urlscan.io logo urlscan.io
SecurityTrails logo

research.checkpoint.com Open in urlscan Pro
141.193.213.21  Public Scan

Go To Rescan Add Verdict Report
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-a...
Submission: On September 10 via api from DE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 32 IPs in 5 countries across 25 domains to perform 94 HTTP transactions. The main IP is 141.193.213.21, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is research.checkpoint.com.
TLS certificate: Issued by R3 on July 6th 2022. Valid for: 3 months.
This is the only time research.checkpoint.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
21 141.193.213.21 209242 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2001:4de0:ac1... 20446 (STACKPATH...)
1 2a00:1450:400... 15169 (GOOGLE)
8 104.122.24.32 16625 (AKAMAI-AS)
2 2a00:1450:400... 15169 (GOOGLE)
1 13.32.99.51 16509 (AMAZON-02)
5 2606:4700::68... 13335 (CLOUDFLAR...)
1 2600:9000:20e... 16509 (AMAZON-02)
1 52.57.224.87 16509 (AMAZON-02)
9 96.16.137.162 16625 (AKAMAI-AS)
3 2001:4860:480... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 37.252.172.123 29990 (ASN-APPNEX)
1 2001:4860:480... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 52.58.117.7 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
10 2600:9000:21f... 16509 (AMAZON-02)
2 18.66.122.15 16509 (AMAZON-02)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
1 199.232.16.157 54113 (FASTLY)
2 23.205.237.4 16625 (AKAMAI-AS)
2 2a03:2880:f01... 32934 (FACEBOOK)
3 3 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 192.28.144.124 15224 (OMNITURE)
1 104.244.42.5 13414 (TWITTER)
1 104.244.42.131 13414 (TWITTER)
2 2a03:2880:f10... 32934 (FACEBOOK)
7 35.168.228.181 14618 (AMAZON-AES)
94 32
21    141.193.213.21 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)
research.checkpoint.com
1    2606:4700:3032::ac43:a9f7 (United States)

ASN13335 (CLOUDFLARENET, US)
use.fontawesome.com
1    2001:4de0:ac18::1:a:3b (Netherlands)

ASN20446 (STACKPATH-CDN, US)
code.jquery.com
1    2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
8    104.122.24.32 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-122-24-32.deploy.static.akamaitechnologies.com
sc1.checkpoint.com
2    2a00:1450:4001:82b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    13.32.99.51 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-51.fra60.r.cloudfront.net
platform-api.sharethis.com
5    2606:4700::6812:e234 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.onesignal.com
onesignal.com
img.onesignal.com
1    2600:9000:20eb:da00:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)
buttons-config.sharethis.com
1    52.57.224.87 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-224-87.eu-central-1.compute.amazonaws.com
l.sharethis.com
9    96.16.137.162 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a96-16-137-162.deploy.static.akamaitechnologies.com
j.6sc.co
c.6sc.co
b.6sc.co
3    2001:4860:4802:36::178 (United States)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2a00:1450:400c:c06::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    37.252.172.123 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
secure.adnxs.com
1    2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
1    2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    2606:4700::6812:e134 (United States)

ASN13335 (CLOUDFLARENET, US)
onesignal.com
2    52.58.117.7 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-58-117-7.eu-central-1.compute.amazonaws.com
epsilon.6sense.com
1    2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
10    2600:9000:21f3:5c00:1d:85c3:6640:93a1 (United States)

ASN16509 (AMAZON-02, US)
platform-cdn.sharethis.com
2    18.66.122.15 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-15.fra60.r.cloudfront.net
assets.trendemon.com
1    2a02:26f0:3500:16::215:14a3 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
snap.licdn.com
1    199.232.16.157 (Vienna, Austria)

ASN54113 (FASTLY, US)
static.ads-twitter.com
2    23.205.237.4 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-205-237-4.deploy.static.akamaitechnologies.com
munchkin.marketo.net
2    2a03:2880:f01c:216:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
connect.facebook.net
3    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
www.linkedin.com
1    13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px4.ads.linkedin.com
1    192.28.144.124 (United States)

ASN15224 (OMNITURE, US)
750-dqh-528.mktoresp.com
1    104.244.42.5 (United States)

ASN13414 (TWITTER, US)
t.co
1    104.244.42.131 (United States)

ASN13414 (TWITTER, US)
analytics.twitter.com
2    2a03:2880:f107:83:face:b00c:0:25de (Vienna, Austria)

ASN32934 (FACEBOOK, US)
www.facebook.com
7    35.168.228.181 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-168-228-181.compute-1.amazonaws.com
trackingapi.trendemon.com
Apex Domain
Subdomains		 Transfer
29 checkpoint.com
research.checkpoint.com
sc1.checkpoint.com — Cisco Umbrella Rank: 27850
1 MB
13 sharethis.com
platform-api.sharethis.com — Cisco Umbrella Rank: 6169
buttons-config.sharethis.com — Cisco Umbrella Rank: 7262
l.sharethis.com — Cisco Umbrella Rank: 6111
platform-cdn.sharethis.com — Cisco Umbrella Rank: 13511
54 KB
9 trendemon.com
assets.trendemon.com — Cisco Umbrella Rank: 182085
trackingapi.trendemon.com — Cisco Umbrella Rank: 180472
51 KB
9 6sc.co
j.6sc.co — Cisco Umbrella Rank: 16308
c.6sc.co — Cisco Umbrella Rank: 23029
b.6sc.co — Cisco Umbrella Rank: 8700
13 KB
6 onesignal.com
cdn.onesignal.com — Cisco Umbrella Rank: 3423
onesignal.com — Cisco Umbrella Rank: 947
img.onesignal.com — Cisco Umbrella Rank: 6452
86 KB
4 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 894
www.linkedin.com — Cisco Umbrella Rank: 847
px4.ads.linkedin.com — Cisco Umbrella Rank: 6869
3 KB
4 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 94
region1.google-analytics.com — Cisco Umbrella Rank: 2119
20 KB
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 111
426 B
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 208
110 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 6777
6 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 30334
411 B
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 141
154 KB
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 870
353 B
1 t.co
t.co — Cisco Umbrella Rank: 600
336 B
1 mktoresp.com
750-dqh-528.mktoresp.com
318 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 996
15 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 1614
3 KB
1 gstatic.com
fonts.gstatic.com
16 KB
1 google.de
www.google.de — Cisco Umbrella Rank: 3469
501 B
1 google.com
www.google.com — Cisco Umbrella Rank: 19
501 B
1 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 725
709 B
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 188
447 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 120
1 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 976
30 KB
1 fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 1565
12 KB
94 25
Domain Requested by
21 research.checkpoint.com research.checkpoint.com
10 platform-cdn.sharethis.com research.checkpoint.com
8 sc1.checkpoint.com research.checkpoint.com
7 trackingapi.trendemon.com assets.trendemon.com
7 b.6sc.co research.checkpoint.com
3 onesignal.com cdn.onesignal.com
3 www.google-analytics.com www.googletagmanager.com
research.checkpoint.com
2 www.facebook.com
2 px.ads.linkedin.com 2 redirects
2 connect.facebook.net research.checkpoint.com
connect.facebook.net
2 munchkin.marketo.net research.checkpoint.com
munchkin.marketo.net
2 assets.trendemon.com research.checkpoint.com
assets.trendemon.com
2 epsilon.6sense.com j.6sc.co
2 cdn.onesignal.com research.checkpoint.com
cdn.onesignal.com
2 www.googletagmanager.com research.checkpoint.com
www.googletagmanager.com
1 analytics.twitter.com
1 t.co
1 750-dqh-528.mktoresp.com munchkin.marketo.net
1 px4.ads.linkedin.com
1 www.linkedin.com 1 redirects
1 static.ads-twitter.com www.googletagmanager.com
1 snap.licdn.com www.googletagmanager.com
1 fonts.gstatic.com fonts.googleapis.com
1 img.onesignal.com research.checkpoint.com
1 www.google.de research.checkpoint.com
1 www.google.com research.checkpoint.com
1 region1.google-analytics.com www.googletagmanager.com
1 c.6sc.co j.6sc.co
1 secure.adnxs.com j.6sc.co
1 stats.g.doubleclick.net www.google-analytics.com
1 j.6sc.co research.checkpoint.com
1 l.sharethis.com platform-api.sharethis.com
1 buttons-config.sharethis.com platform-api.sharethis.com
1 platform-api.sharethis.com research.checkpoint.com
1 fonts.googleapis.com research.checkpoint.com
1 code.jquery.com research.checkpoint.com
1 use.fontawesome.com research.checkpoint.com
94 37
Subject Issuer Validity Valid
research.checkpoint.com
R3		 2022-07-06 -
2022-10-04		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-06-06 -
2023-06-05		 a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2022-08-03 -
2023-07-14		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
*.checkpoint.com
GlobalSign GCC R3 DV TLS CA 2020		 2021-12-07 -
2023-01-08		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
sharethis.com
Amazon		 2022-06-19 -
2023-07-18		 a year crt.sh
*.6sc.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-03-08 -
2023-03-11		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2022-02-11 -
2023-03-14		 a year crt.sh
www.google.com
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
www.google.de
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
*.6sense.com
Amazon		 2022-05-31 -
2023-06-29		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2022-08-22 -
2022-11-14		 3 months crt.sh
*.trendemon.com
SSL.com RSA SSL subCA		 2022-07-12 -
2023-06-26		 a year crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA		 2022-03-01 -
2023-03-01		 a year crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-07-22 -
2023-08-22		 a year crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA		 2022-02-06 -
2023-02-07		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2022-06-19 -
2022-09-17		 3 months crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-11-30 -
2022-11-30		 a year crt.sh
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-03-07 -
2023-03-06		 a year crt.sh
*.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-03-07 -
2023-03-06		 a year crt.sh

