudflare
age: 462491
etag: W/"61ce7e02-47d68"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
cf-ray: 6c8d59c5ddf83b91-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 style.css
blog.checkpoint.com/wp-content/themes/frontend/ 21 KB
5 KB 74ms
73ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.checkpoint.com/wp-content/themes/frontend/style.css?ver=1.27

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1f68ea963390597d0f2f71da80b22a580701b6a2eac5fad4a1d57c3f9b92770

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 24 Dec 2021 01:21:58 GMT
server: cloudflare
age: 462491
etag: W/"61c520b6-5360"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
cf-ray: 6c8d59c5ddfb3b91-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 flickity.min.css
blog.checkpoint.com/wp-content/themes/frontend/css/ 2 KB
685 B 56ms
54ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.checkpoint.com/wp-content/themes/frontend/css/flickity.min.css?ver=1.0

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

a8da941d8a446516c824ebc9fb77b42e6b92c6deed1daed266bd821ed27bc516

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 25 Mar 2019 17:12:14 GMT
server: cloudflare
age: 11189859
etag: W/"5c990bee-71d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
cf-ray: 6c8d59c5ddfe3b91-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 jquery-3.4.0.min.js Show response
code.jquery.com/ 86 KB
30 KB 68ms
21ms Script
application/javascript 2001:4de0:ac18::1:a:2a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.4.0.min.js?ver=5.8.2
Requested by: Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
content-encoding: gzip
last-modified: Wed, 10 Apr 2019 19:56:14 GMT
server: nginx
etag: W/"5cae4a5e-15857"
vary: Accept-Encoding
x-hw: 1641392461.dop206.ml1.t,1641392461.cds222.ml1.hn,1641392461.cds211.ml1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30632

GET
H2 200 scripts.js Show response
blog.checkpoint.com/wp-content/themes/frontend/js/ 430 B
314 B 66ms
64ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.checkpoint.com/wp-content/themes/frontend/js/scripts.js?ver=1.0.0

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d245d96784beee8a8652270aaa63264158ef3a6aae0c4f76d051ee14c4de7d98

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 25 Mar 2019 17:12:14 GMT
server: cloudflare
age: 22238593
etag: W/"5c990bee-1ae"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
cf-ray: 6c8d59c5ddff3b91-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 bootstrap.3.min.js Show response
blog.checkpoint.com/wp-content/themes/frontend/js/lib/ 39 KB
11 KB 75ms
74ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.checkpoint.com/wp-content/themes/frontend/js/lib/bootstrap.3.min.js?ver=5.8.2

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afe

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 10 Jul 2019 21:05:48 GMT
server: cloudflare
age: 4180098
etag: W/"5d26532c-9b00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
cf-ray: 6c8d59c5de023b91-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 jquery.matchHeight.js Show response
blog.checkpoint.com/wp-content/themes/frontend/js/lib/ 12 KB
3 KB 49ms
47ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.checkpoint.com/wp-content/themes/frontend/js/lib/jquery.matchHeight.js?ver=5.8.2

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d6ba13b690dee4af8ac51913d50f8509c65be9516aa24e2f761b3a1aa96dbd3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 25 Mar 2019 17:12:14 GMT
server: cloudflare
age: 2912640
etag: W/"5c990bee-2e02"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
cf-ray: 6c8d59c5de043b91-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 flickity.pkgd.min.js Show response
blog.checkpoint.com/wp-content/themes/frontend/js/lib/ 54 KB
14 KB 72ms
71ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.checkpoint.com/wp-content/themes/frontend/js/lib/flickity.pkgd.min.js?ver=1.0.0

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe2df9f6df4b4a8d7174d259f563b8d9e28e4c03f8f4092fd9db6044e0e64c32

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 25 Mar 2019 17:12:14 GMT
server: cloudflare
age: 14993727
etag: W/"5c990bee-d7c9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
cf-ray: 6c8d59c5de083b91-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 single-post.js Show response
blog.checkpoint.com/wp-content/themes/frontend/js/ 485 B
343 B 75ms
74ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.checkpoint.com/wp-content/themes/frontend/js/single-post.js?ver=1.0.4

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

4eabdbc55715edcfef23aef35a30d6dc56f207e057c5b81b821f858121bb4a7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 31 May 2019 14:33:11 GMT
server: cloudflare
age: 4365455
etag: W/"5cf13b27-1e5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
cf-ray: 6c8d59c5de0b3b91-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H/1.1 200
OK search-btn.png
www.checkpoint.com/wp-content/themes/checkpoint-theme-v2/images/ 2 KB
2 KB 35ms
7ms Image
image/png 2a02:26f0:6c00:297::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.checkpoint.com/wp-content/themes/checkpoint-theme-v2/images/search-btn.png

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00:297::38f0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

a7d7aa09becb2494f61a590c32dd433a7b0daf2bddf29c5f622ac84a4c197007

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 14:21:01 GMT
Last-Modified: Fri, 20 Aug 2021 00:35:30 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "729-5c9f2d8325880"
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Access-Control-Allow-Methods: PUT, POST, GET, DELETE, OPTIONS
Content-Type: image/png
Cache-Control: public, max-age=2500000
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token
Content-Length: 1833

GET
H/1.1 200
OK check-point-logo.png
www.checkpoint.com/wp-content/themes/checkpoint-theme-v2/images/ 8 KB
8 KB 35ms
8ms Image
image/png 2a02:26f0:6c00:297::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.checkpoint.com/wp-content/themes/checkpoint-theme-v2/images/check-point-logo.png

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00:297::38f0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

77b472b6755aa7a5fe017695a793329fc05975805feb11e41ba11f670807661d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 14:21:01 GMT
Last-Modified: Fri, 20 Aug 2021 00:35:30 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "1fa8-5c9f2d8325880"
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Access-Control-Allow-Methods: PUT, POST, GET, DELETE, OPTIONS
Content-Type: image/png
Cache-Control: public, max-age=2500000
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token
Content-Length: 8104

GET
H3 200 default-blog.jpg
blog.checkpoint.com/wp-content/themes/frontend/img/ 21 KB
21 KB 80ms
77ms Image
image/jpeg 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.checkpoint.com/wp-content/themes/frontend/img/default-blog.jpg

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

568e9a539ceb8854e87abfc39b4bca071eb0b6a314de9f9a5a3b73b6801c3be2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 4359535
cf-polished: origSize=37570, status=webp_bigger
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 21590
last-modified: Mon, 25 Mar 2019 17:15:24 GMT
server: cloudflare
etag: "5c990cac-92c2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6c8d59c73f623a2f-CDG
cf-bgj: imgq:100,h2pri

GET
H3 200 CPX2022-blogad-260x260-1.jpg
blog.checkpoint.com/wp-content/uploads/2021/12/ 26 KB
27 KB 81ms
78ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.checkpoint.com/wp-content/uploads/2021/12/CPX2022-blogad-260x260-1.jpg

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

71484898ccbb0ec3975f40c32741bf030861bc7a316713e8a491e2b3a1abb5e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
cf-cache-status: HIT
age: 1784732
cf-polished: origFmt=jpeg, origSize=36539
content-disposition: inline; filename="CPX2022-blogad-260x260-1.webp"
strict-transport-security: max-age=63072000
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 26858
last-modified: Wed, 08 Dec 2021 22:10:46 GMT
server: cloudflare
etag: "61b12d66-8ebb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6c8d59c73f633a2f-CDG
cf-bgj: imgq:100,h2pri

GET
H3 200 blog_side_banner_gartner_thumb_260-1.jpg
blog.checkpoint.com/wp-content/uploads/2021/11/ 19 KB
19 KB 98ms
95ms Image
image/jpeg 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.checkpoint.com/wp-content/uploads/2021/11/blog_side_banner_gartner_thumb_260-1.jpg

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

139e504307c7753224bfff29405576a6816be9a64ceb5ba6f66f701fe989370c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 3780113
cf-polished: origSize=20027, status=webp_bigger
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 18955
last-modified: Mon, 22 Nov 2021 20:07:09 GMT
server: cloudflare
etag: "619bf86d-4e3b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6c8d59c73f653a2f-CDG
cf-bgj: imgq:100,h2pri

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 253 KB
73 KB 83ms
59ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9ef5cf262e025fe18d8648cb344729b872b205f3b96e3183fc4d83ced5112201

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 74535
x-xss-protection: 0
last-modified: Wed, 05 Jan 2022 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 05 Jan 2022 14:21:02 GMT

GET
H3 200 sase_survey_banner_260x260px.jpg
blog.checkpoint.com/wp-content/uploads/2021/12/ 36 KB
37 KB 39ms
37ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.checkpoint.com/wp-content/uploads/2021/12/sase_survey_banner_260x260px.jpg

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d1277b30387b4b95870784da4028fccbed1b2164bb3a421a70cd70add65b89c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
cf-cache-status: HIT
age: 2314000
cf-polished: origFmt=jpeg, origSize=41981
content-disposition: inline; filename="sase_survey_banner_260x260px.webp"
strict-transport-security: max-age=63072000
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 37222
last-modified: Thu, 09 Dec 2021 18:30:37 GMT
server: cloudflare
etag: "61b24b4d-a3fd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6c8d59c73f663a2f-CDG
cf-bgj: imgq:100,h2pri

GET
H3 200 idc-iot-buyers-guide-300x200px.jpg
blog.checkpoint.com/wp-content/uploads/2021/04/ 30 KB
30 KB 102ms
100ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.checkpoint.com/wp-content/uploads/2021/04/idc-iot-buyers-guide-300x200px.jpg

