research.checkpoint.com Open in urlscan Pro
2a02:26f0:6c00:19e::38f0 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Submission: On May 06 via api (May 6th 2019, 10:09:51 pm UTC) from CH

Summary HTTP 82 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 28 IPs in 4 countries across 23 domains to perform 82 HTTP transactions. The main IP is 2a02:26f0:6c00:19e::38f0, located in European Union and belongs to AKAMAI-ASN1, US. The main domain is research.checkpoint.com.
TLS certificate: Issued by DigiCert ECC Secure Server CA on October 29th 2018. Valid for: a year.

This is the only time research.checkpoint.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 8	2a02:26f0:6c0... 2a02:26f0:6c00:19e::38f0	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
29	2a02:26f0:6c0... 2a02:26f0:6c00:18d::38f0	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	23.111.9.35 23.111.9.35	33438 (HIGHWINDS2) (HIGHWINDS2 - Highwinds Network Group)
1	205.185.208.52 205.185.208.52	20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group)
8	23.37.56.8 23.37.56.8	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	151.139.237.11 151.139.237.11	33438 (HIGHWINDS2) (HIGHWINDS2 - Highwinds Network Group)
2	104.96.160.100 104.96.160.100	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	2a00:1450:400... 2a00:1450:4001:824::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a04:4e42::621 2a04:4e42::621	54113 (FASTLY) (FASTLY - Fastly)
4	2a00:1450:400... 2a00:1450:4001:81f::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a02:26f0:6c0... 2a02:26f0:6c00:293::3adf	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700::68... 2606:4700::6813:9408	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	151.101.120.157 151.101.120.157	54113 (FASTLY) (FASTLY - Fastly)
2	23.43.119.71 23.43.119.71	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f01... 2a03:2880:f01c:216:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK - Facebook)
1	2.18.234.190 2.18.234.190	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	2.16.186.243 2.16.186.243	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER - Twitter Inc.)
4	95.100.73.233 95.100.73.233	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	151.101.194.2 151.101.194.2	54113 (FASTLY) (FASTLY - Fastly)
1	50.31.142.19 50.31.142.19	22075 (AS-OUTBRAIN) (AS-OUTBRAIN - Outbrain)
1	192.28.144.124 192.28.144.124	53580 (MARKETO) (MARKETO - MARKETO)
2 2	2a00:1450:400... 2a00:1450:400c:c00::9a	15169 (GOOGLE) (GOOGLE - Google LLC)
2 2	2a00:1450:400... 2a00:1450:4001:825::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:81a::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
1 3	18.184.119.244 18.184.119.244	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	2a03:2880:f11... 2a03:2880:f11c:8083:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK - Facebook)
2	23.37.48.116 23.37.48.116	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
2 3	2620:119:50e0... 2620:119:50e0:105::6cae:b15	14413 (LINKEDIN) (LINKEDIN - LinkedIn Corporation)
1 1	2620:109:c002... 2620:109:c002::6cae:a0a	14413 (LINKEDIN) (LINKEDIN - LinkedIn Corporation)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER - Twitter Inc.)
82	28

8 2a02:26f0:6c00:19e::38f0 (European Union) 1 redirects

ASN20940 (AKAMAI-ASN1, US)

research.checkpoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

29 2a02:26f0:6c00:18d::38f0 (European Union)

ASN20940 (AKAMAI-ASN1, US)

research.checkpoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.111.9.35 (Phoenix, United States)

ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.208.52 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 23.37.56.8 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-37-56-8.deploy.static.akamaitechnologies.com

sc1.checkpoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.237.11 (Dallas, United States)

ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US)

cdn.rawgit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.96.160.100 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-96-160-100.deploy.static.akamaitechnologies.com

platform-api.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
buttons-config.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::621 (European Union)

ASN54113 (FASTLY - Fastly, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:81f::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:293::3adf (European Union)

ASN20940 (AKAMAI-ASN1, US)

sjs.bizographics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:9408 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.120.157 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.43.119.71 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-43-119-71.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:216:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.234.190 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-234-190.deploy.static.akamaitechnologies.com

amplify.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.186.243 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-243.deploy.static.akamaitechnologies.com

c.sharethis.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.133 (San Francisco, United States)

ASN13414 (TWITTER - Twitter Inc., US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 95.100.73.233 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a95-100-73-233.deploy.static.akamaitechnologies.com

platform-cdn.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.194.2 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)

tr.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 50.31.142.19 (Chicago, United States)

ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US)
PTR: chi.outbrain.com

amplifypixel.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (San Mateo, United States)

ASN53580 (MARKETO - MARKETO, Inc., US)

750-dqh-528.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9a (Ireland) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:825::2004 (Ireland) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81a::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.184.119.244 (Cambridge, United States) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-184-119-244.eu-central-1.compute.amazonaws.com

l.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8083:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.37.48.116 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-37-48-116.deploy.static.akamaitechnologies.com

t.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:119:50e0:105::6cae:b15 (United States) 2 redirects

ASN14413 (LINKEDIN - LinkedIn Corporation, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:109:c002::6cae:a0a (United States) 1 redirects

ASN14413 (LINKEDIN - LinkedIn Corporation, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (San Francisco, United States)

ASN13414 (TWITTER - Twitter Inc., US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
45	checkpoint.com 1 redirects research.checkpoint.com sc1.checkpoint.com	9 MB
11	sharethis.com 1 redirects platform-api.sharethis.com buttons-config.sharethis.com platform-cdn.sharethis.com l.sharethis.com t.sharethis.com	35 KB
4	linkedin.com 3 redirects px.ads.linkedin.com www.linkedin.com	1 KB
4	google-analytics.com www.google-analytics.com	37 KB
3	outbrain.com amplify.outbrain.com tr.outbrain.com amplifypixel.outbrain.com	3 KB
2	facebook.com www.facebook.com	322 B
2	google.de www.google.de	218 B
2	google.com 2 redirects www.google.com	359 B
2	doubleclick.net 2 redirects stats.g.doubleclick.net	318 B
2	facebook.net connect.facebook.net	61 KB
2	marketo.net munchkin.marketo.net	6 KB
1	twitter.com analytics.twitter.com	266 B
1	mktoresp.com 750-dqh-528.mktoresp.com	272 B
1	t.co t.co	167 B
1	consensu.org c.sharethis.mgr.consensu.org
1	ads-twitter.com static.ads-twitter.com	2 KB
1	crazyegg.com script.crazyegg.com	499 B
1	bizographics.com sjs.bizographics.com	5 KB
1	jsdelivr.net cdn.jsdelivr.net	673 B
1	googletagmanager.com www.googletagmanager.com	34 KB
1	rawgit.com cdn.rawgit.com	8 KB
1	jquery.com code.jquery.com	30 KB
1	fontawesome.com use.fontawesome.com	13 KB
82	23

	Domain	Requested by
37	research.checkpoint.com	1 redirects research.checkpoint.com
8	sc1.checkpoint.com	research.checkpoint.com
4	platform-cdn.sharethis.com	research.checkpoint.com
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com research.checkpoint.com
3	px.ads.linkedin.com	2 redirects
3	l.sharethis.com	1 redirects research.checkpoint.com
2	t.sharethis.com	platform-api.sharethis.com t.sharethis.com
2	www.facebook.com	research.checkpoint.com connect.facebook.net
2	www.google.de	research.checkpoint.com
2	www.google.com	2 redirects
2	stats.g.doubleclick.net	2 redirects
2	connect.facebook.net	research.checkpoint.com connect.facebook.net
2	munchkin.marketo.net	research.checkpoint.com munchkin.marketo.net
1	analytics.twitter.com	static.ads-twitter.com
1	www.linkedin.com	1 redirects
1	750-dqh-528.mktoresp.com	munchkin.marketo.net
1	amplifypixel.outbrain.com	research.checkpoint.com
1	tr.outbrain.com	research.checkpoint.com
1	t.co	research.checkpoint.com
1	c.sharethis.mgr.consensu.org	platform-api.sharethis.com
1	amplify.outbrain.com	research.checkpoint.com
1	static.ads-twitter.com	www.googletagmanager.com
1	script.crazyegg.com	www.googletagmanager.com
1	sjs.bizographics.com	www.googletagmanager.com
1	buttons-config.sharethis.com	platform-api.sharethis.com
1	cdn.jsdelivr.net	cdn.rawgit.com
1	www.googletagmanager.com	research.checkpoint.com
1	platform-api.sharethis.com	research.checkpoint.com
1	cdn.rawgit.com	research.checkpoint.com
1	code.jquery.com	research.checkpoint.com
1	use.fontawesome.com	research.checkpoint.com
82	31

This site contains links to these domains. Also see Links.