This page contains 2 frames:

Primary Page: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Frame ID: 330269356C6FE2644B98D87200CEC8A8
Requests: 92 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 48CE35C85E9E2E5BBEE7C3F35AC3E9C6
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

DangerousSavanna: Two-year long campaign targets financial institutions in French-speaking Africa - Check Point Research

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <link rel="amphtml"
Overall confidence: 100%
Detected patterns
  • <!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • /flickity(?:\.pkgd)?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js
Overall confidence: 100%
Detected patterns
  • cdn\.onesignal\.com
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

94
Requests

99 %
HTTPS

55 %
IPv6

25
Domains

37
Subdomains

32
IPs

5
Countries

1656 kB
Transfer

3526 kB
Size

33
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 73
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1662786411114&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D51830%26time%3D1662786411114%26url%3Dhttps%253A%252F%252Fresearch.checkpoint.com%252F2022%252Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%252F%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1662786411114&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1662786411114&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&liSync=true&e_ipv6=AQLZwcPT3XRhLgAAAYMlyxvcxJ4JAVuG6qwXJyxQuOw-5CndwP-52NfBTHUDvBx5BNb5nWrkwVUQrbqwZOQkBrE0MfiYew

94 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/ 		66 KB
21 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / WP Engine
Resource Hash
43ca94d55e3813bb9304cae5f890914b1ed56b7bc5d1196f5c1e6e3da2a67f8a
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
max-age=600, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
7485a2f68dce91db-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sat, 10 Sep 2022 05:06:50 GMT
link
<https://research.checkpoint.com/?p=26425>; rel=shortlink
server
cloudflare
vary
Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache
HIT: 6
x-cache-group
normal
x-cacheable
SHORT
x-frame-options
SAMEORIGIN
x-powered-by
WP Engine
x-xss-protection
1; mode=block
style.min.css
research.checkpoint.com/wp-includes/css/dist/block-library/ 		87 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-includes/css/dist/block-library/style.min.css?ver=6.0.2
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 04 Jul 2022 12:10:37 GMT
server
cloudflare
age
102854
etag
W/"62c2d8bd-15b64"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7485a2f7beea91db-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
style.css
research.checkpoint.com/wp-content/themes/research/ 		18 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.32
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef9e48bd5f604cd8d52ac00607fc60c2f4276a7e88c3f2bce907c7aaec90ed41

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 10 Aug 2022 01:47:46 GMT
server
cloudflare
age
335940
etag
W/"62f30e42-4972"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7485a2f7beeb91db-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
bootstrap.min.css
research.checkpoint.com/wp-content/themes/research/css/ 		137 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/css/bootstrap.min.css?ver=4.1
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:49 GMT
server
cloudflare
age
1410805
etag
W/"5dc49a65-22485"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7485a2f7beec91db-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
flickity.min.css
research.checkpoint.com/wp-content/themes/research/css/ 		2 KB
675 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/css/flickity.min.css?ver=1.1
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a8da941d8a446516c824ebc9fb77b42e6b92c6deed1daed266bd821ed27bc516

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
1103716
etag
W/"5dc49a64-71d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7485a2f7beee91db-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
all.css
use.fontawesome.com/releases/v5.6.3/css/ 		52 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/releases/v5.6.3/css/all.css?ver=5.6.3
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:a9f7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
481a0574246e281316ffa0e15399bf5388bb81ae550ce0401a0353b6bb2d1e5a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1461708
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
CK1JF28VB0GJH2AC
x-amz-id-2
3FFLACOAS113lw59pPZz8u2qRBw+ws+TY8c30b1L8WV9X/McDjpIutj6Xq6mLKX4+jnt4obxpWc=
last-modified
Wed, 30 Jun 2021 15:44:33 GMT
server
cloudflare
etag
W/"dc93d584e41f8417f6b7163320d34329"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sUtVcW0d3mYpUR5jwe2gIfLutX1DvvxI9lXcX3A%2BHwy7usN9efWo2bTTceRFXuMVkCSLNpb%2BBdT%2FnC2mslWAuXAfbEGuppBQyCx28V1lZiAgJ501XzR%2FQ575U1zJiMcOZeGL608Q4rPdiaLWuFUTHKXv"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=31556926
cf-ray
7485a2f81a3ebac7-MXP
enlighterjs.min.css
research.checkpoint.com/wp-content/plugins/enlighter/cache/ 		78 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/plugins/enlighter/cache/enlighterjs.min.css?ver=TJ0/7+iAWMKbDKS
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6048e330c0f362be46b20de45d35a5ace57a04be04a29da10448d6949f6f69ce

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 15 Feb 2021 20:35:46 GMT
server
cloudflare
age
7001471
etag
W/"602adb22-13686"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7485a2f7beef91db-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
jquery-3.4.0.min.js
code.jquery.com/ 		86 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.4.0.min.js?ver=6.0.2
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
content-encoding
gzip
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
etag
W/"28feccc0-15857"
vary
Accept-Encoding
x-hw
1662786410.dop145.fr8.t,1662786410.cds290.fr8.hn,1662786410.cds215.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30632
bootstrap.bundle.min.js
research.checkpoint.com/wp-content/themes/research/js/lib/ 		66 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/js/lib/bootstrap.bundle.min.js?ver=4.1
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bb3d017273ed487674d9766d8401cf458228596adcc0c3a6024f44ae715090db

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
19682101
etag
W/"5dc49a64-1089e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7485a2f7bef191db-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
flickity.pkgd.min.js
research.checkpoint.com/wp-content/themes/research/js/lib/ 		54 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/js/lib/flickity.pkgd.min.js?ver=1.0.1
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe2df9f6df4b4a8d7174d259f563b8d9e28e4c03f8f4092fd9db6044e0e64c32

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
3007557
etag
W/"5dc49a64-d7c9"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7485a2f7bef391db-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
single-post.js
research.checkpoint.com/wp-content/themes/research/js/ 		422 B
298 B 		Script
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/js/single-post.js?ver=1.0.4
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f5bd223eafa1c6d1aff21c91c6bfb825f7f36830d97eef41c432681ed671f85

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 14 Jan 2020 00:00:05 GMT
server
cloudflare
age
1103717
etag
W/"5e1d0485-1a6"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7485a2f7bef491db-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
inc-header.js
research.checkpoint.com/wp-content/themes/research/header/ 		1 KB
541 B 		Script
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/header/inc-header.js?v=1.1
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ae3754c54a0880a98a94c423d3e67f39b5b6f3c63516dafa33866e3e74c9f97d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
19682101
etag
W/"5dc49a64-47a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7485a2f7bef691db-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
style.css
research.checkpoint.com/wp-content/themes/research/header/ 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/header/style.css
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0fe8bcbcd24ab838fbbd773001253fc0353956e81c5ba9c8e23951ebdbae305a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
19682101
etag
W/"5dc49a64-25cb"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7485a2f7bef091db-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
css
fonts.googleapis.com/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
234b9bab83aa0c52e9e5192995427a2bc44876cf1a11545ed631f369b8dc6534
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sat, 10 Sep 2022 04:56:53 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Sat, 10 Sep 2022 05:06:50 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 10 Sep 2022 05:06:50 GMT
facebook.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/facebook.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.122.24.32 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-122-24-32.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
791d8c8cb135d3d53915096e999d3857b6ee16966c20a019f38699f09f6aa2ff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Unused62
8096267
Date
Sat, 10 Sep 2022 05:06:50 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"7eb7015574801089503dd7095e1d4313:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1254
google-plus.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/google-plus.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.122.24.32 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-122-24-32.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
1998582382fbf956231d65be84b76e08c0c86e5ced8a99c703bdec416d876d76