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2580e1986fce375c6ed96ac5eb8974cab06d2848b997560bb3c7f9dd5581c53e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
cf-cache-status: HIT
age: 1778053
cf-polished: origFmt=jpeg, origSize=39130
content-disposition: inline; filename="idc-iot-buyers-guide-300x200px.webp"
strict-transport-security: max-age=63072000
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 30498
last-modified: Fri, 30 Apr 2021 20:27:30 GMT
server: cloudflare
etag: "608c6832-98da"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6c8d59c73f683a2f-CDG
cf-bgj: imgq:100,h2pri

GET
H3 200 security-report-2021-promo.jpg
blog.checkpoint.com/wp-content/uploads/2021/03/ 29 KB
29 KB 103ms
101ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.checkpoint.com/wp-content/uploads/2021/03/security-report-2021-promo.jpg

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3111006bd360d7e022385e73923dbec02fcf791700ee201958e711a4d304623

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
cf-cache-status: HIT
age: 3776980
cf-polished: origFmt=jpeg, origSize=46840
content-disposition: inline; filename="security-report-2021-promo.webp"
strict-transport-security: max-age=63072000
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 29662
last-modified: Tue, 23 Mar 2021 21:45:02 GMT
server: cloudflare
etag: "605a615e-b6f8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6c8d59c73f693a2f-CDG
cf-bgj: imgq:100,h2pri

GET
H3 200 wfh-blog-2.jpg
blog.checkpoint.com/wp-content/uploads/2020/09/ 34 KB
34 KB 121ms
119ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.checkpoint.com/wp-content/uploads/2020/09/wfh-blog-2.jpg

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

b8aaffdb6fd495c82977176b9267b8ff2c4fc68dafaa39cf9497d6ed3a5fd5c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
cf-cache-status: HIT
age: 1782402
cf-polished: origFmt=jpeg, origSize=44884
content-disposition: inline; filename="wfh-blog-2.webp"
strict-transport-security: max-age=63072000
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 34468
last-modified: Wed, 09 Sep 2020 19:48:58 GMT
server: cloudflare
etag: "5f5931aa-af54"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6c8d59c73f6a3a2f-CDG
cf-bgj: imgq:100,h2pri

GET
H3 200 HARMONY_300X250_June_11.jpg
blog.checkpoint.com/wp-content/uploads/2020/06/ 38 KB
38 KB 58ms
56ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.checkpoint.com/wp-content/uploads/2020/06/HARMONY_300X250_June_11.jpg

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

62e5ee83717cdbc8480b12e00ffc263a60399b462f88830636dbd495d47f6657

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
cf-cache-status: HIT
age: 2313304
cf-polished: origFmt=jpeg, origSize=40058
content-disposition: inline; filename="HARMONY_300X250_June_11.webp"
strict-transport-security: max-age=63072000
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 38598
last-modified: Fri, 12 Jun 2020 22:26:17 GMT
server: cloudflare
etag: "5ee40109-9c7a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6c8d59c73f6d3a2f-CDG
cf-bgj: imgq:100,h2pri

GET
H3 200 automate-security-260x260-1.jpg
blog.checkpoint.com/wp-content/uploads/2020/11/ 28 KB
28 KB 59ms
57ms Image
image/jpeg 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.checkpoint.com/wp-content/uploads/2020/11/automate-security-260x260-1.jpg

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

8d980fa0fe8e5717bce42de7da9b8e88fff442f9d1a7ce591c2a4ab0507b8575

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 2912641
cf-polished: origSize=28403, status=webp_bigger
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 28395
last-modified: Mon, 16 Nov 2020 18:15:57 GMT
server: cloudflare
etag: "5fb2c1dd-6ef3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6c8d59c73f6f3a2f-CDG
cf-bgj: imgq:100,h2pri

GET
H3 200 footer.js Show response
blog.checkpoint.com/wp-content/themes/frontend/js/ 8 KB
2 KB 43ms
42ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.checkpoint.com/wp-content/themes/frontend/js/footer.js?ver=1.2

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

571930eac2354bf751d8efe096b9011110b0d82c11db07da5bb19a6cb19592c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 23 Dec 2021 23:55:42 GMT
server: cloudflare
age: 1081758
etag: W/"61c50c7e-20d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
cf-ray: 6c8d59c67dbb3a2f-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 200 particles.min.js Show response
blog.checkpoint.com/wp-content/themes/frontend/js/lib/ 23 KB
6 KB 44ms
44ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.checkpoint.com/wp-content/themes/frontend/js/lib/particles.min.js?ver=5.8.2

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

faee7815a5fd27e938d1e01c8392b66332024908eb118048f608eee671371df6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 25 Mar 2019 17:12:14 GMT
server: cloudflare
age: 3780113
etag: W/"5c990bee-5b44"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
cf-ray: 6c8d59c6be443a2f-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 200 app.js Show response
blog.checkpoint.com/wp-content/themes/frontend/js/lib/ 2 KB
947 B 54ms
54ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.checkpoint.com/wp-content/themes/frontend/js/lib/app.js?ver=5.8.2

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4b05f12d91c9f8b7c3bec26e49d7889b53885ed1b08e317e626490cba2c2967

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 25 Mar 2019 17:12:14 GMT
server: cloudflare
age: 4180098
etag: W/"5c990bee-7d6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
cf-ray: 6c8d59c6fece3a2f-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 9 KB
3 KB 71ms
27ms Script
application/javascript 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=5.8.2
Requested by: Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 88522cca257c7b55886862e9549236b005c2fcbb1246bcd986621476739c2127

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 271
etag: W/"f138f96bdde8c4ff4dce4300db918980"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 6c8d59c77b11d600-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Sat, 08 Jan 2022 14:21:02 GMT

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 353 KB
114 KB 71ms
24ms Script
application/javascript 104.80.228.119
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.80.228.119 Haarlem, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-80-228-119.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
server: nginx/1.15.8
etag: W/"5f971164-5834c"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
cache-control: public, max-age=600
date: Wed, 05 Jan 2022 14:21:02 GMT
x-host: s7.addthis.com
content-length: 116406

GET
DATA 200
OK truncated
/ 64 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK bullet-prod.png
www.checkpoint.com/wp-content/themes/checkpoint-theme-v2/images/ 1 KB
2 KB 32ms
14ms Image
image/png 2a02:26f0:6c00:297::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.checkpoint.com/wp-content/themes/checkpoint-theme-v2/images/bullet-prod.png

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/wp-content/themes/frontend/css/cp-header.css?ver=1.27

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00:297::38f0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

b9d991f032b0f626a8b215af39aaae7ad4e1e262c9fad049b6f12a4fe7afb9bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 14:21:01 GMT
Last-Modified: Fri, 20 Aug 2021 00:35:30 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "403-5c9f2d8325880"
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Access-Control-Allow-Methods: PUT, POST, GET, DELETE, OPTIONS
Content-Type: image/png
Cache-Control: public, max-age=2500000
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token
Content-Length: 1027

GET
H/1.1 200
OK search.png
www.checkpoint.com/wp-content/themes/checkpoint-theme-v2/images/ 2 KB
2 KB 32ms
14ms Image
image/png 2a02:26f0:6c00:297::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.checkpoint.com/wp-content/themes/checkpoint-theme-v2/images/search.png

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/wp-content/themes/frontend/css/cp-header.css?ver=1.27

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00:297::38f0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

fb8acb6ca1149529e5e25600bfaaa2aa77a353369dd5c8f63869f63a42279db4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 14:21:01 GMT
Last-Modified: Fri, 20 Aug 2021 00:35:30 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "67a-5c9f2d8325880"
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Access-Control-Allow-Methods: PUT, POST, GET, DELETE, OPTIONS
Content-Type: image/png
Cache-Control: public, max-age=2500000
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token
Content-Length: 1658

GET
H/1.1 200
OK intl.png
www.checkpoint.com/wp-content/themes/checkpoint-theme-v2/images/ 2 KB
3 KB 31ms
7ms Image
image/png 2a02:26f0:6c00:297::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.checkpoint.com/wp-content/themes/checkpoint-theme-v2/images/intl.png

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/wp-content/themes/frontend/css/cp-header.css?ver=1.27

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00:297::38f0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

76911468519fda64950773694e032587649fe089cf454e1f4afa005cd191772c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 14:21:01 GMT
Last-Modified: Fri, 20 Aug 2021 00:35:30 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "84e-5c9f2d8325880"
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Access-Control-Allow-Methods: PUT, POST, GET, DELETE, OPTIONS
Content-Type: image/png
Cache-Control: public, max-age=2500000
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token
Content-Length: 2126

GET
H3 200 blog-bg.jpg
blog.checkpoint.com/wp-content/themes/frontend/img/ 45 KB
45 KB 114ms
113ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.checkpoint.com/wp-content/themes/frontend/img/blog-bg.jpg

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/wp-content/themes/frontend/style.css?ver=1.27

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f9e667632eb739b2d6b1bf57ee3ddb298e5358d11c613b571800247a90c371b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/wp-content/themes/frontend/style.css?ver=1.27
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
cf-cache-status: HIT
age: 14981585
cf-polished: origFmt=jpeg, origSize=170731
content-disposition: inline; filename="blog-bg.webp"
strict-transport-security: max-age=63072000
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 46050
last-modified: Mon, 25 Mar 2019 17:12:45 GMT
server: cloudflare
etag: "5c990c0d-29aeb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6c8d59c74f963a2f-CDG
cf-bgj: imgq:100,h2pri

GET
H3 200 34CA47_6_0.woff2
blog.checkpoint.com/wp-content/themes/frontend/fonts/ 58 KB
58 KB 133ms
132ms Font
font/woff2 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.checkpoint.com/wp-content/themes/frontend/fonts/34CA47_6_0.woff2

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/wp-content/themes/frontend/style.css?ver=1.27