Domain
www.checkpoint.com
www.facebook.com
plus.google.com
www.linkedin.com
twitter.com
threatemulation.checkpoint.com
www.cpcheckme.com
threatmap.checkpoint.com
mfa.gov.kz
blog.checkpoint.com
bit.ly

Subject Issuer	Validity	Valid
*.checkpoint.com DigiCert ECC Secure Server CA	`2018-10-29` - `2020-01-28`	a year	crt.sh
*.fontawesome.com DigiCert SHA2 Secure Server CA	`2018-09-17` - `2019-11-21`	a year	crt.sh
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh
rawgit.com COMODO RSA Domain Validation Secure Server CA	`2018-12-29` - `2020-01-13`	a year	crt.sh
*.sharethis.com DigiCert SHA2 Secure Server CA	`2018-12-16` - `2020-03-16`	a year	crt.sh
*.google-analytics.com Google Internet Authority G3	`2019-04-16` - `2019-07-09`	3 months	crt.sh
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-05-01` - `2020-04-23`	a year	crt.sh
js.bizographics.com DigiCert SHA2 Secure Server CA	`2018-04-13` - `2020-04-17`	2 years	crt.sh
ssl945600.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2018-12-20` - `2019-09-18`	9 months	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2018-08-16` - `2019-08-21`	a year	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2018-12-24` - `2020-03-24`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2019-03-08` - `2019-06-06`	3 months	crt.sh
*.outbrain.com DigiCert SHA2 Secure Server CA	`2018-12-14` - `2020-03-14`	a year	crt.sh
*.sharethis.mgr.consensu.org DigiCert ECC Secure Server CA	`2018-07-31` - `2019-07-31`	a year	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2019-03-07` - `2020-03-07`	a year	crt.sh
f2.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-04-01` - `2019-09-07`	5 months	crt.sh
*.mktoresp.com GeoTrust RSA CA 2018	`2018-02-05` - `2020-02-05`	2 years	crt.sh
www.google.de Google Internet Authority G3	`2019-04-16` - `2019-07-09`	3 months	crt.sh
cert1.a1.atm.aqfer.net Let's Encrypt Authority X3	`2019-02-21` - `2019-05-22`	3 months	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2017-06-06` - `2019-06-11`	2 years	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2019-01-28` - `2020-01-28`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Frame ID: 6C38C6FB0F2633B5CE77C9F3C67D2FB2
Requests: 79 HTTP requests in this frame

Frame: https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Frame ID: 612299EB3792B29F88A00D8E77B060F0
Requests: 1 HTTP requests in this frame

Frame: https://t.sharethis.com/a/t_.htm?ver=0.244.10685&cid=c010&cls=B
Frame ID: 1155F8B17C2774E0ED5D26E5CF1454CE
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: D6DA85906E147E4D8B0A5663E0A76DE9
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets HTTP 301
http://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/ HTTP 307
https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+wp-(?:content|includes)/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+wp-(?:content|includes)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

env /^CE2$/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

env /^google_tag_manager$/i

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

script /munchkin\.marketo\.net\/munchkin\.js/i
env /^Munchkin$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Twitter Bootstrap () Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i

Page Statistics

82
Requests

100 %
HTTPS

45 %
IPv6

23
Domains

31
Subdomains

28
IPs

4
Countries

9090 kB
Transfer

9873 kB
Size

9
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: https://www.checkpoint.com/
Title: CheckPoint.com

Search URL Search Domain Scan URL

URL: https://www.facebook.com/checkpointsoftware

Search URL Search Domain Scan URL

URL: https://plus.google.com/+checkpoint/posts

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/check-point-software-technologies

Search URL Search Domain Scan URL

URL: https://twitter.com/_cpresearch_

Search URL Search Domain Scan URL

URL: https://threatemulation.checkpoint.com/
Title: SandBlast File Analysis

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/urlcat/
Title: URL Categorization

Search URL Search Domain Scan URL

URL: http://www.cpcheckme.com/checkme/
Title: Instant Security Assessment

Search URL Search Domain Scan URL

URL: https://threatmap.checkpoint.com/ThreatPortal/livemap.html
Title: Live Threat Map

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/support-services/threatcloud-incident-response/

Search URL Search Domain Scan URL

URL: http://mfa.gov.kz/ru/content-view/v-baku-prezentovali-knigu-nursultan-nazarbaev-biografia-na-azerbajdzanskom-azyke
Title: website

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/products/threat-emulation-sandboxing/
Title: Check Point’s Threat Emulation

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/products/threat-extraction/
Title: Threat Extraction

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/products/advanced-network-threat-prevention/
Title: SandBlast Network

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/solutions/zero-day-protection/
Title: SandBlast Zero-Day Protection

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/advisories/
Title: IPS ADVISORIES

Search URL Search Domain Scan URL

URL: http://blog.checkpoint.com/
Title: CHECK POINT BLOG

Search URL Search Domain Scan URL

URL: https://bit.ly/2Pmx8R2

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets HTTP 301
http://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/ HTTP 307
https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 70

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j73&tid=UA-194688-1&cid=564690914.1557180574&jid=1097959516&gjid=1300108015&_gid=343636310.1557180574&_u=aGDAgEADQ~&z=1540069295 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-1&cid=564690914.1557180574&jid=1097959516&_v=j73&z=1540069295 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-1&cid=564690914.1557180574&jid=1097959516&_v=j73&z=1540069295&slf_rd=1&random=2509648848

Request Chain 72

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j73&tid=UA-194688-3&cid=564690914.1557180574&jid=1256246200&gjid=986425175&_gid=343636310.1557180574&_u=aGDAgEADQ~&z=1220316017 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-3&cid=564690914.1557180574&jid=1256246200&_v=j73&z=1220316017 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-3&cid=564690914.1557180574&jid=1256246200&_v=j73&z=1220316017&slf_rd=1&random=1131896998

Request Chain 73

https://l.sharethis.com/pview?event=pview&version=st_sop.js&lang=en&hostname=research.checkpoint.com&location=%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&product=sticky-share-buttons&url=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&source=sharethis.js&fcmp=false&title=FINTEAM%3A%20Trojanized%20TeamViewer%20Against%20Government%20Targets%20-%20Check%20Point%20Research&publisher=5a3031770f16c70012a3c297&ts1557180573973=&sop=true HTTP 301
https://l.sharethis.com/sc?cm=ZGAKn1zQsJ4AAAASExjaAw%3D%3D&uid=true&url=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&sop=true

Request Chain 79

https://px.ads.linkedin.com/collect/?time=1557180575227&pid=51830&url=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&fmt=js&s=1 HTTP 302
https://px.ads.linkedin.com/collect/?time=1557180575227&pid=51830&url=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&fmt=js&s=1&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1557180575227%26pid%3D51830%26url%3Dhttps%253A%252F%252Fresearch.checkpoint.com%252Ffinteam-trojanized-teamviewer-against-government-targets%252F%26fmt%3Djs%26s%3D1%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect/?time=1557180575227&pid=51830&url=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&fmt=js&s=1&cookiesTest=true&liSync=true

82 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Redirect Chain

https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets
http://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

39 KB
12 KB

60ms
59ms

Document
text/html

2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

0c380ecbac6ed598f5248ea1250084a3666087791d86bb806a37d6659503d1f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Host: research.checkpoint.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate, br
Cookie: ROUTEID=.1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server: Apache
Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Link: <http://research.checkpoint.com/?p=21338>; rel=shortlink
Cache-Control: private, max-age=600, must-revalidate
Content-Type: text/html; charset=UTF-8
X-XSS-Protection: 1; mode=block
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Mon, 06 May 2019 22:09:33 GMT
Content-Length: 12292
Connection: keep-alive

Redirect headers

Location: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Non-Authoritative-Reason: HSTS

GET
H/1.1 200
OK style.min.css
research.checkpoint.com/wp-includes/css/dist/block-library/ 25 KB
5 KB 68ms
65ms Stylesheet
text/css 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-includes/css/dist/block-library/style.min.css?ver=5.1.1

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

a72261a5191d1485620242b7d3b735501757aef23dedc6d27c84919af838e756

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 25 Feb 2019 23:52:54 GMT
Server: Apache
ETag: "629a-582c0a39f2180"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: text/css
Cache-Control: public,max-age=600000, must-revalidate
Date: Mon, 06 May 2019 22:09:33 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4258
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK style.css
research.checkpoint.com/wp-content/themes/research/ 16 KB
4 KB 75ms
61ms Stylesheet
text/css 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.16

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

f6dafbf3df2e63d4f82554dd65d1746c683caebcef703efc7ca6443e5822378f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 03 May 2019 18:11:59 GMT
Server: Apache
ETag: "40e9-587ffafc6b9c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: text/css
Cache-Control: public,max-age=600000, must-revalidate
Date: Mon, 06 May 2019 22:09:33 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4009
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK bootstrap.min.css
research.checkpoint.com/wp-content/themes/research/css/ 137 KB
21 KB 75ms
61ms Stylesheet
text/css 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/css/bootstrap.min.css?ver=4.1

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 27 Jul 2018 21:29:10 GMT
Server: Apache
ETag: "22485-57201cd647580"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: text/css
Cache-Control: public,max-age=600000, must-revalidate
Date: Mon, 06 May 2019 22:09:33 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 21024
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK flickity.min.css
research.checkpoint.com/wp-content/themes/research/css/ 2 KB
1 KB 75ms
62ms Stylesheet
text/css 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/css/flickity.min.css?ver=1.1

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

a8da941d8a446516c824ebc9fb77b42e6b92c6deed1daed266bd821ed27bc516

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 27 Jul 2018 21:29:10 GMT
Server: Apache
ETag: "71d-57201cd647580"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: text/css
Cache-Control: public,max-age=600000, must-revalidate
Date: Mon, 06 May 2019 22:09:33 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 648
X-XSS-Protection: 1; mode=block

GET
H2 200 all.css
use.fontawesome.com/releases/v5.6.3/css/ 52 KB
13 KB 50ms
13ms Stylesheet
text/css 23.111.9.35
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.6.3/css/all.css?ver=5.6.3
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 481a0574246e281316ffa0e15399bf5388bb81ae550ce0401a0353b6bb2d1e5a