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Unused62
8096267
Date
Sat, 10 Sep 2022 05:06:50 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"eedd0b2cde10b6b1930d57a10c6d0422:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1653
linkedin.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/linkedin.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.122.24.32 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-122-24-32.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a22d6b8782097b7cd9588ab582e119bfd6290278275661e9d0f96b2baec0cb8e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Unused62
8096267
Date
Sat, 10 Sep 2022 05:06:50 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"6789b034de6591b26bbd9b5fa6b451ca:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1416
email.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/email.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.122.24.32 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-122-24-32.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
3643b2c826a615065303aa44b8f463eb854d77934f5f25dc1f74f60d4698f9f0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Unused62
8096267
Date
Sat, 10 Sep 2022 05:06:50 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"15f1e1004accdbc019365e658249f334:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1407
rss.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/rss.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.122.24.32 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-122-24-32.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
b7cfb1c9430d90b22b3f4497543a4cfef719dc40a3cce130cad766171abe8bbe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Unused62
8096267
Date
Sat, 10 Sep 2022 05:06:50 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"8cc18e3677ea53cc679e33e82bf9497a:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1620
twitter.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/social/twitter.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.122.24.32 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-122-24-32.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a59bba774218f207179b30aa8bbd21bad0f7355a52321e08138bd77a308c27d5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Unused62
8096267
Date
Sat, 10 Sep 2022 05:06:50 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"6b05f4fc9522afa0cdbeb1a2c0bccc2c:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1608
check-point-research-logo.gif
sc1.checkpoint.com/sc1/inc/html/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/check-point-research-logo.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.122.24.32 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-122-24-32.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Unused62
8096267
Date
Sat, 10 Sep 2022 05:06:50 GMT
Last-Modified
Mon, 09 Jul 2018 21:15:16 GMT
Server
AkamaiNetStorage
ETag
"c425f4400a5c9dfbaecb24275f494931:1531172224"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
2901
under-attack.gif
research.checkpoint.com/wp-content/themes/research/img/lib/ 		458 B
727 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/themes/research/img/lib/under-attack.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c0f7ef8329ae6da56bd269492901fb024a05d7b67e977995a82b506af4b3b030

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
cf-cache-status
HIT
age
725526
cf-polished
origFmt=gif, origSize=1666
content-disposition
inline; filename="under-attack.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
458
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
etag
"5dc49a64-682"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7485a2f8aaeb9164-FRA
cf-bgj
imgq:100,h2pri
Picture4.png
research.checkpoint.com/wp-content/uploads/2022/09/ 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2022/09/Picture4.png
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
145eb008d49de71b20b1cf3af97811af227b223c812d0f4a35929604c6180c04

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
cf-cache-status
HIT
age
328148
cf-polished
origFmt=png, origSize=65910
content-disposition
inline; filename="Picture4.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
36620
last-modified
Mon, 05 Sep 2022 08:13:59 GMT
server
cloudflare
etag
"6315afc7-10176"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7485a2f8aaee9164-FRA
cf-bgj
imgq:100,h2pri
gtm.js
www.googletagmanager.com/ 		272 KB
81 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
35436a26851b1eafd22845313b120ae9dbe7cf7e437f086ced89e4aa0042047c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
81944
x-xss-protection
0
last-modified
Sat, 10 Sep 2022 03:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 10 Sep 2022 05:06:50 GMT
email-decode.min.js
research.checkpoint.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 		1 KB
871 B 		Script
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 06 Sep 2022 17:30:56 GMT
server
cloudflare
x-frame-options
DENY
etag
W/"631783d0-4d7"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
7485a2f84a879164-FRA
expires
Mon, 12 Sep 2022 05:06:50 GMT
sharethis.js
platform-api.sharethis.com/js/ 		190 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform-api.sharethis.com/js/sharethis.js
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-51.fra60.r.cloudfront.net
Software
/
Resource Hash
2b02c99b94bd29097fd168548bea6dfc28c9ffd3c2d751c1f375c9da902d8f63
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 04:57:17 GMT
content-encoding
gzip
vary
Accept-Encoding
age
573
etag
W/"2f749-jZtDoLQECLv0cAmOiJJ6B61Kdic"
x-frame-options
SAMEORIGIN
x-cache
Hit from cloudfront
content-type
text/javascript; charset=utf-8
via
1.1 c43915e0cad14ee7685e5f74a99ce93c.cloudfront.net (CloudFront)
edge-control
cache-maxage=60m,downstream-ttl=60m
cache-control
max-age=600, public
x-amz-cf-pop
FRA60-P3
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-id
Mck5pv_qYkH0qXN61wgUfA9a55c5X4YAZEbHN3ih6uwAGv2LqyB9Rg==
CfP_1021x580_A.jpg
research.checkpoint.com/wp-content/uploads/2018/11/ 		128 KB
128 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2018/11/CfP_1021x580_A.jpg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
408ddad0ef179adef886bffc95c5851680e2e1a3d9f04a03f5bb8d1efb73344c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
cf-cache-status
HIT
age
8052209
cf-polished
origSize=134980, status=webp_bigger
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
130561
last-modified
Thu, 07 Nov 2019 22:27:41 GMT
server
cloudflare
etag
"5dc49a5d-20f44"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7485a2f8aaf09164-FRA
cf-bgj
imgq:100,h2pri
enlighterjs.min.js
research.checkpoint.com/wp-content/plugins/enlighter/cache/ 		57 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/plugins/enlighter/cache/enlighterjs.min.js?ver=TJ0/7+iAWMKbDKS
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7e0c4a1ed3d232553d98c82ea0e04cee8975d0a67df819e161f96e7c32179e8c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 15 Feb 2021 20:35:46 GMT
server
cloudflare
age
491
etag
W/"602adb22-e33f"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7485a2f88aca9164-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
OneSignalSDK.js
cdn.onesignal.com/sdks/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=6.0.2
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d12c6745eca14e06d4dea70f4c2bd875769b349770d04300477ab18d0db005d4
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

cf-ray
7485a2f8fbebcc46-ZRH
date
Sat, 10 Sep 2022 05:06:50 GMT
via
1.1 google
cf-cache-status
HIT
server
cloudflare
age
522
etag
W/"ae63ef8ff03da61fffaa7f165729897a"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=259200
strict-transport-security
max-age=15552000; includeSubDomains
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Tue, 13 Sep 2022 05:06:50 GMT
search-icon.gif
sc1.checkpoint.com/sc1/inc/html/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sc1.checkpoint.com/sc1/inc/html/images/search-icon.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/wp-content/themes/research/header/style.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.122.24.32 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-122-24-32.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
953d6908ab55929254e46c77e5c751a6e2df7ab84430f134edc3bb62d8f7d32f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Unused62
8096267
Date
Sat, 10 Sep 2022 05:06:50 GMT
Last-Modified
Mon, 25 Sep 2017 18:13:31 GMT
Server
AkamaiNetStorage
ETag
"2e1aa25e7e77e6a393fd38efb413370f:1506366539"
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
1755
34CA47_6_0.woff2
research.checkpoint.com/wp-content/themes/research/fonts/ 		58 KB
58 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://research.checkpoint.com/wp-content/themes/research/fonts/34CA47_6_0.woff2
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.32
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0fc686423c26cb1030032fd7e4f2dd664c4b08517a8990c0b46269dd4e01910b

Request headers

Referer
https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.32
Origin
https://research.checkpoint.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
cf-cache-status
HIT
last-modified
Thu, 07 Nov 2019 22:27:48 GMT
server
cloudflare
age
8052199
etag
"5dc49a64-e890"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7485a2f8baf59164-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
59536
CPR_Africa_Blog_Article-1.jpg
research.checkpoint.com/wp-content/uploads/2022/09/ 		222 KB
223 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2022/09/CPR_Africa_Blog_Article-1.jpg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
88cbb2cb1c1bb1b74f1c390cf890f9b0a025e07b612c84e587e1763010919632