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

0fc686423c26cb1030032fd7e4f2dd664c4b08517a8990c0b46269dd4e01910b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://blog.checkpoint.com/wp-content/themes/frontend/style.css?ver=1.27
Origin: https://blog.checkpoint.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
vary: Accept-Encoding
cf-cache-status: HIT
age: 4358845
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 59536
last-modified: Mon, 10 Jun 2019 21:56:55 GMT
server: cloudflare
etag: "5cfed227-e890"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6c8d59c74fa53a2f-CDG

GET
H3 200 fontawesome-webfont.woff
maxcdn.bootstrapcdn.com/font-awesome/4.2.0/fonts/ 64 KB
65 KB 67ms
47ms Font
font/woff 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.2.0/fonts/fontawesome-webfont.woff?v=4.2.0

Requested by

Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.2.0/css/font-awesome.min.css?ver=3.3.7

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://maxcdn.bootstrapcdn.com/font-awesome/4.2.0/css/font-awesome.min.css?ver=3.3.7
Origin: https://blog.checkpoint.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 722, 617, 617
access-control-allow-origin: *
cdn-cachedat: 2021-04-23 07:57:41
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 65452
timing-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:53 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: font/woff
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: e8d59f9f57c0512e9c2e97d0763dea37
accept-ranges: bytes
cf-ray: 6c8d59c76fe97266-HAM
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H3 200 cpr-cloud-1.png
blog.checkpoint.com/wp-content/uploads/2020/07/ 77 KB
78 KB 609ms
609ms Image
image/png 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.checkpoint.com/wp-content/uploads/2020/07/cpr-cloud-1.png

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

bb50f23bb5bd7abf0a5dbdfb1319b9ce06bdabcb8a61a99905260f29d4d3d1f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
cf-cache-status: MISS
last-modified: Mon, 20 Jul 2020 21:36:16 GMT
server: cloudflare
etag: "5f160e50-135b8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
accept-ranges: bytes
cf-ray: 6c8d59c7986d3a2f-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 79288

GET
H3 200 CPR-cloud-2.png
blog.checkpoint.com/wp-content/uploads/2020/07/ 87 KB
87 KB 227ms
227ms Image
image/png 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.checkpoint.com/wp-content/uploads/2020/07/CPR-cloud-2.png

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3af788ef77d8641a8f04fc3ea3864e7040dd857356c22d8b55c333c588ed488

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
cf-cache-status: MISS
last-modified: Mon, 20 Jul 2020 21:36:21 GMT
server: cloudflare
etag: "5f160e55-15a99"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
accept-ranges: bytes
cf-ray: 6c8d59c798703a2f-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 88729

GET
H3 200 CPR-Cloud-3.png
blog.checkpoint.com/wp-content/uploads/2020/07/ 89 KB
90 KB 610ms
609ms Image
image/png 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.checkpoint.com/wp-content/uploads/2020/07/CPR-Cloud-3.png

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f2a39591ca8fc09488c7b959cb4fb364c56ce94900504c8592b663c4f88c7222

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
cf-cache-status: MISS
last-modified: Mon, 20 Jul 2020 21:36:24 GMT
server: cloudflare
etag: "5f160e58-164cf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
accept-ranges: bytes
cf-ray: 6c8d59c798773a2f-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 91343

GET
H3 200 CPR-Cloud-4.png
blog.checkpoint.com/wp-content/uploads/2020/07/ 332 KB
332 KB 213ms
213ms Image
image/png 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.checkpoint.com/wp-content/uploads/2020/07/CPR-Cloud-4.png

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2866bb4df6d3efd7e9c5c0fa846a92e04a8e96e5af8a5ddb8068a3de023a4b41

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
cf-cache-status: MISS
last-modified: Mon, 20 Jul 2020 21:36:34 GMT
server: cloudflare
etag: "5f160e62-52e2b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
accept-ranges: bytes
cf-ray: 6c8d59c7987a3a2f-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 339499

GET
H3 200 CPR-cloud-5.png
blog.checkpoint.com/wp-content/uploads/2020/07/ 5 KB
5 KB 218ms
217ms Image
image/png 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.checkpoint.com/wp-content/uploads/2020/07/CPR-cloud-5.png

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f80b0710e5536d05a2407c4d80a3d532694ded9b19396ae7b875371981a7c903

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
cf-cache-status: MISS
last-modified: Mon, 20 Jul 2020 21:36:35 GMT
server: cloudflare
etag: "5f160e63-12b1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
accept-ranges: bytes
cf-ray: 6c8d59c7987d3a2f-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 4785

GET
H3 200 CPR-cloud-6.png
blog.checkpoint.com/wp-content/uploads/2020/07/ 9 KB
9 KB 196ms
196ms Image
image/png 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.checkpoint.com/wp-content/uploads/2020/07/CPR-cloud-6.png

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7138dd4ecf8557fcd49ef967ad2c51664aebd1f99fc0e3a5209719b24fb2b168

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
cf-cache-status: MISS
last-modified: Mon, 20 Jul 2020 21:36:37 GMT
server: cloudflare
etag: "5f160e65-230a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
strict-transport-security: max-age=63072000
accept-ranges: bytes
cf-ray: 6c8d59c798893a2f-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 8970

GET
H3 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 283 KB
68 KB 67ms
32ms Script
application/javascript 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151512
Requested by: Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=5.8.2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e000e7805a03b275608d64f0ee40fc1140ea80bcb3daa6bc9a5406dd107f9d0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 365
etag: W/"bade15bfdcba7ee19d22e61741b04b27"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 6c8d59c80b1e7260-HAM
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Sat, 08 Jan 2022 14:21:02 GMT

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 130ms
17ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: D5503D14AA2F06AA
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=53305
accept-ranges: bytes
content-length: 948
x-amz-id-2: JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/ra-5e31d98cbedf7ed2/ 2 KB
726 B 134ms
41ms Script
application/javascript 104.84.56.126
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/ra-5e31d98cbedf7ed2/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.84.56.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-84-56-126.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 30581cee80fdc00a20dde03fe67c68d41453254863b15e9aefa09314eb342d2d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
content-encoding: gzip
etag: 337578481--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public, max-age=6, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 550

GET
H2 200 300lo.json Show response
m.addthis.com/live/red_lojson/ 89 B
249 B 289ms
196ms Script
application/javascript 104.84.56.126
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://m.addthis.com/live/red_lojson/300lo.json?si=61d5a94d8a422dd0&bkl=0&bl=1&pdt=401&sid=61d5a94d8a422dd0&pub=ra-5e31d98cbedf7ed2&rev=v8.28.8-wp&ln=en&pc=men&cb=0&ab=-&dp=blog.checkpoint.com&fp=2020%2F07%2F21%2Fhow-scammers-are-hiding-their-phishing-trips-in-public-clouds%2F&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&colc=1641392461482&jsl=1&uvs=61d5a94dacc295a8000&skipb=1&callback=addthis.cbs.jsonp__55072285383399790
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.84.56.126 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-84-56-126.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 1e744d96d8077c6b8acfbe1831583a0c4bee5241c3f80e9fa80e80572e19d2e7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 14:21:02 GMT
cache-control: max-age=0, no-cache, no-store, no-transform
content-disposition: attachment; filename=1.txt
content-length: 89
content-type: application/javascript;charset=utf-8

GET sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 4EF2 0
0

GET
H2 200 sh.f48a1a04fe8dbf021b4cda1d.html Show response
s7.addthis.com/static/ Frame 2384 71 KB
26 KB 24ms
23ms Document
text/html 104.80.228.119
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.80.228.119 Haarlem, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-80-228-119.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/

Response headers

server: nginx/1.15.8
content-type: text/html
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
etag: W/"5f971164-11adc"
timing-allow-origin: *
cache-control: public, max-age=86313600
p3p: CP="NON ADM OUR DEV IND COM STA"
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
content-length: 26421
date: Wed, 05 Jan 2022 14:21:02 GMT
vary: Accept-Encoding
x-host: s7.addthis.com

GET
H/1.1 200
OK 6si.min.js Show response
j.6sc.co/ 27 KB
9 KB 100ms
26ms Script
application/javascript 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 14:21:02 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 8575
Pragma: no-cache
Last-Modified: Thu, 07 Oct 2021 17:17:43 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615f2bb7-6a5f"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: application/javascript
Access-Control-Allow-Origin
Cache-Control: private, no-cache, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 05 Jan 2022 14:21:02 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 78ms
7ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 4796
date: Wed, 05 Jan 2022 13:01:06 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Wed, 05 Jan 2022 15:01:06 GMT

GET
H2 200 web Show response
onesignal.com/api/v1/sync/8fda8b9d-6ba7-4357-8125-c6df304f7ef8/ 3 KB
2 KB 386ms
385ms Script
text/javascript 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/sync/8fda8b9d-6ba7-4357-8125-c6df304f7ef8/web?callback=__jp0

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151512

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c718c45f165e97d858ddd804cda7aa221e545ec8b39e3cc9ff274314eb21b850

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: EXPIRED
status: 200 OK
x-envoy-upstream-service-time: 81
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 94087c89-22d5-4163-9d22-2dc635ee4cdf
x-runtime: 0.079453
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"c718c45f165e97d858ddd804cda7aa22"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600
cf-ray: 6c8d59c8dd52d600-MXP
access-control-allow-headers: SDK-Version
expires: Wed, 05 Jan 2022 15:21:02 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
444 B 72ms
29ms XHR
text/plain 2a00:1450:400c:c08::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-194688-3&cid=1074270023.1641392462&jid=1634603382&gjid=1384560669&_gid=1734651685.1641392462&_u=YGBAgEABAAAAAE~&z=1087324390