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 06 May 2019 22:09:33 GMT
content-encoding: gzip
last-modified: Thu, 20 Dec 2018 17:45:13 GMT
server: NetDNA-cache/2.2
access-control-allow-origin: *
etag: W/"dc93d584e41f8417f6b7163320d34329"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
status: 200
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H/1.1 200
OK jquery-3.4.0.min.js Show response
code.jquery.com/ 86 KB
30 KB 90ms
31ms Script
application/javascript 205.185.208.52
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.4.0.min.js?ver=5.1.1
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.185.208.52 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip052.ssl.hwcdn.net
Software: nginx /
Resource Hash: 0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:33 GMT
Content-Encoding: gzip
Last-Modified: Wed, 10 Apr 2019 19:56:14 GMT
Server: nginx
ETag: W/"5cae4a5e-15857"
Vary: Accept-Encoding
X-HW: 1557180573.dop036.lo4.shc,1557180573.dop036.lo4.t,1557180573.cds087.lo4.c
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 30632

GET
H/1.1 200
OK bootstrap.bundle.min.js Show response
research.checkpoint.com/wp-content/themes/research/js/lib/ 66 KB
19 KB 52ms
38ms Script
application/javascript 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/js/lib/bootstrap.bundle.min.js?ver=4.1

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

bb3d017273ed487674d9766d8401cf458228596adcc0c3a6024f44ae715090db

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 27 Jul 2018 21:29:12 GMT
Server: Apache
ETag: "1089e-57201cd82fa00"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: private, max-age=200000, must-revalidate
Date: Mon, 06 May 2019 22:09:33 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 19244
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK flickity.pkgd.min.js Show response
research.checkpoint.com/wp-content/themes/research/js/lib/ 54 KB
14 KB 65ms
16ms Script
application/javascript 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/js/lib/flickity.pkgd.min.js?ver=1.0.1

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

fe2df9f6df4b4a8d7174d259f563b8d9e28e4c03f8f4092fd9db6044e0e64c32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 27 Jul 2018 21:29:12 GMT
Server: Apache
ETag: "d7c9-57201cd82fa00"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: private, max-age=200000, must-revalidate
Date: Mon, 06 May 2019 22:09:33 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 13838
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK single-post.js Show response
research.checkpoint.com/wp-content/themes/research/js/ 397 B
719 B 64ms
12ms Script
application/javascript 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/js/single-post.js?ver=1.0.2

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

cbfee73101feaeb8d3fb0c18c79b5b0b953cdbd32549473339e742d96886b5a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Tue, 14 Aug 2018 07:21:35 GMT
Server: Apache
ETag: "18d-573600f577dc0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: private, max-age=200000, must-revalidate
Date: Mon, 06 May 2019 22:09:33 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 218
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK inc-header.js Show response
research.checkpoint.com/wp-content/themes/research/header/ 1 KB
956 B 87ms
22ms Script
application/javascript 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/header/inc-header.js?v=1.1

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

ae3754c54a0880a98a94c423d3e67f39b5b6f3c63516dafa33866e3e74c9f97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Thu, 15 Nov 2018 13:37:28 GMT
Server: Apache
ETag: "47a-57ab426d8d600"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: application/javascript
Cache-Control: private, max-age=200000, must-revalidate
Date: Mon, 06 May 2019 22:09:33 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 455
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK style.css
research.checkpoint.com/wp-content/themes/research/header/ 9 KB
2 KB 48ms
35ms Stylesheet
text/css 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/header/style.css

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

0fe8bcbcd24ab838fbbd773001253fc0353956e81c5ba9c8e23951ebdbae305a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Fri, 27 Jul 2018 21:29:11 GMT
Server: Apache
ETag: "25cb-57201cd73b7c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: text/css
Cache-Control: public,max-age=600000, must-revalidate
Date: Mon, 06 May 2019 22:09:33 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1900
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK facebook.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 1 KB
2 KB 105ms
14ms Image
image/gif 23.37.56.8
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/facebook.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.56.8 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-56-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 791d8c8cb135d3d53915096e999d3857b6ee16966c20a019f38699f09f6aa2ff

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:33 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: Apache
ETag: "7eb7015574801089503dd7095e1d4313:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1254

GET
H/1.1 200
OK google-plus.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 2 KB
2 KB 106ms
14ms Image
image/gif 23.37.56.8
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/google-plus.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.56.8 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-56-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 1998582382fbf956231d65be84b76e08c0c86e5ced8a99c703bdec416d876d76

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:33 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: Apache
ETag: "eedd0b2cde10b6b1930d57a10c6d0422:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1653

GET
H/1.1 200
OK linkedin.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 1 KB
2 KB 27ms
15ms Image
image/gif 23.37.56.8
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/linkedin.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.56.8 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-56-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a22d6b8782097b7cd9588ab582e119bfd6290278275661e9d0f96b2baec0cb8e

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:33 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: Apache
ETag: "6789b034de6591b26bbd9b5fa6b451ca:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1416

GET
H/1.1 200
OK email.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 1 KB
2 KB 26ms
15ms Image
image/gif 23.37.56.8
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/email.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.56.8 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-56-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 3643b2c826a615065303aa44b8f463eb854d77934f5f25dc1f74f60d4698f9f0

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:33 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: Apache
ETag: "15f1e1004accdbc019365e658249f334:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1407

GET
H/1.1 200
OK rss.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 2 KB
2 KB 46ms
18ms Image
image/gif 23.37.56.8
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/rss.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.56.8 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-56-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b7cfb1c9430d90b22b3f4497543a4cfef719dc40a3cce130cad766171abe8bbe

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:33 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: Apache
ETag: "8cc18e3677ea53cc679e33e82bf9497a:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1620

GET
H/1.1 200
OK twitter.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 2 KB
2 KB 45ms
17ms Image
image/gif 23.37.56.8
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/twitter.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.56.8 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-56-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a59bba774218f207179b30aa8bbd21bad0f7355a52321e08138bd77a308c27d5

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:33 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: Apache
ETag: "6b05f4fc9522afa0cdbeb1a2c0bccc2c:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1608

GET
H/1.1 200
OK check-point-research-logo.gif
sc1.checkpoint.com/sc1/inc/html/images/ 3 KB
3 KB 64ms
15ms Image
image/gif 23.37.56.8
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/check-point-research-logo.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.56.8 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-56-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:33 GMT
Last-Modified: Mon, 09 Jul 2018 21:15:16 GMT
Server: Apache
ETag: "c425f4400a5c9dfbaecb24275f494931:1531172224"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2901

GET
H/1.1 200
OK under-attack.gif
research.checkpoint.com/wp-content/themes/research/img/lib/ 2 KB
2 KB 39ms
29ms Image
image/gif 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/themes/research/img/lib/under-attack.gif

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

fab08b60fa81a228f3dd0eb7678669844a4de6a1fd68683a28df73007fd74efa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 27 Jul 2018 21:29:12 GMT
Server: Apache
ETag: "682-57201cd82fa00"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/gif
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:33 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1666
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK NationStateAttacks.jpg
research.checkpoint.com/wp-content/uploads/2019/04/ 569 KB
570 KB 35ms
25ms Image
image/jpeg 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/NationStateAttacks.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

f06cecdc67e6925037863f0d8d0d0fa8b77c3d8f04034f15216878abe81b148e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Tue, 23 Apr 2019 14:25:13 GMT
Server: Apache
ETag: "8e5ab-587335a61e440"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:33 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 583083
X-XSS-Protection: 1; mode=block

GET
H2 200 run_prettify.js Show response
cdn.rawgit.com/google/code-prettify/master/loader/ 18 KB
8 KB 59ms
15ms Script
application/javascript 151.139.237.11
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.rawgit.com/google/code-prettify/master/loader/run_prettify.js

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.139.237.11 Dallas, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),

Reverse DNS

Software

NetDNA-cache/2.2 /

Resource Hash

7285646ea1d6480a26b5c3d66f75edac636a664b9ef84bbd5fb63122065bb668

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload, max-age=31536000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 06 May 2019 22:09:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: MISS
x-cache: HIT
status: 200
strict-transport-security: max-age=31536000; preload, max-age=31536000; preload
sunset: Tue, 01 Oct 2019 00:00:00 GMT
rawgit-cache-status: MISS
x-robots-tag: none
server: NetDNA-cache/2.2
etag: W/"8fc3e48451b6bbfbaf957e9ce3e8b49831a91b57"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=86400
cf-ray: 4d2995111c869ab0-FRA
link: <https://rawgit.com/>; rel="sunset"; title="RawGit will soon shut down. Please stop using it."