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
cf-cache-status
HIT
age
126492
cf-polished
origFmt=jpeg, origSize=514045
content-disposition
inline; filename="CPR_Africa_Blog_Article-1.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
227556
last-modified
Tue, 06 Sep 2022 06:35:14 GMT
server
cloudflare
etag
"6316ea22-7d7fd"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7485a2f8cb059164-FRA
cf-bgj
imgq:100,h2pri
image2.png
research.checkpoint.com/wp-content/uploads/2022/09/ 		60 KB
61 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2022/09/image2.png
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5917f947cb7952d6d88e104efe0ce5657bb548073c1cffb64884b7847b1809e2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
cf-cache-status
HIT
age
78685
cf-polished
origFmt=png, origSize=83406
content-disposition
inline; filename="image2.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
61732
last-modified
Mon, 05 Sep 2022 21:48:54 GMT
server
cloudflare
etag
"63166ec6-145ce"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7485a2f90b4b9164-FRA
cf-bgj
imgq:100,h2pri
image3.png
research.checkpoint.com/wp-content/uploads/2022/09/ 		192 KB
192 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2022/09/image3.png
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f377a3e89420810b6b1ced2534d5dfdc41da58e0602cad130f5240fd39a45bbd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
cf-cache-status
HIT
age
78685
cf-polished
origFmt=png, origSize=417038
content-disposition
inline; filename="image3.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
196210
last-modified
Mon, 05 Sep 2022 21:48:55 GMT
server
cloudflare
etag
"63166ec7-65d0e"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7485a2f90b4c9164-FRA
cf-bgj
imgq:100,h2pri
image4.png
research.checkpoint.com/wp-content/uploads/2022/09/ 		241 KB
242 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://research.checkpoint.com/wp-content/uploads/2022/09/image4.png
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b5a251371eb5ee909740dd838a9778aa62fe7dbd553500545e9352cccd4e68e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
cf-cache-status
HIT
age
78671
cf-polished
origFmt=png, origSize=510104
content-disposition
inline; filename="image4.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
247158
last-modified
Mon, 05 Sep 2022 21:48:59 GMT
server
cloudflare
etag
"63166ecb-7c898"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7485a2f90b4e9164-FRA
cf-bgj
imgq:100,h2pri
5a3031770f16c70012a3c297.js
buttons-config.sharethis.com/js/ 		525 B
939 B 		Script
General
Check archive.org
Download Go to
Full URL
https://buttons-config.sharethis.com/js/5a3031770f16c70012a3c297.js
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:da00:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
eee6d8fe37122ba1538560131fe5c95f9a4b6c45e2059076a7a92513fcb12f20
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:51 GMT
via
1.1 7a3193ebce69450274ae629ce856b09c.cloudfront.net (CloudFront)
last-modified
Tue, 12 Dec 2017 19:43:54 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C1
etag
"29c30155cdf2eaa96943948b94d537b6"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
text/javascript
cache-control
max-age=60,public
strict-transport-security
max-age=31536000; includeSubDomains
accept-ranges
bytes
content-length
525
x-amz-cf-id
NfxLHk4OK8QiwapaeAiQWtENzPubyEnz0aqtRaP5UPFJNoqcaw0r1g==
pview
l.sharethis.com/ 		0
410 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://l.sharethis.com/pview?event=pview&hostname=research.checkpoint.com&location=%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&product=sticky-share-buttons&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&source=sharethis.js&fcmp=false&fcmpv2=false&has_segmentio=false&title=DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research&cms=unknown&publisher=5a3031770f16c70012a3c297&sop=true&version=st_sop.js&lang=en&description=Introduction%20Recent%20studies%20show%20that%20more%20than%2085%25%20of%20financial%20institutions%20in%20Central%20and%20Western%20Africa%20have%20repeatedly%20been%20victimized%20in%20multiple%2C%20damaging%20cyberattacks.%20In%20a%20quarter%20of%20these%20cases%2C%20intrusions%20into%20network%20systems%20resulted%20in%20the%20worst%20possible%20outcomes%20for%20the%20financial%20and%20banking%20sector%3A%20information%20leaks%2C%20identity%20theft%2C%20money%20transfer%20fraud%2C%20and%20bank...%20Click%20to%20Read%20More
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.224.87 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-57-224-87.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 05:06:50 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains;
Access-Control-Allow-Origin
https://research.checkpoint.com
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Access-Control-Max-Age
1728000
Connection
keep-alive
Access-Control-Allow-Headers
*
OneSignalPageSDKES6.js
cdn.onesignal.com/sdks/ 		283 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=6.0.2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
843114448aaeeda7e8caa0cf76d61e0c63b8bffccd34517483363fdb15cdc80c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

cf-ray
7485a2f9c8bd0200-ZRH
date
Sat, 10 Sep 2022 05:06:50 GMT
via
1.1 google
cf-cache-status
HIT
server
cloudflare
age
545
etag
W/"2f96824aee4bf927e734cc519e3e726d"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=259200
strict-transport-security
max-age=15552000; includeSubDomains
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Tue, 13 Sep 2022 05:06:50 GMT
6si.min.js
j.6sc.co/ 		30 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
b71f76186117ab510aca8eb8208815da837acdd4b29e171c9897993175c28878
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 05:06:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 22 Aug 2022 22:26:40 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"630402a0-786e"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
9594
expires
Sat, 10 Sep 2022 05:06:50 GMT
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Apr 2022 21:02:38 GMT
server
Golfe2
age
6652
date
Sat, 10 Sep 2022 03:15:58 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Sat, 10 Sep 2022 05:15:58 GMT
js
www.googletagmanager.com/gtag/ 		209 KB
73 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-48VXKGDGCV&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
0d3872a4a141baff670beb7e64aeef40234a0faa27a0aab40b4428cd377572b7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
74826
x-xss-protection
0
expires
Sat, 10 Sep 2022 05:06:50 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
447 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-194688-3&cid=1437366116.1662786411&jid=931862397&gjid=1419715546&_gid=165873466.1662786411&_u=YGBAgEABAAAAAE~&z=136316374
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c06::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://research.checkpoint.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Sat, 10 Sep 2022 05:06:50 GMT
content-type
text/plain
access-control-allow-origin
https://research.checkpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=243195300&t=pageview&_s=1&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&ul=en-us&de=UTF-8&dt=DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgEAB~&jid=931862397&gjid=1419715546&cid=1437366116.1662786411&tid=UA-194688-3&_gid=165873466.1662786411&gtm=2wg9705JCRGP&z=461792733
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 09 Sep 2022 16:52:53 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
44037
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
web
onesignal.com/api/v1/sync/3ba17c77-81bb-4a83-8917-7b62de3d6e22/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onesignal.com/api/v1/sync/3ba17c77-81bb-4a83-8917-7b62de3d6e22/web?callback=__jp0
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e1d017f7421f0b19ff2b282f852335f835f6d381119164d6a22ca1813954f74f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
HIT
x-permitted-cross-domain-policies
none
age
286
cf-polished
origSize=3450
status
200 OK
x-envoy-upstream-service-time
62
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
x-request-id
832cf6cc-1a6a-4554-98af-1790758ccebd
x-runtime
0.060016
referrer-policy
strict-origin-when-cross-origin
cf-bgj
minify
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"f888df38bcbf743ad7f0a0bd5485450f"
x-download-options
noopen
strict-transport-security
max-age=15552000; includeSubDomains
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=3600
cf-ray
7485a2fa5cd0cc46-ZRH
access-control-allow-headers
SDK-Version
expires
Sat, 10 Sep 2022 06:06:50 GMT
getuidj
secure.adnxs.com/ 		11 B
709 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 10 Sep 2022 05:06:50 GMT
X-Proxy-Origin
217.64.151.32; 217.64.151.32; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
c226286a-2bff-4b9e-9f58-95ad3044376a
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://research.checkpoint.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/ 		7 B
207 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://research.checkpoint.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
collect
region1.google-analytics.com/g/ 		0
352 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-48VXKGDGCV&gtm=2oe970&_p=243195300&cid=1437366116.1662786411&ul=en-us&sr=1600x1200&_z=ccd.v9B&_s=1&sid=1662786410&sct=1&seg=0&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&dt=DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research&en=page_view&_fv=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-48VXKGDGCV&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 05:06:50 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://research.checkpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
OneSignalSDKStyles.css
onesignal.com/sdks/ 		82 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