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.checkpoint.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 05 Jan 2022 14:21:02 GMT
content-type: text/plain
access-control-allow-origin: https://blog.checkpoint.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 26ms
11ms Image
image/gif 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1029219380&t=pageview&_s=1&dl=https%3A%2F%2Fblog.checkpoint.com%2F2020%2F07%2F21%2Fhow-scammers-are-hiding-their-phishing-trips-in-public-clouds%2F&ul=en-us&de=UTF-8&dt=How%20scammers%20are%20hiding%20their%20phishing%20trips%20in%20public%20clouds&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgEAB~&jid=1634603382&gjid=1384560669&cid=1074270023.1641392462&tid=UA-194688-3&_gid=1734651685.1641392462&gtm=2wgc105JCRGP&z=1720273627

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 14:09:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 673
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK getuidj Show response
secure.adnxs.com/ 11 B
693 B 59ms
14ms XHR
application/json 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 05 Jan 2022 14:21:02 GMT
X-Proxy-Origin: 194.36.108.20; 194.36.108.20; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 7d7939ac-91a2-4ea6-ba0b-67be44e9f857
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://blog.checkpoint.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 11
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK / Show response
c.6sc.co/ 47 B
375 B 65ms
18ms XHR
text/plain 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-233-140.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2a77e167a09c32088184c0931b7d0a325daf8dada0a036b6be6797e74e9d60d3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 14:21:02 GMT
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: text/plain
Access-Control-Allow-Origin: https://blog.checkpoint.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 47

GET
H2 200 layers.fa6cd1947ce26e890d3d.js Show response
s7.addthis.com/static/ 263 KB
76 KB 26ms
26ms Script
application/javascript 104.80.228.119
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.fa6cd1947ce26e890d3d.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.80.228.119 Haarlem, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-80-228-119.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
server: nginx/1.15.8
etag: W/"5f971164-41cf5"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86313600
date: Wed, 05 Jan 2022 14:21:02 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77617

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 66ms
42ms Image
image/gif 2a00:1450:4001:803::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-194688-3&cid=1074270023.1641392462&jid=1634603382&_u=YGBAgEABAAAAAE~&z=531200284

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 14:21:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 55ms
30ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-194688-3&cid=1074270023.1641392462&jid=1634603382&_u=YGBAgEABAAAAAE~&z=531200284

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 14:21:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 239ms
197ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&session=36d119df-58e5-43c0-803f-30358630257a&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2005%20Jan%202022%2014%3A21%3A01%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Check%20Point%20researchers%20warn%20and%20cite%20an%20example%20of%20a%20fast-growing%20trend%20in%20which%20hackers%20are%20concealing%20phishing%20attacks%20on%20Google%20Cloud%20Services.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%5Cn%20%20%20%20%20%20%20%20How%20scammers%20are%20hiding%20their%20phishing%20trips%20in%20public%20clouds%20%20%20%20%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblog.checkpoint.com%2F2020%2F07%2F21%2Fhow-scammers-are-hiding-their-phishing-trips-in-public-clouds%2F&pageViewId=d2af8fea-b575-4a8d-8935-537c74fc21d5&an_uid=0

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 14:21:02 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:57:20 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e502810-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 1 KB
812 B 30ms
13ms XHR
application/json 35.158.252.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.158.252.9 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-158-252-9.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: bcdf608103a7e83ebafda51aec81029da1a3bb33bba4246d233c243f86f681ec

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Referer: https://blog.checkpoint.com/
Accept-Language: de-DE,de;q=0.9
Authorization: Token 87c67a7c5a9e9b4dd1824f6727ed4e43fadadde4
EpsilonCookie: 36bb1002832400004ea9d561fe0000000d0b0300

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://blog.checkpoint.com
access-control-allow-credentials: true
content-length: 625

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 27ms
8ms Preflight 35.158.252.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.158.252.9 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-158-252-9.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization,epsiloncookie
Origin: https://blog.checkpoint.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
server: nginx
access-control-allow-origin: https://blog.checkpoint.com
access-control-allow-credentials: true
access-control-max-age: 1800
access-control-allow-methods: OPTIONS,GET
access-control-allow-headers: authorization,epsiloncookie

GET
DATA 200
OK truncated
/ 443 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
7ms Image
image/gif 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1029219380&t=event&ni=1&_s=1&dl=https%3A%2F%2Fblog.checkpoint.com%2F2020%2F07%2F21%2Fhow-scammers-are-hiding-their-phishing-trips-in-public-clouds%2F&ul=en-us&de=UTF-8&dt=How%20scammers%20are%20hiding%20their%20phishing%20trips%20in%20public%20clouds&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aGDAgEABAAAAAE~&jid=&gjid=&cid=1074270023.1641392462&tid=UA-194688-3&_gid=1734651685.1641392462&gtm=2wgc105JCRGP&cd9=Credit%20Suisse&cd10=credit-suisse.com&cd11=Financial%20Services&cd12=10%2C000%2B&cd13=CloudGuard_BO_20211217_DO_NOT_TOUCH%2CCloudGuard_BO_20211224_DO_NOT_TOUCH%2CHarmony_BO_20210816_DO_NOT_TOUCH%2CBuying%20Stage%203%3A%20Decision%20-%20SC%2CQuantum_BO_20211213_1_DO_NOT_TOUCH%2CBuying%20Stage%202%3A%20Consideration%20-%20SC%2CBuying%20Stage%201%3A%20Awareness%20-%20SC&cd14=%245B%2B&cd16=47860&cd17=Germany&z=1598765853

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 14:09:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 673
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 OneSignalSDKStyles.css
onesignal.com/sdks/ 82 KB
9 KB 27ms
26ms Stylesheet
text/css 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2
Requested by: Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151512
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 363
etag: W/"4e9aaefffd5f8ae7dc83361aa2294190"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=259200
cf-ray: 6c8d59cb6a907260-HAM
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Sat, 08 Jan 2022 14:21:02 GMT

GET
H3 200 icon Show response
onesignal.com/api/v1/apps/8fda8b9d-6ba7-4357-8125-c6df304f7ef8/ 176 B
610 B 88ms
38ms Fetch
application/json 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/apps/8fda8b9d-6ba7-4357-8125-c6df304f7ef8/icon

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151512

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

179d0859bd448c9d778463de4df53108b80046e4354aaf7c00a2fc0b5d021bbe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18
status: 200 OK
x-envoy-upstream-service-time: 14
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 1f6836e1-b150-4012-b7d0-4dc54bcac627
x-runtime: 0.012876
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"179d0859bd448c9d778463de4df53108"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=0, private, must-revalidate
cf-ray: 6c8d59cc0c68e8eb-MXP
access-control-allow-headers: SDK-Version

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 5 KB
2 KB 72ms
19ms Script
application/x-javascript 2a02:26f0:6b::5f64:615a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6b::5f64:615a Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 14:21:02 GMT
Content-Encoding: gzip
Last-Modified: Wed, 29 Sep 2021 19:17:49 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=60095
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2036

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 14 KB
6 KB 47ms
14ms Script
application/javascript 199.232.148.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.148.157 Amsterdam, Netherlands, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
content-encoding: gzip
last-modified: Mon, 20 Sep 2021 23:58:10 GMT
etag: "8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip+gzip"
vary: Accept-Encoding,Host
x-tw-cdn: FT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache
x-cache: HIT, HIT
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 5410
x-served-by: cache-iad-kcgs7200032-IAD, cache-ams12726-AMS

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 65ms
20ms Script
application/x-javascript 23.2.173.2
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.2.173.2 Haarlem, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-2-173-2.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 14:21:02 GMT
Content-Encoding: gzip
Last-Modified: Fri, 29 Oct 2021 01:24:07 GMT
Server: AkamaiNetStorage
ETag: "461ce1cffaadfebf2e7659745618ba8e:1635470647.434977"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 753

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 98 KB
26 KB 45ms
14ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 25965
x-xss-protection: 0
pragma: public
x-fb-debug: EmhM/DQ6o6KO7EWv2YqGhi4gqPpiewNj6UNOseY8oSbg3NdxykiornG7ZSyAmhsn0ngu1SyPrvOjl6e5dXFypQ==
x-fb-trip-id: 1709462857
x-frame-options: DENY
date: Wed, 05 Jan 2022 14:21:02 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
675 B 145ms
127ms Script
application/javascript 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nxi3o&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=b7060c98-224b-4fcd-8025-6aeed15b86cf&tw_document_href=https%3A%2F%2Fblog.checkpoint.com%2F2020%2F07%2F21%2Fhow-scammers-are-hiding-their-phishing-trips-in-public-clouds%2F&tpx_cb=twttr.conversion.loadPixels

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 119
pragma: no-cache
last-modified: Wed, 05 Jan 2022 14:21:02 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 971f857922f940461fed0b25ab5cea385b816507553622746fb26d37f7cc06d2
x-transaction: 3e037d6fe56e7a51
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
471 B 138ms
119ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nxi3o&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=b7060c98-224b-4fcd-8025-6aeed15b86cf&tw_document_href=https%3A%2F%2Fblog.checkpoint.com%2F2020%2F07%2F21%2Fhow-scammers-are-hiding-their-phishing-trips-in-public-clouds%2F

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 112
pragma: no-cache
last-modified: Wed, 05 Jan 2022 14:21:02 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 2378b2fefb2a742d236b9eb66826fd4d6fefe46dc5cf1089b1ac04148915766f
x-transaction: b3335027e685a39a
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 5d3fc083-4c59-4342-a60b-010debb0ca4c.png
img.onesignal.com/t/ 25 KB
25 KB 446ms
445ms Image
image/png 2606:4700::6812:e134
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.onesignal.com/t/5d3fc083-4c59-4342-a60b-010debb0ca4c.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3789d9dadb2c581c2bc934bf054c49babb1d33cbe08fe34a68aef870b821d561