GET
H/1.1 200
OK fig1-2.png
research.checkpoint.com/wp-content/uploads/2019/04/ 295 KB
296 KB 209ms
199ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/fig1-2.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

16ed3e2c6c4e9fc544edcfdc94e769b858df3dc3cd786a7fb781912ab5dce43e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 22 Apr 2019 06:40:02 GMT
Server: Apache
ETag: "49d4a-58718bcea7480"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:34 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 302410
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig2-2.png
research.checkpoint.com/wp-content/uploads/2019/04/ 81 KB
81 KB 665ms
664ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/fig2-2.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

ec2d4166284f4e705baa6d335e2a1f5d902b941c9a76bd6494f668d7bdee9d44

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 22 Apr 2019 06:41:30 GMT
Server: Apache
ETag: "14258-58718c2293a80"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:34 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 82520
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig3-3.png
research.checkpoint.com/wp-content/uploads/2019/04/ 54 KB
54 KB 47ms
46ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/fig3-3.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

05f7b3f4c8017fea6fa197d4968af308a239e854d44a1a13431a27e9835ccde5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 22 Apr 2019 06:41:32 GMT
Server: Apache
ETag: "d76c-58718c247bf00"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:33 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 55148
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK video.gif
research.checkpoint.com/wp-content/uploads/2019/04/ 2 MB
2 MB 677ms
675ms Image
image/gif 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/video.gif

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

bf3ee4e832836e70955ce8d35807d337c5cf10fec2411a600c20d3cd5b361083

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 22 Apr 2019 06:44:36 GMT
Server: Apache
ETag: "27e2f6-58718cd3f5d00"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/gif
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:34 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2614006
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig5-1.png
research.checkpoint.com/wp-content/uploads/2019/04/ 220 KB
220 KB 47ms
46ms Image
image/png 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/fig5-1.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

c7e2d4cab7f975afa09bf5ce3921a29b2f621edfd8f1f098f796f6b23746b32c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 22 Apr 2019 06:41:38 GMT
Server: Apache
ETag: "36e7a-58718c2a34c80"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:33 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 224890
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig6-2.png
research.checkpoint.com/wp-content/uploads/2019/04/ 1 MB
1 MB 41ms
40ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/fig6-2.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

474bb2b2b13a92ed0fcf27c855883290fe6ed6305daa84c788e31078ae1f54ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 22 Apr 2019 06:41:44 GMT
Server: Apache
ETag: "148a4f-58718c2feda00"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:33 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1346127
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig7-3.png
research.checkpoint.com/wp-content/uploads/2019/04/ 473 KB
473 KB 39ms
38ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/fig7-3.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

2348b08817889461c989072540fe46112ed39841f91fb9b382acb413869ae24b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 22 Apr 2019 06:41:47 GMT
Server: Apache
ETag: "76389-58718c32ca0c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:33 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 484233
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig8-3.png
research.checkpoint.com/wp-content/uploads/2019/04/ 285 KB
285 KB 671ms
670ms Image
image/png 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/fig8-3.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

f084671ee037910a240ee9ad2f435f9b8ac54a0ed40566a99b90061796da527e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 22 Apr 2019 06:41:50 GMT
Server: Apache
ETag: "473b1-58718c35a6780"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:34 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 291761
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig9-3.png
research.checkpoint.com/wp-content/uploads/2019/04/ 143 KB
143 KB 672ms
672ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/fig9-3.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

1149d2d4149bfa99dd0b3e42a2dee876e338871d326f01f8247cfde3868824e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 22 Apr 2019 06:41:53 GMT
Server: Apache
ETag: "23a16-58718c3882e40"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:34 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 145942
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig10-2.png
research.checkpoint.com/wp-content/uploads/2019/04/ 313 KB
314 KB 43ms
43ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/fig10-2.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

8ee871347af2af847832b158fdd095e603ee9c6f0d06c02dd1c6e9727425889e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 22 Apr 2019 06:41:55 GMT
Server: Apache
ETag: "4e5e3-58718c3a6b2c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:34 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 320995
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig11-3.png
research.checkpoint.com/wp-content/uploads/2019/04/ 320 KB
320 KB 667ms
666ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/fig11-3.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

8bb2cc0f5bbfd2c32fdb3f2fdc7cf2db7d3252ef9e615dd874afdb1af17b9ca8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 22 Apr 2019 06:41:57 GMT
Server: Apache
ETag: "50031-58718c3c53740"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:34 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 327729
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig12-3.png
research.checkpoint.com/wp-content/uploads/2019/04/ 28 KB
28 KB 38ms
37ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/fig12-3.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

aab63aaaad061cbdfddc0ec2fb741f5355bea913f339f0b05a00d96524ecdfe9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 22 Apr 2019 06:42:00 GMT
Server: Apache
ETag: "6f3c-58718c3f2fe00"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:34 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 28476
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig13-2.png
research.checkpoint.com/wp-content/uploads/2019/04/ 400 KB
401 KB 55ms
55ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/fig13-2.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

6dff57ffe778db6c344223720503e25d202af2a3f7a5ebceaa85223c68639e4a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 22 Apr 2019 06:42:02 GMT
Server: Apache
ETag: "640eb-58718c4118280"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:34 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 409835
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig14-1.png
research.checkpoint.com/wp-content/uploads/2019/04/ 11 KB
11 KB 44ms
43ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/fig14-1.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

d8662853c0cbf82f37ba5ceb4d7736accd3ef9006987af0268bbfc4ae15ed9c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 22 Apr 2019 06:42:05 GMT
Server: Apache
ETag: "2b95-58718c43f4940"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:34 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 11157
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig15-1.jpg
research.checkpoint.com/wp-content/uploads/2019/04/ 168 KB
169 KB 38ms
37ms Image
image/jpeg 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/fig15-1.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

45481fb0499e64991061f75ff954dcfb03bd27e18b2516c4be38ae1394160341

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 22 Apr 2019 06:42:07 GMT
Server: Apache
ETag: "2a11c-58718c45dcdc0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:34 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 172316
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig16-1.png
research.checkpoint.com/wp-content/uploads/2019/04/ 280 KB
281 KB 284ms
284ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/fig16-1.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

540f2c572dd9437d202b363b5a4dc3eeb4a6b7200e5f1f080c14d55e3d29b274

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 22 Apr 2019 06:42:09 GMT
Server: Apache
ETag: "461b2-58718c47c5240"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:34 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 287154
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig17.png
research.checkpoint.com/wp-content/uploads/2019/04/ 33 KB
33 KB 38ms
37ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/fig17.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

25c864e1c760f7adbb3cc069d5e989458247614918535fedb8fda4b986c56155

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 22 Apr 2019 06:42:11 GMT
Server: Apache
ETag: "841d-58718c49ad6c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:34 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 33821
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fig18-1.png
research.checkpoint.com/wp-content/uploads/2019/04/ 34 KB
34 KB 676ms
675ms Image
image/png 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/fig18-1.png

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

e33021ab4390a3819eb503dceeb9e7f75b4815e6a5719ac60d9f2b678d98a8a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 22 Apr 2019 06:42:12 GMT
Server: Apache
ETag: "8725-58718c4aa1900"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/png
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:35 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 34597
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK control-panel-1021x580.jpg
research.checkpoint.com/wp-content/uploads/2019/05/ 142 KB
143 KB 15ms
14ms Image
image/jpeg 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/05/control-panel-1021x580.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

81dace21889845f24965228581063c267b882bb8f0a56f0ea542423758457363

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Wed, 01 May 2019 10:12:59 GMT
Server: Apache
ETag: "2387c-587d0c30e60c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:34 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 145532
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK Data_Breaches.jpg
research.checkpoint.com/wp-content/uploads/2019/04/ 751 KB
751 KB 35ms
34ms Image
image/jpeg 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/Data_Breaches.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

eca3bafa27f8254899afa47d2a9a8bab1c39ac971143c79227332de19dff11f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Tue, 30 Apr 2019 07:51:10 GMT
Server: Apache
ETag: "bba6e-587baaa09f780"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:34 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 768622
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK TI-Bulletins.jpg
research.checkpoint.com/wp-content/uploads/2019/03/ 5 KB
5 KB 12ms
11ms Image
image/jpeg 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/03/TI-Bulletins.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

b7fc664ed17cbb1375ccbed7319bf53598e908288a16913310b54b8b900f7eab

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Thu, 07 Mar 2019 09:18:07 GMT
Server: Apache
ETag: "1426-5837d9590d1c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:34 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5158
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK ResearchAnalysis_blog_1021x580.jpg
research.checkpoint.com/wp-content/uploads/2019/04/ 82 KB
83 KB 17ms
16ms Image
image/jpeg 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2019/04/ResearchAnalysis_blog_1021x580.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

05dbe6b7af7ff019d9192f9cd34ee1925bb7b0566eef212e301c31a0ed50eab6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Tue, 23 Apr 2019 09:19:47 GMT
Server: Apache
ETag: "14940-5872f161152c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:34 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 84288
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK sharethis.js Show response
platform-api.sharethis.com/js/ 91 KB
28 KB 107ms
26ms Script
text/javascript 104.96.160.100
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://platform-api.sharethis.com/js/sharethis.js
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.96.160.100 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-96-160-100.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e5c2f85b9e49be5acd30c8ba3767b124d8945f35000eef89902a0485c04e6040

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:33 GMT
Content-Encoding: gzip
ETag: W/"16d4e-SgmVDK5mv+C+DRaEIjQ3WYUSiQ4"
Vary: Accept-Encoding
Access-Control-Allow-Methods: DELETE, GET, HEAD, OPTIONS, POST, PUT
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600
Connection: keep-alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 27855

GET
H/1.1 200
OK CfP_1021x580_A.jpg
research.checkpoint.com/wp-content/uploads/2018/11/ 132 KB
132 KB 39ms
39ms Image
image/jpeg 2a02:26f0:6c00:18d::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://research.checkpoint.com/wp-content/uploads/2018/11/CfP_1021x580_A.jpg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:18d::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