cf-ray
7485a2faa98f0200-ZRH
date
Sat, 10 Sep 2022 05:06:50 GMT
via
1.1 google
cf-cache-status
HIT
server
cloudflare
age
533
etag
W/"4e9aaefffd5f8ae7dc83361aa2294190"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=2592000
strict-transport-security
max-age=15552000; includeSubDomains
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Mon, 10 Oct 2022 05:06:50 GMT
ga-audiences
www.google.com/ads/ 		42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-194688-3&cid=1437366116.1662786411&jid=931862397&_u=YGBAgEABAAAAAE~&z=40552894
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 05:06:50 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-194688-3&cid=1437366116.1662786411&jid=931862397&_u=YGBAgEABAAAAAE~&z=40552894
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 05:06:50 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
494 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&visitor=da4f6168-c453-4bc9-87b1-786c4765258c&session=62194a3d-338c-4bb4-8c1a-5ac08ff8a681&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A06%3A50%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&pageViewId=e23e0635-1984-4028-8f86-a1d1fd03f68c&an_uid=0
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
icon
onesignal.com/api/v1/apps/3ba17c77-81bb-4a83-8917-7b62de3d6e22/ 		176 B
599 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://onesignal.com/api/v1/apps/3ba17c77-81bb-4a83-8917-7b62de3d6e22/icon
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:e134 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57e48df5586242df165fa8424ae8cb9e360c8e81b6a711736bf1f395a2c02a2f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
x-permitted-cross-domain-policies
none
status
200 OK
x-envoy-upstream-service-time
17
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
x-request-id
f876e995-e622-4581-a776-9b56dc231098
x-runtime
0.012880
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"57e48df5586242df165fa8424ae8cb9e"
x-download-options
noopen
strict-transport-security
max-age=15552000; includeSubDomains
content-type
application/json; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
max-age=0, private, must-revalidate
cf-ray
7485a2fb28812397-ZRH
access-control-allow-headers
SDK-Version
details
epsilon.6sense.com/v3/company/ 		423 B
411 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.58.117.7 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-58-117-7.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e99a52151c294c42df9ab0df1048d2403af8d1cf94817c26c706c8d75d002743