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:03 GMT
cf-cache-status: REVALIDATED
x-amz-request-id: H1GG4V1RZ48Z9J4R
x-amz-meta-cache-control: public, maxage=604800
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 25692
x-amz-id-2: JEkTf+UuNE1MEPLIQt0cunKVe65r7c+Qu2f6q7jbGo3FV+y/oU/QPNYkgRWzKr4T3NQsvTkrgbw=
last-modified: Wed, 21 Aug 2019 23:42:34 GMT
server: cloudflare
etag: "6428393c2d616b22b710383929f09491"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cache-control: public, max-age=2678400
accept-ranges: bytes
cf-ray: 6c8d59cc4ac2d600-MXP
expires: Sat, 05 Feb 2022 14:21:03 GMT

GET
H3 200 1692853834349189 Show response
connect.facebook.net/signals/config/ 305 KB
87 KB 32ms
16ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1692853834349189?v=2.9.48&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f69f074cc1ecce0a1c4d713e7d4f1a4460f6fe600100330fcb2418881e710d79

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 88855
x-xss-protection: 0
pragma: public
x-fb-debug: KR2ly/1p+yfLLPQoKBY4Qih4Zs8YLsNq7j/0BYUZogTt0H6EVGqEzzn44MmEsmKRc82jdEzCi4rtiqUepAc4ng==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 05 Jan 2022 14:21:02 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

429

li_sync
www.linkedin.com/px/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1641392462141&url=https%3A%2F%2Fblog.checkpoint.com%2F2020%2F07%2F21%2Fhow-scammers-are-hiding-their-phishing-trips-in-public-clouds%2F
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D51830%26time%3D1641392462141%26url%3Dhttps%253A%252F%252Fblog.checkpoint.com%252F...

0
174 B

103ms
102ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D51830%26time%3D1641392462141%26url%3Dhttps%253A%252F%252Fblog.checkpoint.com%252F2020%252F07%252F21%252Fhow-scammers-are-hiding-their-phishing-trips-in-public-clouds%252F%26liSync%3Dtrue
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 05 Jan 2022 14:21:02 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: DB3F43742A754ECA82F216A4FBCDE182 Ref B: FRAEDGE1521 Ref C: 2022-01-05T14:21:02Z
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
cache-control: no-cache, no-store
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXU1naxn/IBYzCwNAqQvQ==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Wed, 05 Jan 2022 14:21:02 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: C9F99C399B7B404D8AF2A85EBDCE6086 Ref B: FRAEDGE1521 Ref C: 2022-01-05T14:21:02Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D51830%26time%3D1641392462141%26url%3Dhttps%253A%252F%252Fblog.checkpoint.com%252F2020%252F07%252F21%252Fhow-scammers-are-hiding-their-phishing-trips-in-public-clouds%252F%26liSync%3Dtrue
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXU1nav64f5TOf1Ty62OA==

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/161/ 11 KB
5 KB 19ms
19ms Script
application/x-javascript 23.2.173.2
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/161/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.2.173.2 Haarlem, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-2-173-2.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 14:21:02 GMT
Content-Encoding: gzip
Last-Modified: Wed, 08 Sep 2021 00:38:21 GMT
Server: AkamaiNetStorage
ETag: "0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4681
Expires: Fri, 15 Apr 2022 14:21:02 GMT

POST
H/1.1 200
OK visitWebPage
750-dqh-528.mktoresp.com/webevents/ 2 B
311 B 393ms
97ms Ping
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://750-dqh-528.mktoresp.com/webevents/visitWebPage?_mchNc=1641392462169&_mchCn=&_mchId=750-DQH-528&_mchTk=_mch-checkpoint.com-1641392462168-68204&_mchHo=blog.checkpoint.com&_mchPo=&_mchRu=%2F2020%2F07%2F21%2Fhow-scammers-are-hiding-their-phishing-trips-in-public-clouds%2F&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/161/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://blog.checkpoint.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Wed, 05 Jan 2022 14:21:03 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 5ddd4434-1e75-4b67-b40d-5b0b093097ab

GET
H2 200 /
www.facebook.com/tr/ 44 B
295 B 58ms
19ms Image
image/gif 2a03:2880:f158:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1692853834349189&ev=PageView&dl=https%3A%2F%2Fblog.checkpoint.com%2F2020%2F07%2F21%2Fhow-scammers-are-hiding-their-phishing-trips-in-public-clouds%2F&rl=&if=false&ts=1641392462198&sw=1600&sh=1200&v=2.9.48&r=stable&ec=0&o=30&fbp=fb.1.1641392462196.1620820621&it=1641392462112&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f158:181:face:b00c:0:25de London, United Kingdom, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 14:21:02 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Wed, 05 Jan 2022 14:21:02 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 192ms
191ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=36bb1002832400004ea9d561fe0000000d0b0300&session=36d119df-58e5-43c0-803f-30358630257a&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2005%20Jan%202022%2014%3A21%3A02%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2005%20Jan%202022%2014%3A21%3A01%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Check%20Point%20researchers%20warn%20and%20cite%20an%20example%20of%20a%20fast-growing%20trend%20in%20which%20hackers%20are%20concealing%20phishing%20attacks%20on%20Google%20Cloud%20Services.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%5Cn%20%20%20%20%20%20%20%20How%20scammers%20are%20hiding%20their%20phishing%20trips%20in%20public%20clouds%20%20%20%20%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblog.checkpoint.com%2F2020%2F07%2F21%2Fhow-scammers-are-hiding-their-phishing-trips-in-public-clouds%2F&pageViewId=d2af8fea-b575-4a8d-8935-537c74fc21d5&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 14:21:03 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Tue, 05 Oct 2021 22:17:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615ccf10-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 7F36 0
18 B 40ms
19ms Document
text/plain 2a03:2880:f158:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f158:181:face:b00c:0:25de London, United Kingdom, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
Origin: https://blog.checkpoint.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/

Response headers

content-type: text/plain
access-control-allow-origin: https://blog.checkpoint.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority: u=3,i
date: Wed, 05 Jan 2022 14:21:03 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 192ms
192ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=36bb1002832400004ea9d561fe0000000d0b0300&session=36d119df-58e5-43c0-803f-30358630257a&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2005%20Jan%202022%2014%3A21%3A03%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2005%20Jan%202022%2014%3A21%3A02%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%222006%22%7D&isIframe=false&m=%7B%22description%22%3A%22Check%20Point%20researchers%20warn%20and%20cite%20an%20example%20of%20a%20fast-growing%20trend%20in%20which%20hackers%20are%20concealing%20phishing%20attacks%20on%20Google%20Cloud%20Services.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%5Cn%20%20%20%20%20%20%20%20How%20scammers%20are%20hiding%20their%20phishing%20trips%20in%20public%20clouds%20%20%20%20%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblog.checkpoint.com%2F2020%2F07%2F21%2Fhow-scammers-are-hiding-their-phishing-trips-in-public-clouds%2F&pageViewId=d2af8fea-b575-4a8d-8935-537c74fc21d5&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 14:21:04 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Tue, 05 Oct 2021 22:17:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615ccf10-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 190ms
190ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=36bb1002832400004ea9d561fe0000000d0b0300&session=36d119df-58e5-43c0-803f-30358630257a&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2005%20Jan%202022%2014%3A21%3A04%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2005%20Jan%202022%2014%3A21%3A03%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%223008%22%7D&isIframe=false&m=%7B%22description%22%3A%22Check%20Point%20researchers%20warn%20and%20cite%20an%20example%20of%20a%20fast-growing%20trend%20in%20which%20hackers%20are%20concealing%20phishing%20attacks%20on%20Google%20Cloud%20Services.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%5Cn%20%20%20%20%20%20%20%20How%20scammers%20are%20hiding%20their%20phishing%20trips%20in%20public%20clouds%20%20%20%20%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblog.checkpoint.com%2F2020%2F07%2F21%2Fhow-scammers-are-hiding-their-phishing-trips-in-public-clouds%2F&pageViewId=d2af8fea-b575-4a8d-8935-537c74fc21d5&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 14:21:05 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Tue, 05 Oct 2021 22:17:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615ccf10-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 192ms
191ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=36bb1002832400004ea9d561fe0000000d0b0300&session=36d119df-58e5-43c0-803f-30358630257a&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2005%20Jan%202022%2014%3A21%3A05%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2005%20Jan%202022%2014%3A21%3A04%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%224011%22%7D&isIframe=false&m=%7B%22description%22%3A%22Check%20Point%20researchers%20warn%20and%20cite%20an%20example%20of%20a%20fast-growing%20trend%20in%20which%20hackers%20are%20concealing%20phishing%20attacks%20on%20Google%20Cloud%20Services.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%5Cn%20%20%20%20%20%20%20%20How%20scammers%20are%20hiding%20their%20phishing%20trips%20in%20public%20clouds%20%20%20%20%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblog.checkpoint.com%2F2020%2F07%2F21%2Fhow-scammers-are-hiding-their-phishing-trips-in-public-clouds%2F&pageViewId=d2af8fea-b575-4a8d-8935-537c74fc21d5&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 14:21:06 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:57:20 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e502810-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 189ms
189ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=36bb1002832400004ea9d561fe0000000d0b0300&session=36d119df-58e5-43c0-803f-30358630257a&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2005%20Jan%202022%2014%3A21%3A06%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2005%20Jan%202022%2014%3A21%3A05%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225012%22%7D&isIframe=false&m=%7B%22description%22%3A%22Check%20Point%20researchers%20warn%20and%20cite%20an%20example%20of%20a%20fast-growing%20trend%20in%20which%20hackers%20are%20concealing%20phishing%20attacks%20on%20Google%20Cloud%20Services.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%5Cn%20%20%20%20%20%20%20%20How%20scammers%20are%20hiding%20their%20phishing%20trips%20in%20public%20clouds%20%20%20%20%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fblog.checkpoint.com%2F2020%2F07%2F21%2Fhow-scammers-are-hiding-their-phishing-trips-in-public-clouds%2F&pageViewId=d2af8fea-b575-4a8d-8935-537c74fc21d5&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Wed, 05 Jan 2022 14:21:07 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:57:20 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e502810-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 wxbvs5zxy7iy.js Show response
js.driftt.com/include/1641392700000/ 218 KB
62 KB 186ms
169ms Script
application/javascript 18.66.112.41