9a6f22e2d9bba0601021ffb3fb8e484336fdd3041f6675f900ffc8c320091f06

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Fri, 02 Nov 2018 21:13:47 GMT
Server: Apache
ETag: "20f44-579b502d358c0"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public,max-age=2500000
Date: Mon, 06 May 2019 22:09:34 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 134980
X-XSS-Protection: 1; mode=block

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 155 KB
34 KB 17ms
15ms Script
application/javascript 2a00:1450:4001:824::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager (scaffolding) /

Resource Hash

afe8966a178414732a640767da814920743e6d097272bd98b8dc8d8788043846

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 06 May 2019 22:09:33 GMT
content-encoding: br
last-modified: Wed, 01 May 2019 22:14:49 GMT
server: Google Tag Manager (scaffolding)
access-control-allow-origin: http://www.googletagmanager.com
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-length: 34528
x-xss-protection: 0
expires: Mon, 06 May 2019 22:09:33 GMT

GET
H/1.1 200
OK search-icon.gif
sc1.checkpoint.com/sc1/inc/html/images/ 2 KB
2 KB 54ms
14ms Image
image/gif 23.37.56.8
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/search-icon.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.56.8 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-56-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 953d6908ab55929254e46c77e5c751a6e2df7ab84430f134edc3bb62d8f7d32f

Request headers

Referer: https://research.checkpoint.com/wp-content/themes/research/header/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:33 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: Apache
ETag: "2e1aa25e7e77e6a393fd38efb413370f:1506366539"
Content-Type: image/gif
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1755

GET
H/1.1 200
OK 34CA47_6_0.woff2
research.checkpoint.com/wp-content/themes/research/fonts/ 58 KB
59 KB 37ms
36ms Font
application/octet-stream 2a02:26f0:6c00:19e::38f0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/wp-content/themes/research/fonts/34CA47_6_0.woff2

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:19e::38f0 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

0fc686423c26cb1030032fd7e4f2dd664c4b08517a8990c0b46269dd4e01910b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.16
Origin: https://research.checkpoint.com

Response headers

Strict-Transport-Security: max-age=15768000; includeSubDomains; preload
Last-Modified: Mon, 07 Jan 2019 16:17:09 GMT
Server: Apache
ETag: "e890-57ee08f822b40"
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Cache-Control: max-age=86400
Date: Mon, 06 May 2019 22:09:33 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 59536
X-XSS-Protection: 1; mode=block
Expires: Tue, 07 May 2019 22:09:33 GMT

GET
H2 200 prettify.css
cdn.jsdelivr.net/gh/google/code-prettify@master/loader/ 655 B
673 B 56ms
6ms Stylesheet
text/css 2a04:4e42::621
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/prettify.css

Requested by

Host: cdn.rawgit.com
URL: https://cdn.rawgit.com/google/code-prettify/master/loader/run_prettify.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42::621 , European Union, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

Resource Hash

e3b0f209e58b0d412b1e37d9468ab6674dad3860077ad9a918a7462ca67d033d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
x-cache: HIT, HIT
status: 200
date: Mon, 06 May 2019 22:09:33 GMT
content-length: 328
x-served-by: cache-ams21027-AMS, cache-fra19129-FRA
jsd-meta: 1551799388999, 9d802c44dc28, pk, 0
etag: W/"28f-3AMtzR7l//agOVmpYsx92kQQyCI"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H/1.1 200
OK 5a3031770f16c70012a3c297.js Show response
buttons-config.sharethis.com/js/ 525 B
946 B 122ms
28ms Script
text/javascript 104.96.160.100
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://buttons-config.sharethis.com/js/5a3031770f16c70012a3c297.js
Requested by: Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.96.160.100 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-96-160-100.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: eee6d8fe37122ba1538560131fe5c95f9a4b6c45e2059076a7a92513fcb12f20

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:34 GMT
Last-Modified: Tue, 12 Dec 2017 19:43:54 GMT
Server: AmazonS3
x-amz-request-id: C4296D7286D98082
ETag: "29c30155cdf2eaa96943948b94d537b6"
Content-Type: text/javascript
Cache-Control: public, max-age=60
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 525
x-amz-id-2: s1azRjRciOqqAsaQ/Tr2RTpX0/mGBI5DoMoZUiZLrAxRQoGqVyj8Sazvs0J4HKyiC5cMmr+x7FM=

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:81f::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 16 Jan 2019 20:01:45 GMT
server: Golfe2
age: 2225
date: Mon, 06 May 2019 21:32:29 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 17543
expires: Mon, 06 May 2019 23:32:29 GMT

GET
H/1.1 200
OK insight.min.js Show response
sjs.bizographics.com/ 15 KB
5 KB 9ms
7ms Script
application/x-javascript 2a02:26f0:6c00:293::3adf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sjs.bizographics.com/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:293::3adf , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:34 GMT
Content-Encoding: gzip
Last-Modified: Mon, 03 Dec 2018 23:03:30 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=22151
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4571

GET
H2 200 7614.js Show response
script.crazyegg.com/pages/scripts/0041/ 155 B
499 B 12ms
10ms Script
application/x-javascript 2606:4700::6813:9408
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0041/7614.js?432550
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e66d5c0b32b55fd27a1ff8c74bd88f63c1047603ea1685781539a0782d939b4

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 06 May 2019 22:09:34 GMT
via: 1.1 c5ad7defce0694621f07129d852e42da.cloudfront.net (CloudFront)
cf-cache-status: HIT
cf-polished: origSize=156
x-cache: Hit from cloudfront
status: 200
content-encoding: gzip
last-modified: Tue, 09 Apr 2019 20:20:37 GMT
server: cloudflare
etag: W/"8872624abb9bee7082097e58c74fe2a2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: private, max-age=300
cf-ray: 4d2e477bcfcd63d7-FRA
x-amz-cf-id: wc3Bx2ZFkrB0wevnLk_1hDhDTVWpMWx7ydtKB6EHRWPlW90BSJT-Uw==
cf-bgj: minify

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 44ms
27ms Script
application/javascript 151.101.120.157
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.120.157 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 06 May 2019 22:09:34 GMT
content-encoding: gzip
age: 21710
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-cdg20758-CDG
last-modified: Tue, 23 Jan 2018 19:05:33 GMT
x-timer: S1557180574.074191,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 32ms
16ms Script
application/x-javascript 23.43.119.71
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.43.119.71 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-43-119-71.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 66f7eaa7a45f696c332cd450771f4be48e110f6afbe1fe7b39c7a95518aeef76

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:34 GMT
Content-Encoding: gzip
Last-Modified: Fri, 05 Apr 2019 02:53:44 GMT
Server: Apache
ETag: "54520320df20b526337717d6d28181fc:1554432824"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 752

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 53 KB
16 KB 39ms
8ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

fa59b1ed1b011e084474ad818b5f6986d84fc678e2f37fee9330eb52d86860b3

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Origin, Accept-Encoding
content-length: 15397
x-xss-protection: 0
pragma: public
x-fb-debug: x11LNRjlX9VaaSTrdht+PqDL62Am/GgtzCNFMIcvG5h0IW9MgQlr3agvkW/YpOoDrJ6qOZaSoRD6p/yv2ky/pA==
date: Mon, 06 May 2019 22:09:34 GMT
x-frame-options: DENY
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: public, max-age=1200
access-control-allow-credentials: true
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK obtp.js Show response
amplify.outbrain.com/cp/ 4 KB
2 KB 43ms
42ms Script
application/x-javascript 2.18.234.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/cp/obtp.js
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.190 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-190.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b5703e469f7e06927cabb0a5220c35a67a043f198dd913289da775f43f053e44

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:34 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Feb 2019 08:51:57 GMT
Server: Apache
ETag: "4874136f9bd9aaf33fa7a5842ae56a91:1549961517"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1995
Expires: Mon, 06 May 2019 22:29:34 GMT

GET
H/1.1 200
OK portal.html
c.sharethis.mgr.consensu.org/v1.0/cmp/ Frame 6122 0
0 131ms
29ms Document
text/html 2.16.186.243
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.sharethis.mgr.consensu.org/v1.0/cmp/portal.html
Requested by: Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.243 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-243.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Host: c.sharethis.mgr.consensu.org
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Methods: DELETE, GET, HEAD, OPTIONS, POST, PUT
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
ETag: W/"26b-4977387000"
Last-Modified: Tue, 01 Jan 1980 00:00:00 GMT
Vary: Accept-Encoding
Content-Length: 334
Cache-Control: public, max-age=3600
Date: Mon, 06 May 2019 22:09:34 GMT
Connection: keep-alive

GET
H2 200 js Show response
www.google-analytics.com/gtm/ 51 KB
19 KB 21ms
21ms Script
application/javascript 2a00:1450:4001:81f::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=GTM-5L6CQT3&t=gtm1&cid=564690914.1557180574

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager (scaffolding) /

Resource Hash

277f60c6cc5ee0bbbaf948c56636fda0d7453c7fa474ca1338f9d283ce9e05ad

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 06 May 2019 22:09:34 GMT
content-encoding: br
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
server: Google Tag Manager (scaffolding)
access-control-allow-origin: http://www.googletagmanager.com
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-length: 19708
x-xss-protection: 0
expires: Mon, 06 May 2019 22:09:34 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/155/ 9 KB
5 KB 15ms
14ms Script
application/x-javascript 23.43.119.71
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/155/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.43.119.71 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-43-119-71.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: efb6b9732bf508ee305363b10cf2a67ace474e06eb42642f2c3696b2442a5775