Request headers

Authorization
Token 08e578d30e2119adb1ab60b02b8f1dd15c6b908d
Referer
https://research.checkpoint.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://research.checkpoint.com
access-control-allow-credentials
true
content-length
221
details
epsilon.6sense.com/v3/company/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.58.117.7 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-58-117-7.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization
Access-Control-Request-Method
GET
Origin
https://research.checkpoint.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://research.checkpoint.com
access-control-max-age
1800
date
Sat, 10 Sep 2022 05:06:50 GMT
server
nginx
7ec0ceb7-c110-40e8-9782-73562b05b110.gif
img.onesignal.com/t/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.onesignal.com/t/7ec0ceb7-c110-40e8-9782-73562b05b110.gif
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
vary
Accept-Encoding
cf-cache-status
HIT
age
285
x-amz-meta-cache-control
public, maxage=604800
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2901
x-amz-id-2
NU5YTaLZFxChniSzranrlIgK+EnyBXYV4cUqbnJGhiNeKN2f/W+DqK8I4w9U0R8Dh/k56+U0pgQ=
last-modified
Mon, 26 Aug 2019 20:17:26 GMT
server
cloudflare
etag
"c425f4400a5c9dfbaecb24275f494931"
strict-transport-security
max-age=15552000; includeSubDomains
x-amz-request-id
91PG7FESTS7QBHZ6
cache-control
public, max-age=2678400
accept-ranges
bytes
cf-ray
7485a2fb9dd5cc46-ZRH
expires
Tue, 11 Oct 2022 05:06:50 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://research.checkpoint.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Thu, 08 Sep 2022 08:01:51 GMT
x-content-type-options
nosniff
age
162299
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 08 Sep 2023 08:01:51 GMT
twitter.svg
platform-cdn.sharethis.com/img/ 		731 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/twitter.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:5c00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7c93346d4f681a0be90d1dfc19346382a4700f1810f41caa54415688dee1777f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 13 Aug 2022 02:42:10 GMT
via
1.1 04ce5a607a98db6d08257633417b84d6.cloudfront.net (CloudFront)
vary
Accept-Encoding
age
2427881
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
731
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
etag
"0af2fb38987598376c99e21af17ade45"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
OW81mOZSilJwp8gC8-SAVLzmyqoXd80Iyy_DwghKlsfLm0vsd7UfJA==
whatsapp.svg
platform-cdn.sharethis.com/img/ 		832 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/whatsapp.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:5c00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
847eb36b4dc4b05f94052dcd98077319e74d882334a106bb9ca451ba211c9c2c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Sun, 14 Aug 2022 22:10:43 GMT
via
1.1 04ce5a607a98db6d08257633417b84d6.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
age
2271368
etag
"afe7fc60ed757db39a88d2950fce69c9"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
832
x-amz-cf-id
fOzl8jLzZx1diWjOD30IKgOwynTisvxePMa9oisc0WtcE7TsfX_4RA==
facebook.svg
platform-cdn.sharethis.com/img/ 		301 B
743 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/facebook.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:5c00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Thu, 11 Aug 2022 23:48:36 GMT
via
1.1 04ce5a607a98db6d08257633417b84d6.cloudfront.net (CloudFront)
vary
Accept-Encoding
age
2524695
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
301
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
etag
"c6e9be45643e197ce1db1d7e24a99adc"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
5xZ5n0B-rpO8bvdmtENqj-5QwBpzEwlR4tbJ6RcLzNumhxwmyOHX7w==
linkedin.svg
platform-cdn.sharethis.com/img/ 		456 B
879 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/linkedin.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:5c00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Mon, 29 Aug 2022 03:10:45 GMT
via
1.1 04ce5a607a98db6d08257633417b84d6.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
age
1043766
etag
"fa43b4ede18498b114fc7185993f6da7"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
456
x-amz-cf-id
dRg_9yAaAz57u9S89HasDYu7l1iIxbM8rpN_cOtdYZDtGAphh3ZTLw==
email.svg
platform-cdn.sharethis.com/img/ 		343 B
767 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/email.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:5c00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Mon, 22 Aug 2022 04:56:04 GMT
via
1.1 04ce5a607a98db6d08257633417b84d6.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
age
1642247
etag
"5977437466e857c7ddcadda6f6d88c2a"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
343
x-amz-cf-id
ZgSlIJswfbeTLWzE_p_G0YbckLpwOolUIaNL1dLxVjwt2bPzEq8ZCg==
pinterest.svg
platform-cdn.sharethis.com/img/ 		771 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/pinterest.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:5c00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
efc737b4f58cfe73a9bd0e57d7570365701381da31e628b269e7217a0ce3359d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Sat, 20 Aug 2022 03:57:45 GMT
via
1.1 04ce5a607a98db6d08257633417b84d6.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
age
1818546
etag
"2b10a062e719c64b686e2e8fcdc216dc"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
771
x-amz-cf-id
PlbKXPVWTdY4qAiGs6dxgS90Wl0FkWMZFaTG87I0k2QQU_1mnt9TDQ==
sharethis.svg
platform-cdn.sharethis.com/img/ 		514 B
936 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/sharethis.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:5c00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Fri, 09 Sep 2022 00:38:14 GMT
via
1.1 04ce5a607a98db6d08257633417b84d6.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
age
102517
etag
"deecdaa377907db5cc1722fc831670a1"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
514
x-amz-cf-id
02D9Aevk2VX4Nzoet6xRvqX6RyZPha5fymSadwW664lxBU5GfLgWSw==
reddit.svg
platform-cdn.sharethis.com/img/ 		910 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/reddit.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:5c00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
dadbb59b37bfea4c78c6e15c8cbb96dfba84526e43a0767dc244fd062a841aba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Thu, 25 Aug 2022 06:22:19 GMT
via
1.1 04ce5a607a98db6d08257633417b84d6.cloudfront.net (CloudFront)
last-modified
Thu, 10 Oct 2019 01:20:13 GMT
server
AmazonS3
age
1377872
etag
"78d796ca648d8a5e665b48ed0217c56a"
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
910
x-amz-cf-id
g9QSW1UBaIdKX5SNsGQYnQp2UlbkhpFJ3z3v2uFycNuu0MEDlRKbVA==
arrow_left.svg
platform-cdn.sharethis.com/img/ 		565 B
1008 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/arrow_left.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:5c00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Wed, 07 Sep 2022 05:01:47 GMT
via
1.1 04ce5a607a98db6d08257633417b84d6.cloudfront.net (CloudFront)
vary
Accept-Encoding
age
259504
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
565
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
etag
"b55d8d2b9321e381a3c38a4bddb74037"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
Py_LLMTaXqh40Wnf7aSEzZRY2wm8UX1svlLeVfSZuSqGZoziGC0Zuw==
arrow_right.svg
platform-cdn.sharethis.com/img/ 		565 B
1007 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://platform-cdn.sharethis.com/img/arrow_right.svg
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:5c00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 13 Aug 2022 23:55:45 GMT
via
1.1 04ce5a607a98db6d08257633417b84d6.cloudfront.net (CloudFront)
vary
Accept-Encoding
age
2351466
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
565
last-modified
Thu, 10 Oct 2019 01:20:12 GMT
server
AmazonS3
etag
"9928d025bd5792b718ee0a185f62e67c"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/svg+xml
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
x-amz-cf-id
z0qZBTyKutE9AN_NwQZwjw15izCwEXrKx4hdTLp7IP0adWcVQ6cKvA==
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=243195300&t=event&ni=1&_s=1&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&ul=en-us&de=UTF-8&dt=DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aGDAgEABAAAAAE~&jid=&gjid=&cid=1437366116.1662786411&tid=UA-194688-3&_gid=165873466.1662786411&gtm=2wg9705JCRGP&cd9=&cd10=&cd11=&cd12=&cd13=&cd14=&cd16=&cd17=&z=1804652653
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 09 Sep 2022 16:52:53 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
44037
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
trends.min.js
assets.trendemon.com/tag/ 		220 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.trendemon.com/tag/trends.min.js
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-122-15.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
67affcd8e2f46a4ab641f378e973888030cc93455e54b6a042cb0691056549d2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Fri, 09 Sep 2022 20:08:16 GMT
content-encoding
gzip
last-modified
Mon, 05 Sep 2022 08:38:16 GMT
server
AmazonS3
age
32316
etag
"3d6c5cab0eeb5ffb72700457b43a473e"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 0121ceb2efadb6db52d122a8b6b52f90.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P2
accept-ranges
bytes
content-length
43730
x-amz-cf-id
GvG5EbQAkzV6NHPhZ7QTFAlmW71BBXysIS5e45-cPlQs9fa4WYPyPA==
insight.min.js
snap.licdn.com/li.lms-analytics/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:14a3 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:51 GMT
content-encoding
gzip
last-modified
Fri, 12 Aug 2022 20:23:36 GMT
x-cdn
AKAM
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=68645
accept-ranges
bytes
content-length
3063
uwt.js
static.ads-twitter.com/ 		56 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.16.157 Vienna, Austria, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
41b758f84ab2dd5da6f7ba488813d17410ebb48bc2074d304c26d63c5ece003d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:51 GMT
content-encoding
gzip
last-modified
Tue, 30 Aug 2022 15:04:19 GMT
etag
"d4de8398858246712016031c834bb061+gzip+gzip"
vary
Accept-Encoding,Host
x-tw-cdn
FT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache
x-cache
HIT, HIT
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
content-length
15317
x-served-by
cache-iad-kjyo7100064-IAD, cache-vie6365-VIE
munchkin.js
munchkin.marketo.net/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.205.237.4 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-205-237-4.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
91a50850c517899e1c975079158949f7a500ddf5a7307fe36bf50092926beedc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 05:06:51 GMT
Content-Encoding
gzip
Last-Modified
Fri, 09 Sep 2022 01:18:39 GMT
Server
AkamaiNetStorage
ETag
"92b41a298690c047b0c4602dd843cba4:1662686319.691662"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
728
fbevents.js
connect.facebook.net/en_US/ 		100 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: research.checkpoint.com
URL: https://research.checkpoint.com/2022/dangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
5ae95e748ad12444cd760e245c02264cea3e8deb41fabd95f1e0784b81f72783
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
26737
x-xss-protection
0
pragma
public
x-fb-debug
Z40aejvuB+E1yDICkj7PntNs1NrncMz8neAdSMtzYGCcPFXYj5tMlFUMJ6U9VbaFETB7RboaV7ks9BixKb6nkg==
x-fb-trip-id
686109401
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Sat, 10 Sep 2022 05:06:51 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
x-fb-rlafr
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
1692853834349189
connect.facebook.net/signals/config/ 		292 KB
84 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/1692853834349189?v=2.9.79&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
c7987fa399af086aa19748e7504ca702d17233ab72abbb1a078880ac9c3a9cce
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
85827
x-xss-protection
0
pragma
public
x-fb-debug
wqhJPRSmpP+l4Za9ykbWfPwKt+pY74yu4umDAswAfe5o8/4N2itiohiEy51d+FuZak7I6cc4w/yOosb0i9weOQ==
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Sat, 10 Sep 2022 05:06:51 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
munchkin.js
munchkin.marketo.net/162/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/162/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.205.237.4 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-205-237-4.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 05:06:51 GMT
Content-Encoding
gzip
Last-Modified
Fri, 01 Jul 2022 00:59:12 GMT
Server
AkamaiNetStorage
ETag
"75daf56f6191efe42577301908659c29:1656637152.894482"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4677
Expires
Mon, 19 Dec 2022 05:06:51 GMT
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1662786411114&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D51830%26time%3D1662786411114%26url%3Dhttps%253A%252F%252Fresearch.checkpoint.com%...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1662786411114&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1662786411114&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institution...
0
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1662786411114&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&liSync=true&e_ipv6=AQLZwcPT3XRhLgAAAYMlyxvcxJ4JAVuG6qwXJyxQuOw-5CndwP-52NfBTHUDvBx5BNb5nWrkwVUQrbqwZOQkBrE0MfiYew
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:50 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 91721E238EA34137AFCA5C65AB082F32 Ref B: FRAEDGE1519 Ref C: 2022-09-10T05:06:51Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-proto
http/2
content-length
0
x-li-uuid
AAXoS6FnFatcSCm0BcB+Qg==
x-li-fabric
prod-lva1