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1641392700000/wxbvs5zxy7iy.js

Requested by

Host: blog.checkpoint.com
URL: https://blog.checkpoint.com/2020/07/21/how-scammers-are-hiding-their-phishing-trips-in-public-clouds/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

40432b0e3f615381a012653f21171da44508deca9cbc85ee01ba5e10dd8b4319

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-version-id: LAroroDHNSly7ZjXt4S4khfQ.aBm7WxA
content-encoding: gzip
etag: W/"a6398b7de1ed8be209da4792254a654b"
x-amz-cf-pop: FRA56-P5
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:53:54 GMT
server: nginx
date: Wed, 05 Jan 2022 14:21:07 GMT
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 2QJoRmJ5wCsW9FrW6Opd66Wsog2pJwebNWxZCVW-G-KWp35cFzcCIw==

GET
H2 200 core Show response
js.driftt.com/ Frame 34A6 2 KB
1 KB 63ms
62ms Document
text/html 18.66.112.41

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0a777eb4-0e96-4eb2-a789-df1901ed2cab&sessionStarted=1641392467.248&campaignRefreshToken=58abc3aa-1f0f-4e67-a97b-5d498b6d709e&hideController=false&pageLoadStartTime=1641392461008&mode=CHAT&driftEnableLog=false

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1641392700000/wxbvs5zxy7iy.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

2e202da16f6f8f094812dd4debdbc67426c6a8174a44de7578c87282f1f5c684

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blog.checkpoint.com/

Response headers

content-type: text/html; charset=utf-8
server: nginx
last-modified: Tue, 04 Jan 2022 15:53:42 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: uRWuQt0bq5kQDkt9_YfSQYqkzagYjXE1
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Wed, 05 Jan 2022 14:21:07 GMT
cache-control: no-cache
etag: W/"e8ad35b9fde61f2147c4e07907d0291c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
x-amz-cf-id: WAnjEQIQH9UAnP8lfYYPNMpLkVfh2GQS2ypNH9UoFd8-S2eyYpuLHQ==

GET chat
js.driftt.com/core/ Frame FAF5 0
0

GET
H2 200 runtime~main.20f5d2c6.js Show response
js.driftt.com/core/assets/js/ Frame 34A6 6 KB
3 KB 7ms
7ms Script
application/javascript 18.66.112.41

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.20f5d2c6.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0a777eb4-0e96-4eb2-a789-df1901ed2cab&sessionStarted=1641392467.248&campaignRefreshToken=58abc3aa-1f0f-4e67-a97b-5d498b6d709e&hideController=false&pageLoadStartTime=1641392461008&mode=CHAT&driftEnableLog=false

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

f214640891ce14748be49cfef00a7827958e57945215eb2a3fa3f4d8b244c4fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0a777eb4-0e96-4eb2-a789-df1901ed2cab&sessionStarted=1641392467.248&campaignRefreshToken=58abc3aa-1f0f-4e67-a97b-5d498b6d709e&hideController=false&pageLoadStartTime=1641392461008&mode=CHAT&driftEnableLog=false
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 80846
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:19 GMT
server: nginx
etag: W/"8cfe788c9e2d44b32f70125bdc9732d0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: ZKO7d1nA6GrptWXF1VxxMY2wDBSEijqF
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: FvsnmEUEtFK6uyjWTAEhUsvc-DaxH6nz6CiqgIT1GAgEE5TEnazYfw==

GET
H2 200 5.b4ccdd57.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 34A6 58 KB
20 KB 8ms
8ms Script
application/javascript 18.66.112.41

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/5.b4ccdd57.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

9d8f8c89a5f7c90adc5196d1c10fe3e8c46d16cb8d24de13ade83de53183027d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0a777eb4-0e96-4eb2-a789-df1901ed2cab&sessionStarted=1641392467.248&campaignRefreshToken=58abc3aa-1f0f-4e67-a97b-5d498b6d709e&hideController=false&pageLoadStartTime=1641392461008&mode=CHAT&driftEnableLog=false
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 80846
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:18 GMT
server: nginx
etag: W/"bf2b7dc96b40587d388df8918a276f1d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: rlqnQvHWjB4kDZlydkAKa7LRajgzy9Gl
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: BgWKfailAhooXH3wVftUdab5RwEMxAp30Mf8J8lGqjRal_V_cy4-ww==

GET
H2 200 main~493df0b3.91d188cd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 34A6 6 KB
3 KB 9ms
9ms Script
application/javascript 18.66.112.41

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.91d188cd.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

dcfc540946183ee12e6ccb43e706ad1a30b4f0205c25adcfa316829075f94a31

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0a777eb4-0e96-4eb2-a789-df1901ed2cab&sessionStarted=1641392467.248&campaignRefreshToken=58abc3aa-1f0f-4e67-a97b-5d498b6d709e&hideController=false&pageLoadStartTime=1641392461008&mode=CHAT&driftEnableLog=false
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 80846
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:19 GMT
server: nginx
etag: W/"364091b90499473799e7470f551ae597"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 1JY.0LVfNng8iNIWI44BrilEq.Gn8MTC
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 916W1lnx9GAGiw5RDhhhYF5Hk9oAgPdOi_pWjc24jKS9E8b6d-kYQg==

GET
H2 200 43.bf52ab96.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 34A6 47 KB
14 KB 8ms
8ms Script
application/javascript 18.66.112.41

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/43.bf52ab96.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.20f5d2c6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

bd713db29fb234eb7584927050df71683e11b7b72bda4fcf72a88f8a7ff2f56d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0a777eb4-0e96-4eb2-a789-df1901ed2cab&sessionStarted=1641392467.248&campaignRefreshToken=58abc3aa-1f0f-4e67-a97b-5d498b6d709e&hideController=false&pageLoadStartTime=1641392461008&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 80847
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"4ab965f0d26a973cf1be72a39d537999"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: SIJLtOk7PXIgJIf54NBJQngGjZ1AQW3g
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: v4fHE9jskUzlB6x-csf1th9JVyts2rA570sDWsT6EqEcX_xpPcbb_g==

GET
H2 200 18.8ef42267.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 34A6 44 KB
13 KB 9ms
8ms Script
application/javascript 18.66.112.41

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.8ef42267.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.20f5d2c6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

49c6f7925a020059af53cab3baa5d2ea485e6807744ba07f1b2e90ee47266a44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0a777eb4-0e96-4eb2-a789-df1901ed2cab&sessionStarted=1641392467.248&campaignRefreshToken=58abc3aa-1f0f-4e67-a97b-5d498b6d709e&hideController=false&pageLoadStartTime=1641392461008&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 30 Sep 2021 15:45:04 GMT
content-encoding: gzip
age: 8375764
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 30 Sep 2021 14:53:53 GMT
server: nginx
etag: W/"0c6f51f22b2a4bddd966a92b56c18e29"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: epMuKR1SK2idtGdfgpFU1pzsaoH_Wikv
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: xVOmodfyR54RX8sAUN3TGkPj4TY0WrkkpV1PCT02mKqjeBPzWAqWFA==

GET
H2 200 37.dc112dfd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 34A6 25 KB
8 KB 9ms
9ms Script
application/javascript 18.66.112.41

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/37.dc112dfd.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.20f5d2c6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

9cd7629d2e66537eb15542646bfd16cd461aaf18592c35f19ce7d67ada586635

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0a777eb4-0e96-4eb2-a789-df1901ed2cab&sessionStarted=1641392467.248&campaignRefreshToken=58abc3aa-1f0f-4e67-a97b-5d498b6d709e&hideController=false&pageLoadStartTime=1641392461008&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 80847
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"391f6f28819c5b154653979d5154c888"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: A01_.TOyslfHN6C7mHM2iYp5F_NuODuW
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8WfnMUqjK6vHq9FVyuFLZIYIbsMDIgfddfq_7PyWvZ6ioAJCRuocvA==

GET
H2 200 16.10d76686.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 34A6 16 KB
5 KB 10ms
9ms Script
application/javascript 18.66.112.41

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/16.10d76686.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.20f5d2c6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

1cbf80f7d71564dc48af2c5d6bb5d15fc2aec0d541101c5eedf84bad1b908cab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0a777eb4-0e96-4eb2-a789-df1901ed2cab&sessionStarted=1641392467.248&campaignRefreshToken=58abc3aa-1f0f-4e67-a97b-5d498b6d709e&hideController=false&pageLoadStartTime=1641392461008&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 80847
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"c16e855d0a26bf91ae3cc32cdbfa3ad6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: mzB2ul0u_48ftIGEd6phwcoTfextzATL
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: WLtLXt11USlt3_ufL7X3wlMPlrbqXBOhAeUXCRowNTIIRxwgsC4pYg==

GET
H2 200 21.8ac5d777.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 34A6 72 KB
22 KB 12ms
12ms Script
application/javascript 18.66.112.41

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/21.8ac5d777.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.20f5d2c6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

4038a666dfd5af607a0374ad6e934cf1007e78da69329dbc341eaf757bb38beb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0a777eb4-0e96-4eb2-a789-df1901ed2cab&sessionStarted=1641392467.248&campaignRefreshToken=58abc3aa-1f0f-4e67-a97b-5d498b6d709e&hideController=false&pageLoadStartTime=1641392461008&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 80847
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"c39414a669b98ba4a25856ccdc1c1c1b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: PmO9yEa8J.DEQa9FEB2tMN_1Ccd5vo_f
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 0JRAoRXdm0bzw1qhIsuKVG8--aKBC-hSIU5WahC45SHHYXhnnKpD3Q==