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:34 GMT
Content-Encoding: gzip
Last-Modified: Fri, 30 Nov 2018 03:18:20 GMT
Server: Apache
ETag: "c67dad42946949112916578f78706df8:1543547900"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 3923
Expires: Wed, 14 Aug 2019 22:09:34 GMT

GET
H2 200 1692853834349189 Show response
connect.facebook.net/signals/config/ 174 KB
46 KB 112ms
112ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1692853834349189?v=2.8.47&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

29df5d37091da3988086b1eb7c5a1935f2bd816dac3ab0fe5b6d65e4d52db889

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Origin, Accept-Encoding
x-xss-protection: 0
pragma: public
x-fb-debug: a80QnTyl1BZ8JkYhAoviUa6z3j8p62jgBweDMnPBZEe5qtB3GPo04jtF3x4rpI3n/fSn2giIzOmtPhj4Lu5Efg==
date: Mon, 06 May 2019 22:09:34 GMT
x-frame-options: DENY
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: public, max-age=1200
access-control-allow-credentials: true
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
167 B 149ms
149ms Image
image/gif 104.244.42.133
Twitter Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nxi3o&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.133 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://twitter.com/i/xss_report

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 06 May 2019 22:09:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 1; mode=block; report=https://twitter.com/i/xss_report
x-response-time: 119
pragma: no-cache
last-modified: Mon, 06 May 2019 22:09:34 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: f3ab3af94c15f81c5cbe62e0d9dde6bf
x-transaction: 00dc939800468eb2
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1 200
OK whatsapp.svg
platform-cdn.sharethis.com/img/ 832 B
1 KB 79ms
13ms Image
image/svg+xml 95.100.73.233
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform-cdn.sharethis.com/img/whatsapp.svg
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.73.233 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a95-100-73-233.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 847eb36b4dc4b05f94052dcd98077319e74d882334a106bb9ca451ba211c9c2c

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:34 GMT
Last-Modified: Fri, 04 Jan 2019 18:31:20 GMT
Server: AmazonS3
x-amz-request-id: C8268FA90A7F5A75
ETag: "afe7fc60ed757db39a88d2950fce69c9"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 832
x-amz-id-2: 9LwNbOlIJRavVOAwY3HXujgaWJ02sxaO0Y+q6hL2wT3YkV0R2DvnokRjgEt6hNrhN6Qd/MchUmk=

GET
H/1.1 200
OK reddit.svg
platform-cdn.sharethis.com/img/ 910 B
922 B 80ms
14ms Image
image/svg+xml 95.100.73.233
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform-cdn.sharethis.com/img/reddit.svg
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.73.233 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a95-100-73-233.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: dadbb59b37bfea4c78c6e15c8cbb96dfba84526e43a0767dc244fd062a841aba

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:34 GMT
Content-Encoding: gzip
Last-Modified: Fri, 04 Jan 2019 18:31:14 GMT
Server: AmazonS3
x-amz-request-id: 6684B22845339444
ETag: "78d796ca648d8a5e665b48ed0217c56a"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 491
x-amz-id-2: BpspWmYmR7oFkjWopZIv9ezbuOvWhlHMH1RuqYTSZBQeTeLxpVsioXX+36yFk6nylxygWcCnEJ8=

GET
H/1.1 200
OK arrow_left.svg
platform-cdn.sharethis.com/img/ 565 B
949 B 95ms
14ms Image
image/svg+xml 95.100.73.233
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform-cdn.sharethis.com/img/arrow_left.svg
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.73.233 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a95-100-73-233.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:34 GMT
Last-Modified: Fri, 04 Jan 2019 18:31:05 GMT
Server: AmazonS3
x-amz-request-id: 0104282DE1A31712
ETag: "b55d8d2b9321e381a3c38a4bddb74037"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 565
x-amz-id-2: G4fRKuPSOOYAwmeTb0IhHUra0glE2MNWhB0O8D3xDhUY46NaG0HhkQaDDSf+0XwrBlh6ibV1VYs=

GET
H/1.1 200
OK arrow_right.svg
platform-cdn.sharethis.com/img/ 565 B
949 B 15ms
14ms Image
image/svg+xml 95.100.73.233
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://platform-cdn.sharethis.com/img/arrow_right.svg
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.100.73.233 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a95-100-73-233.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:34 GMT
Last-Modified: Fri, 04 Jan 2019 18:31:05 GMT
Server: AmazonS3
x-amz-request-id: BDD8B15B83EDF9F8
ETag: "9928d025bd5792b718ee0a185f62e67c"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 565
x-amz-id-2: 1A6tJcupIukli56gzHabsDVV+2s06b9qiadWmfBw5nuifRAmsmu4dp29S2SFiMMbSxmt0BnrTC4=

GET
H2 200 pixel
tr.outbrain.com/ 43 B
212 B 102ms
101ms Image
image/gif 151.101.194.2
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tr.outbrain.com/pixel?marketerId=007281ee64432ffe21cc9ba8667dd68bed&obApiVersion=1.0.11&name=PAGE_VIEW&dl=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&optOut=false&bust=05447517912201614

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

Resource Hash

33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=0; includeSubDomains;
content-encoding: gzip
traffic-path: NYDC1, JFK, HHN, Europe1
x-cache: MISS, MISS
status: 200
x-traceid: 43256c808d088feccaea86b7c9219572
content-length: 60
x-served-by: cache-jfk8131-JFK, cache-hhn1544-HHN
x-timer: S1557180574.244879,VS0,VE88
date: Mon, 06 May 2019 22:09:34 GMT
content-type: image/gif;
via: 1.1 varnish, 1.1 varnish
cache-control: no-cache
backend-ip: 104.156.90.31
accept-ranges: bytes, bytes
x-cache-hits: 0, 0

GET
H/1.1 200
OK pixel
amplifypixel.outbrain.com/ 43 B
314 B 387ms
120ms Image
image/gif 50.31.142.19
Outbrain

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://amplifypixel.outbrain.com/pixel?mid=007281ee64432ffe21cc9ba8667dd68bed&dl=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&bust=03092401428674767

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

50.31.142.19 Chicago, United States, ASN22075 (AS-OUTBRAIN - Outbrain, Inc., US),

Reverse DNS

chi.outbrain.com

Software

Resource Hash

33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:34 GMT
Cache-Control: no-cache
X-TraceId: 64c547e9d1f09769173db571123a002c
content-encoding: gzip
Content-Length: 60
Strict-Transport-Security: max-age=0; includeSubDomains;
Content-Type: image/gif;

GET
H/1.1 200
OK visitWebPage Show response
750-dqh-528.mktoresp.com/webevents/ 2 B
272 B 575ms
101ms XHR
text/plain 192.28.144.124
MARKETO

General

Check archive.org

Show headers Download Go to

Full URL: https://750-dqh-528.mktoresp.com/webevents/visitWebPage?_mchNc=1557180574230&_mchCn=&_mchId=750-DQH-528&_mchTk=_mch-checkpoint.com-1557180574229-97059&_mchHo=research.checkpoint.com&_mchPo=&_mchRu=%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&_mchPc=https%3A&_mchVr=155&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/155/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.28.144.124 San Mateo, United States, ASN53580 (MARKETO - MARKETO, Inc., US),
Reverse DNS
Software: spray-can/1.3.3 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Origin: https://research.checkpoint.com

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 06 May 2019 22:09:34 GMT
Content-Encoding: gzip
Server: spray-can/1.3.3
Content-Length: 22
X-Request-Id: 22635813-1f8c-4e32-acce-680a21735ea8
Content-Type: text/plain; charset=UTF-8

GET
H2 200 collect
www.google-analytics.com/ 35 B
109 B 6ms
6ms Image
image/gif 2a00:1450:4001:81f::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j73&a=292940361&t=pageview&_s=1&dl=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&ul=en-us&de=UTF-8&dt=FINTEAM%3A%20Trojanized%20TeamViewer%20Against%20Government%20Targets%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=aGDAgEADQ~&jid=1097959516&gjid=1300108015&cid=564690914.1557180574&tid=UA-194688-1&_gid=343636310.1557180574&gtm=2wg4305JCRGP&z=1404564333

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Mar 2019 21:11:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 5101077
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j73&tid=UA-194688-1&cid=564690914.1557180574&jid=1097959516&gjid=1300108015&_gid=343636310.1557180574&_u=aGDAgEADQ~&z=1540069295
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-1&cid=564690914.1557180574&jid=1097959516&_v=j73&z=1540069295
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-1&cid=564690914.1557180574&jid=1097959516&_v=j73&z=1540069295&slf_rd=1&random=2509648848

42 B
109 B

19ms
18ms

Image
image/gif

2a00:1450:4001:81a::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-1&cid=564690914.1557180574&jid=1097959516&_v=j73&z=1540069295&slf_rd=1&random=2509648848

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 May 2019 22:09:34 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 06 May 2019 22:09:34 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-1&cid=564690914.1557180574&jid=1097959516&_v=j73&z=1540069295&slf_rd=1&random=2509648848
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
103 B 6ms
6ms Image
image/gif 2a00:1450:4001:81f::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j73&a=292940361&t=pageview&_s=1&dl=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&ul=en-us&de=UTF-8&dt=FINTEAM%3A%20Trojanized%20TeamViewer%20Against%20Government%20Targets%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=aGDAgEADQ~&jid=1256246200&gjid=986425175&cid=564690914.1557180574&tid=UA-194688-3&_gid=343636310.1557180574&gtm=2wg4305JCRGP&z=2066989110