Redirect headers

date
Sat, 10 Sep 2022 05:06:50 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 9B58312BA3994919B47951C2733018CB Ref B: FRAEDGE1219 Ref C: 2022-09-10T05:06:51Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1662786411114&url=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&liSync=true&e_ipv6=AQLZwcPT3XRhLgAAAYMlyxvcxJ4JAVuG6qwXJyxQuOw-5CndwP-52NfBTHUDvBx5BNb5nWrkwVUQrbqwZOQkBrE0MfiYew
x-li-proto
http/2
content-length
0
x-li-uuid
AAXoS6FksYLrEiLgvONxDw==
visitWebPage
750-dqh-528.mktoresp.com/webevents/ 		2 B
318 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://750-dqh-528.mktoresp.com/webevents/visitWebPage?_mchNc=1662786411134&_mchCn=&_mchId=750-DQH-528&_mchTk=_mch-checkpoint.com-1662786411134-98019&_mchHo=research.checkpoint.com&_mchPo=&_mchRu=%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&_mchPc=https%3A&_mchVr=162&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/162/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Sat, 10 Sep 2022 05:06:51 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
45e542e6-0e3d-4f3b-b9ff-18cbd2b1e3a0
adsct
t.co/i/ 		43 B
336 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/i/adsct?bci=3&eci=2&event_id=d2211dd6-b587-4339-8e74-6afad84b3be6&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=5a0e962e-1129-4fad-85f5-0fee622e45d8&tw_document_href=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxi3o&type=javascript&version=2.3.27
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.5 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-response-time
115
date
Sat, 10 Sep 2022 05:06:50 GMT
server
tsa_o
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
756aad1f52ced0e8203c08c8db12b5d144804bef0fd5eae11ce6cecf521e0488
content-length
43
adsct
analytics.twitter.com/i/ 		43 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=d2211dd6-b587-4339-8e74-6afad84b3be6&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=5a0e962e-1129-4fad-85f5-0fee622e45d8&tw_document_href=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nxi3o&type=javascript&version=2.3.27
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.131 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-response-time
112
date
Sat, 10 Sep 2022 05:06:51 GMT
server
tsa_o
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
e91a4faf3a5324f2d58462f725711f5386a6377308761af3c7709e0e3ee061e6
content-length
43
/
www.facebook.com/tr/ 		44 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=1692853834349189&ev=PageView&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&rl=&if=false&ts=1662786411182&sw=1600&sh=1200&v=2.9.79&r=stable&ec=0&o=30&fbp=fb.1.1662786411181.1985040303&it=1662786411100&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:51 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
44
expires
Sat, 10 Sep 2022 05:06:51 GMT
2336
trackingapi.trendemon.com/api/settings/ 		745 B
884 B 		Script
General
Check archive.org
Download Go to
Full URL
https://trackingapi.trendemon.com/api/settings/2336?callback=jsonp64652&vid=
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.168.228.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-168-228-181.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
0222ddcd7ee438945126889c7f076c87973506d0c747e858005b8a50d46c812f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 05:06:51 GMT
cache-control
no-store,no-cache
server
Kestrel
content-length
745
content-type
application/x-javascript; charset=UTF-8
img.gif
b.6sc.co/v1/beacon/ 		43 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&visitor=da4f6168-c453-4bc9-87b1-786c4765258c&session=62194a3d-338c-4bb4-8c1a-5ac08ff8a681&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A06%3A51%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A06%3A50%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&pageViewId=e23e0635-1984-4028-8f86-a1d1fd03f68c&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:51 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
/
www.facebook.com/tr/ Frame 48CE 		0
18 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://research.checkpoint.com
Referer
https://research.checkpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://research.checkpoint.com
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Sat, 10 Sep 2022 05:06:51 GMT
priority
u=0
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
identity.min.js
assets.trendemon.com/global/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.trendemon.com/global/identity.min.js
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-122-15.fra60.r.cloudfront.net
Software
/ Express
Resource Hash
c66036f1288dcf003502e4f687e102a7ec6afe8bfa29daa9a5bb5ab62eb3567c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 00:46:56 GMT
content-encoding
gzip
age
15602
x-powered-by
Express
x-cache
Hit from cloudfront
via
1.1 0121ceb2efadb6db52d122a8b6b52f90.cloudfront.net (CloudFront)
trd-ts
2022-09-07T00:46:47.641Z
last-modified
Mon, 05 Sep 2022 08:36:43 GMT
etag
W/"46f8-1830ccb7178"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
x-amz-cf-pop
FRA60-P2
accept-ranges
bytes
x-amz-cf-id
qQfn7cm1TGSMCEJ7OS3BLCzYuQcENd1AEFxK0g7eIeqKtrjId5k4Ow==
me
trackingapi.trendemon.com/api/Identity/ 		95 B
509 B 		Script
General
Check archive.org
Download Go to
Full URL
https://trackingapi.trendemon.com/api/Identity/me?accountId=2336&DomainCookie=16627864117931458&fingerPrint=d26d751f1986e8bb55982e80b2c0dd74&callback=jsonp125461&vid=
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.168.228.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-168-228-181.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
3b9364ccc4bcf3ca52021353ee5e8b53fdccb100217f7bb41696203c22a3d45f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 05:06:52 GMT
cache-control
no-store,no-cache
server
Kestrel
content-length
95
content-type
application/x-javascript; charset=UTF-8
marketingautomation
trackingapi.trendemon.com/api/ 		95 B
232 B 		Script
General
Check archive.org
Download Go to
Full URL
https://trackingapi.trendemon.com/api/marketingautomation?AccountId=2336&ClientUrl=aHR0cHM6Ly9yZXNlYXJjaC5jaGVja3BvaW50LmNvbS8yMDIyL2Rhbmdlcm91c3NhdmFubmEtdHdvLXllYXItbG9uZy1jYW1wYWlnbi10YXJnZXRzLWZpbmFuY2lhbC1pbnN0aXR1dGlvbnMtaW4tZnJlbmNoLXNwZWFraW5nLWFmcmljYS8%3D&CookieId=16627864117931458&MaCookie=aWQ6NzUwLURRSC01MjgmdG9rZW46X21jaC1jaGVja3BvaW50LmNvbS0xNjYyNzg2NDExMTM0LTk4MDE5&MaCookieName=X21rdG9fdHJr&MaName=marketo&callback=jsonp151715&vid=2336:16627521547179979
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.168.228.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-168-228-181.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
519b650a4661d30815ffeb31959d71e7df5012c6b6dddfb5a00768a256bbd004

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 05:06:52 GMT
cache-control
no-store,no-cache
server
Kestrel
content-length
95
content-type
application/x-javascript; charset=UTF-8
personal
trackingapi.trendemon.com/api/experience/ 		14 B
113 B 		Script
General
Check archive.org
Download Go to
Full URL
https://trackingapi.trendemon.com/api/experience/personal?AccountId=2336&ClientUrl=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&MarketingAutomationCookie=id%3A750-DQH-528%26token%3A_mch-checkpoint.com-1662786411134-98019&ExcludeUnitsJson=%5B%5D&callback=jsonp17293&vid=2336:16627521547179979
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.168.228.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-168-228-181.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
94c5f6452ee3b876e465971b68020bc726229818b2ddb59ca2a400063cbcff5d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:52 GMT
server
Kestrel
content-length
14
content-type
application/x-javascript; charset=UTF-8
pageview
trackingapi.trendemon.com/api/events/ 		43 B
234 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trackingapi.trendemon.com/api/events/pageview?accountId=2336&url=aHR0cHM6Ly9yZXNlYXJjaC5jaGVja3BvaW50LmNvbS8yMDIyL2Rhbmdlcm91c3NhdmFubmEtdHdvLXllYXItbG9uZy1jYW1wYWlnbi10YXJnZXRzLWZpbmFuY2lhbC1pbnN0aXR1dGlvbnMtaW4tZnJlbmNoLXNwZWFraW5nLWFmcmljYS8%3D&cookie=16627864117931458&referral=&vid=2336:16627521547179979&r=1662786412085
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.168.228.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-168-228-181.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 05:06:52 GMT
server
Kestrel
age
1691358
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
content-length
43
expires
Mon, 01 Jan 1990 00:00:00 GMT
multiple
trackingapi.trendemon.com/api/events/client-app/ 		43 B
234 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trackingapi.trendemon.com/api/events/client-app/multiple?accountId=2336&url=aHR0cHM6Ly9yZXNlYXJjaC5jaGVja3BvaW50LmNvbS8yMDIyL2Rhbmdlcm91c3NhdmFubmEtdHdvLXllYXItbG9uZy1jYW1wYWlnbi10YXJnZXRzLWZpbmFuY2lhbC1pbnN0aXR1dGlvbnMtaW4tZnJlbmNoLXNwZWFraW5nLWFmcmljYS8%3D&app=sixsense&names=%5B%5D&vid=2336:16627521547179979&r=1662786412094
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.168.228.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-168-228-181.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 10 Sep 2022 05:06:52 GMT
server
Kestrel
age
1691358
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
content-length
43
expires
Mon, 01 Jan 1990 00:00:00 GMT
personal-embedded
trackingapi.trendemon.com/api/experience/ 		14 B
113 B 		Script
General
Check archive.org
Download Go to
Full URL
https://trackingapi.trendemon.com/api/experience/personal-embedded?AccountId=2336&ClientUrl=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&MarketingAutomationCookie=id%3A750-DQH-528%26token%3A_mch-checkpoint.com-1662786411134-98019&Ids=%5B%5D&Groups=%5B%5D&callback=jsonp69715&vid=2336:16627521547179979
Requested by
Host: assets.trendemon.com
URL: https://assets.trendemon.com/tag/trends.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.168.228.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-168-228-181.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
dd9e3b2906f31cde9f53110cfe8d52a2c3ca6ff430e344829d0fa66cdd1489e8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:52 GMT
server
Kestrel
content-length
14
content-type
application/x-javascript; charset=UTF-8
img.gif
b.6sc.co/v1/beacon/ 		43 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&visitor=da4f6168-c453-4bc9-87b1-786c4765258c&session=62194a3d-338c-4bb4-8c1a-5ac08ff8a681&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A06%3A52%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A06%3A51%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&pageViewId=e23e0635-1984-4028-8f86-a1d1fd03f68c&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:52 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&visitor=da4f6168-c453-4bc9-87b1-786c4765258c&session=62194a3d-338c-4bb4-8c1a-5ac08ff8a681&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A06%3A53%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A06%3A52%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&pageViewId=e23e0635-1984-4028-8f86-a1d1fd03f68c&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:53 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
494 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&visitor=da4f6168-c453-4bc9-87b1-786c4765258c&session=62194a3d-338c-4bb4-8c1a-5ac08ff8a681&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A06%3A54%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A06%3A53%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%224005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&pageViewId=e23e0635-1984-4028-8f86-a1d1fd03f68c&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:55 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
494 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&visitor=da4f6168-c453-4bc9-87b1-786c4765258c&session=62194a3d-338c-4bb4-8c1a-5ac08ff8a681&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A06%3A55%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A06%3A54%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225006%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&pageViewId=e23e0635-1984-4028-8f86-a1d1fd03f68c&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:55 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/ 		43 B
493 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&visitor=da4f6168-c453-4bc9-87b1-786c4765258c&session=62194a3d-338c-4bb4-8c1a-5ac08ff8a681&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A06%3A56%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2010%20Sep%202022%2005%3A06%3A55%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226007%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DangerousSavanna%3A%20Two-year%20long%20campaign%20targets%20financial%20institutions%20in%20French-speaking%20Africa%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2022%2Fdangeroussavanna-two-year-long-campaign-targets-financial-institutions-in-french-speaking-africa%2F&pageViewId=e23e0635-1984-4028-8f86-a1d1fd03f68c&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-137-162.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://research.checkpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Sat, 10 Sep 2022 05:06:56 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