GET
H2 200 34.801d3c89.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 34A6 16 KB
6 KB 13ms
13ms Script
application/javascript 18.66.112.41

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/34.801d3c89.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.20f5d2c6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

e41e2b5c9df3073d6f7da0080ad2f3eca4994ab372d2f65fa76b14f8868663ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0a777eb4-0e96-4eb2-a789-df1901ed2cab&sessionStarted=1641392467.248&campaignRefreshToken=58abc3aa-1f0f-4e67-a97b-5d498b6d709e&hideController=false&pageLoadStartTime=1641392461008&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 80847
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"fa218b0849860dbc5ceda153316c9c38"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: VLd3KMbDPd6s2pCiJkiLNxZPlKywvnnH
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: gzSFw1r_P-Lt8yOZS_d2PkCaddfD4pWnQZexySIm3WgJwzBvB7G-aw==

GET
H2 200 23.a53d721f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 34A6 59 KB
19 KB 13ms
13ms Script
application/javascript 18.66.112.41

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/23.a53d721f.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.20f5d2c6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0a777eb4-0e96-4eb2-a789-df1901ed2cab&sessionStarted=1641392467.248&campaignRefreshToken=58abc3aa-1f0f-4e67-a97b-5d498b6d709e&hideController=false&pageLoadStartTime=1641392461008&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 02:55:04 GMT
content-encoding: gzip
age: 5657164
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 29 Oct 2021 20:21:07 GMT
server: nginx
etag: W/"fe96cb8c4c390342c29d3c8cb0a4ca14"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 8P07cElTKzzatCQBMuaLbbzDn74Jxjfl
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: zNkBCWlo07nuq5ynLNLePjzNWzP8Gz3OKvtvXrIXE3CKB3U43o24kA==

GET
H2 200 11.8d62d6c4.chunk.js
js.driftt.com/core/assets/js/ Frame 34A6 91 KB
28 KB 14ms
14ms Script
application/javascript 18.66.112.41

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/11.8d62d6c4.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.20f5d2c6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0a777eb4-0e96-4eb2-a789-df1901ed2cab&sessionStarted=1641392467.248&campaignRefreshToken=58abc3aa-1f0f-4e67-a97b-5d498b6d709e&hideController=false&pageLoadStartTime=1641392461008&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 80847
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:16 GMT
server: nginx
etag: W/"8199a8634768214fc6204b18351f842d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: p_YagIEBvf.Qgp7hIJy74.J4YIszefj5
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: WFINGWVyeUlFNWyJ73gR1tuigGv0rZG2x7MiD1Fr0WLFDvpRN2qtvA==

GET
H2 200 10.937b0755.chunk.js
js.driftt.com/core/assets/js/ Frame 34A6 24 KB
7 KB 16ms
16ms Script
application/javascript 18.66.112.41

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/10.937b0755.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.20f5d2c6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0a777eb4-0e96-4eb2-a789-df1901ed2cab&sessionStarted=1641392467.248&campaignRefreshToken=58abc3aa-1f0f-4e67-a97b-5d498b6d709e&hideController=false&pageLoadStartTime=1641392461008&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 80847
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:16 GMT
server: nginx
etag: W/"e9243456e8ca8af97d77d525d5367d6b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 1OI8MdaO_2Zet9LQGrgpik7z8k_2AhIl
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 0LT8Fri0KFqhnT7LzoxkrVOaxRd2B_UIeFflDyDsRgaKGcd5dGl4xA==

GET
H2 200 14.2a01ddd6.chunk.js
js.driftt.com/core/assets/js/ Frame 34A6 62 KB
20 KB 16ms
16ms Script
application/javascript 18.66.112.41

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/14.2a01ddd6.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.20f5d2c6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0a777eb4-0e96-4eb2-a789-df1901ed2cab&sessionStarted=1641392467.248&campaignRefreshToken=58abc3aa-1f0f-4e67-a97b-5d498b6d709e&hideController=false&pageLoadStartTime=1641392461008&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 80847
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"6f457384188c98017d8d27281f3df6ad"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: KpoEpDmO7G9TLWLfSTzA1dytLAyREIfM
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: JRcw68OPf0oJTXsTengckuvQenO1m9ZPkvlpSykc7OP_TlCi33MrJA==

GET
H2 200 41.ef07ba02.chunk.js
js.driftt.com/core/assets/js/ Frame 34A6 0
0 18ms
17ms Script
application/javascript 18.66.112.41

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/41.ef07ba02.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.20f5d2c6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0a777eb4-0e96-4eb2-a789-df1901ed2cab&sessionStarted=1641392467.248&campaignRefreshToken=58abc3aa-1f0f-4e67-a97b-5d498b6d709e&hideController=false&pageLoadStartTime=1641392461008&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 80847
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"da03c1012cb0aaeb2041fa677a272d14"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 6OpxVYvZjRVHdu0KjdhZlusmExqFlB4E
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ibwxj3KCbpvUYoaGMJPrE26SrTbbYTfha1LUGEKcRvB18FU2NZ6OFQ==

GET
H2 200 35.0810b4b3.chunk.js
js.driftt.com/core/assets/js/ Frame 34A6 0
0 18ms
18ms Script
application/javascript 18.66.112.41

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.0810b4b3.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.20f5d2c6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0a777eb4-0e96-4eb2-a789-df1901ed2cab&sessionStarted=1641392467.248&campaignRefreshToken=58abc3aa-1f0f-4e67-a97b-5d498b6d709e&hideController=false&pageLoadStartTime=1641392461008&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 80847
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"4a61646db5420cc31cb60b9287d9f544"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: wDOiuCZSfZ.KHqNETPwI3S2a9GU0lEIR
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: N-YvbMHQN-sEhvODuYVm-GqdLvbmvEPuL-gDG4gHeYrPmwFGxsZ5qA==

GET
H2 200 26.d9eb886e.chunk.js
js.driftt.com/core/assets/js/ Frame 34A6 0
0 19ms
18ms Script
application/javascript 18.66.112.41

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/26.d9eb886e.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.20f5d2c6.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0a777eb4-0e96-4eb2-a789-df1901ed2cab&sessionStarted=1641392467.248&campaignRefreshToken=58abc3aa-1f0f-4e67-a97b-5d498b6d709e&hideController=false&pageLoadStartTime=1641392461008&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 80847
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"44c7301d8127e805fcdfcc1b00ddf2ea"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: EjkJtX0HE9ajSK4icA5a46UNajNAQcku
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: zxHo8MeILFwKoztHtXqgkRmO9QPigbhnN3Xe1ZAAoLrDgxaUFjS1ug==

GET 17.6c3c965c.chunk.js
js.driftt.com/core/assets/js/ Frame 34A6 0
0

GET 8.5b0bb1c3.chunk.css
js.driftt.com/core/assets/css/ Frame 34A6 0
0

GET 8.a50cfadf.chunk.js
js.driftt.com/core/assets/js/ Frame 34A6 0
0

GET 15.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 34A6 0
0

GET 15.ce99ce47.chunk.js
js.driftt.com/core/assets/js/ Frame 34A6 0
0

GET 22.e9578bb7.chunk.js
js.driftt.com/core/assets/js/ Frame 34A6 0
0

GET 13.f7469502.chunk.js
js.driftt.com/core/assets/js/ Frame 34A6 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s7.addthis.com
URL: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Domain: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1641392461008

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/17.6c3c965c.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/css/8.5b0bb1c3.chunk.css

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/8.a50cfadf.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/css/15.22abfce0.chunk.css

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/15.ce99ce47.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/22.e9578bb7.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/13.f7469502.chunk.js

Verdicts & Comments Add Verdict or Comment

110 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

21 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
blog.checkpoint.com/	1970-01-20 09:26:46	Name: __atuvc Value: 1%7C1
blog.checkpoint.com/	1970-01-19 23:56:34	Name: __atuvs Value: 61d5a94dacc295a8000
.checkpoint.com/	1969-12-31 23:59:59	Name: referralURL Value:
.checkpoint.com/	1970-01-20 17:27:44	Name: _ga Value: GA1.2.1074270023.1641392462
.checkpoint.com/	1970-01-19 23:57:58	Name: _gid Value: GA1.2.1734651685.1641392462
.6sc.co/	1970-01-20 17:27:44	Name: 6suuid Value: 36bb1002832400004ea9d561fe0000000d0b0300
.checkpoint.com/	1970-01-19 23:56:32	Name: _dc_gtm_UA-194688-3 Value: 1
.addthis.com/	1970-01-20 09:26:46	Name: uvc Value: 1%7C1
blog.checkpoint.com/	1970-01-20 00:06:37	Name: _an_uid Value: 0
blog.checkpoint.com/	1970-01-20 17:27:44	Name: _gd_visitor Value: eb9ecbb1-0c5c-4d5f-86a3-73f87232bfc8
blog.checkpoint.com/	1970-01-19 23:56:46	Name: _gd_session Value: 36d119df-58e5-43c0-803f-30358630257a
blog.checkpoint.com/	1970-01-20 17:27:44	Name: _gd_svisitor Value: 36bb1002832400004ea9d561fe0000000d0b0300
.addthis.com/	1970-01-20 09:26:46	Name: loc Value: MDAwMDBFVURFQlcyMjgyMTg5ODAwNDAwMDBDSA==
.checkpoint.com/	1970-01-20 17:27:44	Name: _mkto_trk Value: id:750-DQH-528&token:_mch-checkpoint.com-1641392462168-68204
.checkpoint.com/	1970-01-20 02:06:08	Name: _fbp Value: fb.1.1641392462196.1620820621
.twitter.com/	1970-01-20 17:27:44	Name: personalization_id Value: "v1_j6ha8x9LfZmEt0OoDvlBmQ=="
.linkedin.com/	1970-01-20 00:39:44	Name: UserMatchHistory Value: AQLx55SV6M2LXAAAAX4qnVwvhe5ClHkRz0gZBV8yr4T8GSJWbd1qEVAIoByFA9jn3eCSR0JO5X3DgA
.linkedin.com/	1970-01-20 00:39:44	Name: AnalyticsSyncHistory Value: AQKmCYzYLMtIRQAAAX4qnVwwslhTmhNP-aI2ApCVe9F4Xst9sL5SV5q4Ok0mxf9TKX6lwsi6EKzGixvF7jz7uw
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 17:28:26	Name: bcookie Value: "v=2&b3649eef-d3c2-44fe-8999-da13454d2db2"
.linkedin.com/	1970-01-19 23:57:58	Name: lidc Value: "b=VGST09:s=V:r=V:a=V:p=V:g=2180:u=1:x=1:i=1641392462:t=1641478862:v=2:sig=AQH7mQhl4y4ZdB3hj074y6s57-rpBL3N"