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 08 Mar 2019 21:11:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 5101077
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j73&tid=UA-194688-3&cid=564690914.1557180574&jid=1256246200&gjid=986425175&_gid=343636310.1557180574&_u=aGDAgEADQ~&z=1220316017
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-3&cid=564690914.1557180574&jid=1256246200&_v=j73&z=1220316017
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-3&cid=564690914.1557180574&jid=1256246200&_v=j73&z=1220316017&slf_rd=1&random=1131896998

42 B
109 B

22ms
21ms

Image
image/gif

2a00:1450:4001:81a::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-3&cid=564690914.1557180574&jid=1256246200&_v=j73&z=1220316017&slf_rd=1&random=1131896998

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 May 2019 22:09:34 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 06 May 2019 22:09:34 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-194688-3&cid=564690914.1557180574&jid=1256246200&_v=j73&z=1220316017&slf_rd=1&random=1131896998
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

301
Moved Permanently

sc Show response
l.sharethis.com/
Redirect Chain

https://l.sharethis.com/pview?event=pview&version=st_sop.js&lang=en&hostname=research.checkpoint.com&location=%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&product=sticky-share-but...
https://l.sharethis.com/sc?cm=ZGAKn1zQsJ4AAAASExjaAw%3D%3D&uid=true&url=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&sop=true

0
-1 B

87ms
15ms

XHR
text/html

18.184.119.244
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://l.sharethis.com/sc?cm=ZGAKn1zQsJ4AAAASExjaAw%3D%3D&uid=true&url=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&sop=true
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.119.244 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-184-119-244.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:34 GMT
Location: /sc?cm=ZGAKn1zQsJ4AAAASExjaAw%3D%3D&uid=true&url=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&sop=true
Access-Control-Max-Age: 1728000
P3p: policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Access-Control-Allow-Origin: https://research.checkpoint.com
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Headers: *
Content-Length: 204
Stid: ZGAKn1zQsJ4AAAASExjaAw==

Redirect headers

Date: Mon, 06 May 2019 22:09:34 GMT
Access-Control-Allow-Origin: https://research.checkpoint.com
Access-Control-Max-Age: 1728000
P3p: policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM"
Location: /sc?cm=ZGAKn1zQsJ4AAAASExjaAw%3D%3D&uid=true&url=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&sop=true
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Headers: *
Content-Length: 204
Stid: ZGAKn1zQsJ4AAAASExjaAw==

GET
H2 200 /
www.facebook.com/tr/ 44 B
322 B 23ms
6ms Image
image/gif 2a03:2880:f11c:8083:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1692853834349189&ev=PageView&dl=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&rl=&if=false&ts=1557180574336&sw=1600&sh=1200&v=2.8.47&r=stable&ec=0&o=30&fbp=fb.1.1557180574335.466463667&it=1557180574139&coo=false&rqm=GET

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 06 May 2019 22:09:34 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Mon, 06 May 2019 22:09:34 GMT

GET
H/1.1 200
OK sc Show response
l.sharethis.com/ 51 B
481 B 15ms
15ms XHR
text/plain 18.184.119.244
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://l.sharethis.com/sc?cm=ZGAKn1zQsJ4AAAASExjaAw%3D%3D&uid=true&url=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&sop=true
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.119.244 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-184-119-244.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 1e46eacce511481a3a2485d45f689b7e1870f6ef08298999c7b1fd912af9b5e4

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Origin: https://research.checkpoint.com

Response headers

Date: Mon, 06 May 2019 22:09:34 GMT
Access-Control-Max-Age: 1728000
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: https://research.checkpoint.com
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Stid: ZGAKn1zQsJ4AAAASExjaAw==
Access-Control-Allow-Headers: *
Content-Length: 51

GET
H/1.1 200
OK t.dhj Show response
t.sharethis.com/1/d/ 2 KB
1 KB 78ms
14ms Script
application/javascript 23.37.48.116
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://t.sharethis.com/1/d/t.dhj?cid=c010&cls=B&dmn=research.checkpoint.com&rnd=1557180574414

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.37.48.116 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-37-48-116.deploy.static.akamaitechnologies.com

Software

Resource Hash

d4c871567d310696b04ee9272a8b286104feff6eb619ac7fd8a2549b3ca0515f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 06 May 2019 22:09:34 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="DSP LAW NID OUR DEL SAM BUS UNI PUR COM NAV INT STA PRE LOC OTC"
Cache-Control: private, max-age=3600
Connection: keep-alive
Content-Type: application/javascript
Content-Length: 958
Expires: Mon, 06 May 2019 23:09:34 GMT

GET
H/1.1 200
OK t_.htm
t.sharethis.com/a/ Frame 1155 0
0 15ms
14ms Document
text/html 23.37.48.116
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://t.sharethis.com/a/t_.htm?ver=0.244.10685&cid=c010&cls=B
Requested by: Host: t.sharethis.com
URL: https://t.sharethis.com/1/d/t.dhj?cid=c010&cls=B&dmn=research.checkpoint.com&rnd=1557180574414
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.37.48.116 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-37-48-116.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Host: t.sharethis.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
Accept-Encoding: gzip, deflate, br
Cookie: __stid=ZGAKn1zQsJ4AAAASExjaAw==
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Response headers

Content-Encoding: gzip
Content-Length: 849
Cache-Control: max-age=604800
Expires: Mon, 13 May 2019 22:09:34 GMT
Date: Mon, 06 May 2019 22:09:34 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="DSP LAW NID OUR DEL SAM BUS UNI PUR COM NAV INT STA PRE LOC OTC"
Content-Type: text/html
Vary: Accept-Encoding

POST
H2 200 /
www.facebook.com/tr/ Frame D6DA 0
0 7ms
6ms Document
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2040
pragma: no-cache
cache-control: no-cache
origin: https://research.checkpoint.com
upgrade-insecure-requests: 1
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
accept-encoding: gzip, deflate, br
cookie: fr=0o6btdLNNKLV3DlFv..Bc0LCe...1.0.Bc0LCe.
Origin: https://research.checkpoint.com
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/

Response headers

status: 200
content-type: text/plain
access-control-allow-origin: https://research.checkpoint.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 0
server: proxygen-bolt
date: Mon, 06 May 2019 22:09:34 GMT

GET
H2

200

/ Show response
px.ads.linkedin.com/collect/
Redirect Chain

https://px.ads.linkedin.com/collect/?time=1557180575227&pid=51830&url=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&fmt=js&s=1
https://px.ads.linkedin.com/collect/?time=1557180575227&pid=51830&url=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&fmt=js&s=1&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%2F%3Ftime%3D1557180575227%26pid%3D51830%26url%3Dhttps%253A%252F%252Fresearch.checkpoint.com%252Ffinteam-troj...
https://px.ads.linkedin.com/collect/?time=1557180575227&pid=51830&url=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&fmt=js&s=1&cookiesTest=true...

0
79 B

154ms
154ms

Script
application/javascript

2620:119:50e0:105::6cae:b15
LinkedIn Corporation

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/collect/?time=1557180575227&pid=51830&url=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&fmt=js&s=1&cookiesTest=true&liSync=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:119:50e0:105::6cae:b15 , United States, ASN14413 (LINKEDIN - LinkedIn Corporation, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 06 May 2019 22:09:35 GMT
content-encoding: gzip
server: Play
vary: Accept-Encoding
x-li-fabric: prod-ltx1
status: 200
x-li-proto: http/2
x-li-pop: prod-vmi1
content-type: application/javascript
content-length: 20
x-li-uuid: IrTLu3s3nBWAGGZQMysAAA==

Redirect headers

date: Mon, 06 May 2019 22:09:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 302
x-li-pop: prod-edc2
content-length: 20
x-li-uuid: BFILs3s3nBUg4uxMaysAAA==
pragma: no-cache
server: Play
x-frame-options: sameorigin
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
vary: Accept-Encoding
strict-transport-security: max-age=2592000
x-li-fabric: prod-ltx1
location: https://px.ads.linkedin.com/collect/?time=1557180575227&pid=51830&url=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F&fmt=js&s=1&cookiesTest=true&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob:; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
266 B 147ms
147ms Script
application/javascript 104.244.42.195
Twitter Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nxi3o&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fresearch.checkpoint.com%2Ffinteam-trojanized-teamviewer-against-government-targets%2F

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),

Reverse DNS

Software

tsa_f /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://twitter.com/i/xss_report

Request headers

Referer: https://research.checkpoint.com/finteam-trojanized-teamviewer-against-government-targets/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 06 May 2019 22:09:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 1; mode=block; report=https://twitter.com/i/xss_report
x-response-time: 120
pragma: no-cache
last-modified: Mon, 06 May 2019 22:09:35 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: cf3aa353ccc1da01970d6d534e35e2bf
x-transaction: 00dd3570000d13ff
expires: Tue, 31 Mar 1981 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

55 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

9 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.sharethis.com/	1970-01-19 09:20:02	Name: __stid Value: ZGAKn1zQsJ4AAAASExjaAw==
.checkpoint.com/	1970-01-19 02:42:36	Name: _fbp Value: fb.1.1557180574335.466463667
.checkpoint.com/	1970-01-19 00:33:00	Name: _dc_gtm_UA-194688-3 Value: 1
.t.sharethis.com/	1970-01-19 01:16:12	Name: pxcelPage_c010_B Value: 0_11_1557180574639
.checkpoint.com/	1970-01-19 00:33:00	Name: _dc_gtm_UA-194688-1 Value: 1
.checkpoint.com/	1970-01-19 18:04:12	Name: _mkto_trk Value: id:750-DQH-528&token:_mch-checkpoint.com-1557180574229-97059
.checkpoint.com/	1970-01-19 00:34:26	Name: _gid Value: GA1.2.343636310.1557180574
.checkpoint.com/	1970-01-19 18:04:12	Name: _ga Value: GA1.2.564690914.1557180574
research.checkpoint.com/	1969-12-31 23:59:59	Name: ROUTEID Value: .1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

750-dqh-528.mktoresp.com
amplify.outbrain.com
amplifypixel.outbrain.com
analytics.twitter.com
buttons-config.sharethis.com
c.sharethis.mgr.consensu.org
cdn.jsdelivr.net
cdn.rawgit.com
code.jquery.com
connect.facebook.net
l.sharethis.com
munchkin.marketo.net
platform-api.sharethis.com
platform-cdn.sharethis.com
px.ads.linkedin.com
research.checkpoint.com
sc1.checkpoint.com
script.crazyegg.com
sjs.bizographics.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
t.sharethis.com
tr.outbrain.com
use.fontawesome.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
104.244.42.133
104.244.42.195
104.96.160.100
151.101.120.157
151.101.194.2
151.139.237.11
18.184.119.244
192.28.144.124
2.16.186.243
2.18.234.190
205.185.208.52
23.111.9.35
23.37.48.116
23.37.56.8
23.43.119.71
2606:4700::6813:9408
2620:109:c002::6cae:a0a
2620:119:50e0:105::6cae:b15
2a00:1450:4001:81a::2003
2a00:1450:4001:81f::200e
2a00:1450:4001:824::2008
2a00:1450:4001:825::2004
2a00:1450:400c:c00::9a
2a02:26f0:6c00:18d::38f0
2a02:26f0:6c00:19e::38f0
2a02:26f0:6c00:293::3adf
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
2a04:4e42::621
50.31.142.19
95.100.73.233
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8
05dbe6b7af7ff019d9192f9cd34ee1925bb7b0566eef212e301c31a0ed50eab6
05f7b3f4c8017fea6fa197d4968af308a239e854d44a1a13431a27e9835ccde5
0c380ecbac6ed598f5248ea1250084a3666087791d86bb806a37d6659503d1f0
0e66d5c0b32b55fd27a1ff8c74bd88f63c1047603ea1685781539a0782d939b4
0fc686423c26cb1030032fd7e4f2dd664c4b08517a8990c0b46269dd4e01910b
0fe8bcbcd24ab838fbbd773001253fc0353956e81c5ba9c8e23951ebdbae305a
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1149d2d4149bfa99dd0b3e42a2dee876e338871d326f01f8247cfde3868824e6
16ed3e2c6c4e9fc544edcfdc94e769b858df3dc3cd786a7fb781912ab5dce43e
1998582382fbf956231d65be84b76e08c0c86e5ced8a99c703bdec416d876d76
1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e
1e46eacce511481a3a2485d45f689b7e1870f6ef08298999c7b1fd912af9b5e4
2348b08817889461c989072540fe46112ed39841f91fb9b382acb413869ae24b
25c864e1c760f7adbb3cc069d5e989458247614918535fedb8fda4b986c56155
277f60c6cc5ee0bbbaf948c56636fda0d7453c7fa474ca1338f9d283ce9e05ad
29df5d37091da3988086b1eb7c5a1935f2bd816dac3ab0fe5b6d65e4d52db889
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c
34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255
3643b2c826a615065303aa44b8f463eb854d77934f5f25dc1f74f60d4698f9f0
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
45481fb0499e64991061f75ff954dcfb03bd27e18b2516c4be38ae1394160341
474bb2b2b13a92ed0fcf27c855883290fe6ed6305daa84c788e31078ae1f54ee
481a0574246e281316ffa0e15399bf5388bb81ae550ce0401a0353b6bb2d1e5a
540f2c572dd9437d202b363b5a4dc3eeb4a6b7200e5f1f080c14d55e3d29b274
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38
66f7eaa7a45f696c332cd450771f4be48e110f6afbe1fe7b39c7a95518aeef76
6dff57ffe778db6c344223720503e25d202af2a3f7a5ebceaa85223c68639e4a
7285646ea1d6480a26b5c3d66f75edac636a664b9ef84bbd5fb63122065bb668
791d8c8cb135d3d53915096e999d3857b6ee16966c20a019f38699f09f6aa2ff
81dace21889845f24965228581063c267b882bb8f0a56f0ea542423758457363
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
847eb36b4dc4b05f94052dcd98077319e74d882334a106bb9ca451ba211c9c2c
8bb2cc0f5bbfd2c32fdb3f2fdc7cf2db7d3252ef9e615dd874afdb1af17b9ca8
8ee871347af2af847832b158fdd095e603ee9c6f0d06c02dd1c6e9727425889e
953d6908ab55929254e46c77e5c751a6e2df7ab84430f134edc3bb62d8f7d32f
9a6f22e2d9bba0601021ffb3fb8e484336fdd3041f6675f900ffc8c320091f06
a22d6b8782097b7cd9588ab582e119bfd6290278275661e9d0f96b2baec0cb8e
a59bba774218f207179b30aa8bbd21bad0f7355a52321e08138bd77a308c27d5
a72261a5191d1485620242b7d3b735501757aef23dedc6d27c84919af838e756
a8da941d8a446516c824ebc9fb77b42e6b92c6deed1daed266bd821ed27bc516
aab63aaaad061cbdfddc0ec2fb741f5355bea913f339f0b05a00d96524ecdfe9
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae3754c54a0880a98a94c423d3e67f39b5b6f3c63516dafa33866e3e74c9f97d
afe8966a178414732a640767da814920743e6d097272bd98b8dc8d8788043846
b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242
b5703e469f7e06927cabb0a5220c35a67a043f198dd913289da775f43f053e44
b7cfb1c9430d90b22b3f4497543a4cfef719dc40a3cce130cad766171abe8bbe
b7fc664ed17cbb1375ccbed7319bf53598e908288a16913310b54b8b900f7eab
bb3d017273ed487674d9766d8401cf458228596adcc0c3a6024f44ae715090db
bc9cef10d07e8da3ce80181de07a056414731f86e0dc12e2c81d652b28ac770b
bf3ee4e832836e70955ce8d35807d337c5cf10fec2411a600c20d3cd5b361083
c7e2d4cab7f975afa09bf5ce3921a29b2f621edfd8f1f098f796f6b23746b32c
cbfee73101feaeb8d3fb0c18c79b5b0b953cdbd32549473339e742d96886b5a9
d4c871567d310696b04ee9272a8b286104feff6eb619ac7fd8a2549b3ca0515f
d8662853c0cbf82f37ba5ceb4d7736accd3ef9006987af0268bbfc4ae15ed9c7
dadbb59b37bfea4c78c6e15c8cbb96dfba84526e43a0767dc244fd062a841aba
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e33021ab4390a3819eb503dceeb9e7f75b4815e6a5719ac60d9f2b678d98a8a5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3b0f209e58b0d412b1e37d9468ab6674dad3860077ad9a918a7462ca67d033d
e5c2f85b9e49be5acd30c8ba3767b124d8945f35000eef89902a0485c04e6040
ec2d4166284f4e705baa6d335e2a1f5d902b941c9a76bd6494f668d7bdee9d44
eca3bafa27f8254899afa47d2a9a8bab1c39ac971143c79227332de19dff11f0
eee6d8fe37122ba1538560131fe5c95f9a4b6c45e2059076a7a92513fcb12f20
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efb6b9732bf508ee305363b10cf2a67ace474e06eb42642f2c3696b2442a5775
f06cecdc67e6925037863f0d8d0d0fa8b77c3d8f04034f15216878abe81b148e
f084671ee037910a240ee9ad2f435f9b8ac54a0ed40566a99b90061796da527e
f6dafbf3df2e63d4f82554dd65d1746c683caebcef703efc7ca6443e5822378f
fa59b1ed1b011e084474ad818b5f6986d84fc678e2f37fee9330eb52d86860b3
fab08b60fa81a228f3dd0eb7678669844a4de6a1fd68683a28df73007fd74efa
fe2df9f6df4b4a8d7174d259f563b8d9e28e4c03f8f4092fd9db6044e0e64c32

research.checkpoint.com Open in urlscan Pro 2a02:26f0:6c00:19e::38f0 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

82 Requests

100 %HTTPS

45 %IPv6

23 Domains

31 Subdomains

28 IPs

4 Countries

9090 kBTransfer

9873 kBSize

9 Cookies

18 Outgoing links

Page URL History

Redirected requests

82 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

research.checkpoint.com Open in urlscan Pro
2a02:26f0:6c00:19e::38f0 Public Scan

Screenshot
Live screenshot

Full Image

82
Requests

100 %
HTTPS

45 %
IPv6

23
Domains

31
Subdomains

28
IPs

4
Countries

9090 kB
Transfer

9873 kB
Size

9
Cookies

82 HTTP transactions
0 data transactions