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D51830%26time%3D1641392462141%26url%3Dhttps%253A%252F%252Fblog.checkpoint.com%252F2020%252F07%252F21%252Fhow-scammers-are-hiding-their-phishing-trips-in-public-clouds%252F%26liSync%3Dtrue Message: Failed to load resource: the server responded with a status of 429 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

750-dqh-528.mktoresp.com
analytics.twitter.com
b.6sc.co
blog.checkpoint.com
c.6sc.co
cdn.onesignal.com
code.jquery.com
connect.facebook.net
epsilon.6sense.com
img.onesignal.com
j.6sc.co
js.driftt.com
m.addthis.com
maxcdn.bootstrapcdn.com
munchkin.marketo.net
onesignal.com
px.ads.linkedin.com
s7.addthis.com
secure.adnxs.com
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
v1.addthisedge.com
www.checkpoint.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
z.moatads.com
js.driftt.com
s7.addthis.com
104.111.233.140
104.244.42.197
104.244.42.3
104.80.228.119
104.84.56.126
141.193.213.20
18.66.112.41
185.33.221.88
192.28.144.124
199.232.148.157
2.18.235.40
2001:4de0:ac18::1:a:2a
23.2.173.2
2606:4700::6812:bcf
2606:4700::6812:e134
2606:4700::6812:e234
2620:1ec:21::14
2a00:1450:4001:803::2004
2a00:1450:4001:80f::2008
2a00:1450:4001:829::2003
2a00:1450:4001:830::200e
2a00:1450:400c:c08::9d
2a02:26f0:6b::5f64:615a
2a02:26f0:6c00:297::38f0
2a03:2880:f045:10:face:b00c:0:3
2a03:2880:f158:181:face:b00c:0:25de
35.158.252.9
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
0fb1bbca73646e8e2b93c82e8d8b219647b13d4b440c48e338290b9a685b8de1
0fc686423c26cb1030032fd7e4f2dd664c4b08517a8990c0b46269dd4e01910b
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
139e504307c7753224bfff29405576a6816be9a64ceb5ba6f66f701fe989370c
179d0859bd448c9d778463de4df53108b80046e4354aaf7c00a2fc0b5d021bbe
199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1
1cbf80f7d71564dc48af2c5d6bb5d15fc2aec0d541101c5eedf84bad1b908cab
1e744d96d8077c6b8acfbe1831583a0c4bee5241c3f80e9fa80e80572e19d2e7
2580e1986fce375c6ed96ac5eb8974cab06d2848b997560bb3c7f9dd5581c53e
2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a
2866bb4df6d3efd7e9c5c0fa846a92e04a8e96e5af8a5ddb8068a3de023a4b41
2a77e167a09c32088184c0931b7d0a325daf8dada0a036b6be6797e74e9d60d3
2e202da16f6f8f094812dd4debdbc67426c6a8174a44de7578c87282f1f5c684
30581cee80fdc00a20dde03fe67c68d41453254863b15e9aefa09314eb342d2d
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
3789d9dadb2c581c2bc934bf054c49babb1d33cbe08fe34a68aef870b821d561
4038a666dfd5af607a0374ad6e934cf1007e78da69329dbc341eaf757bb38beb
40432b0e3f615381a012653f21171da44508deca9cbc85ee01ba5e10dd8b4319
49c6f7925a020059af53cab3baa5d2ea485e6807744ba07f1b2e90ee47266a44
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb
4eabdbc55715edcfef23aef35a30d6dc56f207e057c5b81b821f858121bb4a7b
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
568e9a539ceb8854e87abfc39b4bca071eb0b6a314de9f9a5a3b73b6801c3be2
571930eac2354bf751d8efe096b9011110b0d82c11db07da5bb19a6cb19592c0
5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba
5cafe00d3c4778d7be3b4c3a7c4f7fa86e4907631162b3127493198fb43a418e
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
62e5ee83717cdbc8480b12e00ffc263a60399b462f88830636dbd495d47f6657
7138dd4ecf8557fcd49ef967ad2c51664aebd1f99fc0e3a5209719b24fb2b168
71484898ccbb0ec3975f40c32741bf030861bc7a316713e8a491e2b3a1abb5e0
76911468519fda64950773694e032587649fe089cf454e1f4afa005cd191772c
77b472b6755aa7a5fe017695a793329fc05975805feb11e41ba11f670807661d
7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d
7d6ba13b690dee4af8ac51913d50f8509c65be9516aa24e2f761b3a1aa96dbd3
7f9e667632eb739b2d6b1bf57ee3ddb298e5358d11c613b571800247a90c371b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
88522cca257c7b55886862e9549236b005c2fcbb1246bcd986621476739c2127
8d980fa0fe8e5717bce42de7da9b8e88fff442f9d1a7ce591c2a4ab0507b8575
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
9cd7629d2e66537eb15542646bfd16cd461aaf18592c35f19ce7d67ada586635
9d8f8c89a5f7c90adc5196d1c10fe3e8c46d16cb8d24de13ade83de53183027d
9e000e7805a03b275608d64f0ee40fc1140ea80bcb3daa6bc9a5406dd107f9d0
9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afe
9ef5cf262e025fe18d8648cb344729b872b205f3b96e3183fc4d83ced5112201
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a7d7aa09becb2494f61a590c32dd433a7b0daf2bddf29c5f622ac84a4c197007
a8da941d8a446516c824ebc9fb77b42e6b92c6deed1daed266bd821ed27bc516
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6
b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a
b8aaffdb6fd495c82977176b9267b8ff2c4fc68dafaa39cf9497d6ed3a5fd5c7
b9462c3d8fc4e698687d6fa7efdd3123606f6e235a179e7cb12cdb38f8ed7978
b9d991f032b0f626a8b215af39aaae7ad4e1e262c9fad049b6f12a4fe7afb9bc
bb50f23bb5bd7abf0a5dbdfb1319b9ce06bdabcb8a61a99905260f29d4d3d1f5
bcdf608103a7e83ebafda51aec81029da1a3bb33bba4246d233c243f86f681ec
bd713db29fb234eb7584927050df71683e11b7b72bda4fcf72a88f8a7ff2f56d
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537
c4b05f12d91c9f8b7c3bec26e49d7889b53885ed1b08e317e626490cba2c2967
c718c45f165e97d858ddd804cda7aa221e545ec8b39e3cc9ff274314eb21b850
d1277b30387b4b95870784da4028fccbed1b2164bb3a421a70cd70add65b89c8
d245d96784beee8a8652270aaa63264158ef3a6aae0c4f76d051ee14c4de7d98
d3af788ef77d8641a8f04fc3ea3864e7040dd857356c22d8b55c333c588ed488
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dcfc540946183ee12e6ccb43e706ad1a30b4f0205c25adcfa316829075f94a31
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e1f68ea963390597d0f2f71da80b22a580701b6a2eac5fad4a1d57c3f9b92770
e3111006bd360d7e022385e73923dbec02fcf791700ee201958e711a4d304623
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e41e2b5c9df3073d6f7da0080ad2f3eca4994ab372d2f65fa76b14f8868663ec
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f100c6915ea9ca5ae0eeb12857bc1a61f22f2c202ee854b3aea760bb9a6d1f71
f214640891ce14748be49cfef00a7827958e57945215eb2a3fa3f4d8b244c4fd
f2a39591ca8fc09488c7b959cb4fb364c56ce94900504c8592b663c4f88c7222
f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed
f69f074cc1ecce0a1c4d713e7d4f1a4460f6fe600100330fcb2418881e710d79
f80b0710e5536d05a2407c4d80a3d532694ded9b19396ae7b875371981a7c903
faee7815a5fd27e938d1e01c8392b66332024908eb118048f608eee671371df6
fb8acb6ca1149529e5e25600bfaaa2aa77a353369dd5c8f63869f63a42279db4
fe2df9f6df4b4a8d7174d259f563b8d9e28e4c03f8f4092fd9db6044e0e64c32
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

blog.checkpoint.com Open in urlscan Pro 141.193.213.20 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

108 Requests

91 %HTTPS

52 %IPv6

25 Domains

32 Subdomains

28 IPs

5 Countries

2008 kBTransfer

4463 kBSize

21 Cookies

132 Outgoing links

Redirected requests

108 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

blog.checkpoint.com Open in urlscan Pro
141.193.213.20 Public Scan

Screenshot
Live screenshot

Full Image

108
Requests

91 %
HTTPS

52 %
IPv6

25
Domains

32
Subdomains

28
IPs

5
Countries

2008 kB
Transfer

4463 kB
Size

21
Cookies

108 HTTP transactions
2 data transactions