127 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| dataLayer function| $ function| jQuery object| bootstrap function| jQueryBridget function| EvEmitter function| getSize function| matchesSelector object| fizzyUIUtils function| Flickity function| Unipointer function| Unidragger function| TapListener function| imagesLoaded function| documentInitOneSignal function| OneSignal object| st object| __stdos__ boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus function| __sharethis__docReady object| __sharethis__ object| EnlighterJS function| EnlighterJSINIT object| google_tag_manager function| postscribe object| google_tag_manager_external function| processEpsilonData string| epsilonName boolean| enabled function| callback number| version object| _6si object| google_tag_data string| GoogleAnalyticsObject function| ga number| TRD_ACC_ID object| gaplugins object| gaGlobal object| gaData number| __oneSignalSdkLoadCount object| _oneSignalInitOptions function| __jp0 function| onYouTubeIframeAPIReady boolean| _storagePopulated string| _linkedin_data_partner_id function| twq function| fbq function| _fbq function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin function| lintrk boolean| _already_called_lintrk object| MunchkinTracker object| regeneratorRuntime object| twttr function| $Trd_Base64 function| $Trd_i18n function| __awaiter function| __generator function| $Trd_Utils function| $Trd_Tools function| $Trd_Logger function| RecordsService function| __extends function| $Trd_UserPageHistory_Cook object| enRenderModes object| $Trd_InternalEventsTypes object| $Trd_TriggersEventsTypes function| mapBackendTriggers function| $Trd_Context function| $Trd_EnvironmentSettings function| $Trd_ClientCookie function| $Trd_CtaClientCookie function| $Trd_ButtonSelector object| Frequency object| UnitVisibiltyType object| UnitTypeId string| LOCAL_STORAGE_ITEM_NAME function| $Trd_FormListener object| COOKIE_NAMES function| $Trd_Visitor function| $Trd_UrlGrabber function| $Trd_Events function| $Trd_Pageview function| $Trd_Newvisitor function| $Trd_Cookmanager string| $TRD_MA_COOKIE_NAME object| $TRD_MA_COOKIE_NAME_MAP function| $Trd_MarketingAutomation function| $TRD_CtaComponent function| $TRD_CtaContentComponent function| $TRD_GenericLayoutComponent function| $TRD_FormLayoutComponent function| $TRD_RecommendationLayoutComponent function| $TRD_GenericScriptComponent function| $TRD_FastTextLayoutComponent function| $TRD_SurveyLayoutComponent function| __assign function| __spreadArray number| COOLOFF_DAYS_AFTER_CLOSE number| COOLOFF_MS_AFTER_CLOSE function| $Trd_ExperienceManager function| $TRD_ClientAppFactory function| $TRD_ClientApp function| $TRD_ClientAppDrift function| $TRD_ClientAppSixSense object| trdContext undefined| src function| $Trd_Lift function| $Trd_Embedded function| $Trd_NApi object| TrendemonContext object| $trd_Context object| trd_api object| IdentityConfig function| $Trd_Identity

33 Cookies

Domain/Path Name / Value
.checkpoint.com/ Name: referralURL
Value:
.checkpoint.com/ Name: _gid
Value: GA1.2.165873466.1662786411
.checkpoint.com/ Name: _dc_gtm_UA-194688-3
Value: 1
.checkpoint.com/ Name: _ga_48VXKGDGCV
Value: GS1.1.1662786410.1.0.1662786410.0.0.0
research.checkpoint.com/ Name: _an_uid
Value: 0
research.checkpoint.com/ Name: _gd_visitor
Value: da4f6168-c453-4bc9-87b1-786c4765258c
research.checkpoint.com/ Name: _gd_session
Value: 62194a3d-338c-4bb4-8c1a-5ac08ff8a681
.checkpoint.com/ Name: _ga
Value: GA1.2.1437366116.1662786411
.6sc.co/ Name: 6suuid
Value: cbd5ce17a73e00006a1b1c63a70300000f380701
.checkpoint.com/ Name: _mkto_trk
Value: id:750-DQH-528&token:_mch-checkpoint.com-1662786411134-98019
.checkpoint.com/ Name: _fbp
Value: fb.1.1662786411181.1985040303
.facebook.com/ Name: fr
Value: 0fUrGCnFVIdoUhTm0..BjHBtr...1.0.BjHBtr.
.linkedin.com/ Name: UserMatchHistory
Value: AQJuBYQHPb9w2gAAAYMlyxrgmQ4IWTQz8YxlEZyoZcyFBzghtWAcH-_-dIPYQwaEZYEaVgF2CTffJg
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQLQOUZKs5DTuAAAAYMlyxrgXE4Nbl6sH0zkkJ88qKMN83KOziPWVhQ4TxtZY98-wsf1Cml5b5UQO-Ssjkq2PQ
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&0a5cf513-1ce7-4356-8579-3fd177e591d2"
.linkedin.com/ Name: lidc
Value: "b=VGST08:s=V:r=V:a=V:p=V:g=2396:u=1:x=1:i=1662786411:t=1662872811:v=2:sig=AQFguMXdn_cDdOgAf-acjocK8ibvLYz4"
.t.co/ Name: muc_ads
Value: 79289d9c-512f-461b-931a-12868416b757
.twitter.com/ Name: personalization_id
Value: "v1_dv8NPUwAAscSEgm2uu1P/g=="
.linkedin.com/ Name: lang
Value: v=2&lang=de-de
.www.linkedin.com/ Name: bscookie
Value: "v=1&202209100506510e6f7740-f663-41c1-8c6e-cece2f6db80fAQEy7HDXptiuCraE8wlE5Ov0GRPZLV6l"
.linkedin.com/ Name: li_gc
Value: MTswOzE2NjI3ODY0MTE7MjswMjHDund+B8HxvPDLP7z8KGGwf36qxaTioH+HThFC0jhctA==
.checkpoint.com/ Name: trd_cid
Value: 16627864117931458
trackingapi.trendemon.com/ Name: trd_gavid_2336
Value: 16627521547179979
trackingapi.trendemon.com/ Name: trd_gvid
Value: 16627521547179979
trackingapi.trendemon.com/ Name: trd_vid_2336
Value: 2336%3A16627521547179979
.checkpoint.com/ Name: trd_vid_l
Value: 2336%3A16627521547179979
.checkpoint.com/ Name: trd_vuid_l
Value: -5618392221253186188
.checkpoint.com/ Name: trd_first_visit
Value: 1662786412
.checkpoint.com/ Name: trd_pw
Value: 1
.checkpoint.com/ Name: trd_pws
Value: 1
.checkpoint.com/ Name: trd_sid
Value: 16627864120838748
.checkpoint.com/ Name: trd_ma_cookie
Value: aWQ6NzUwLURRSC01MjgmdG9rZW46X21jaC1jaGVja3BvaW50LmNvbS0xNjYyNzg2NDExMTM0LTk4MDE5

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

750-dqh-528.mktoresp.com
analytics.twitter.com
assets.trendemon.com
b.6sc.co
buttons-config.sharethis.com
c.6sc.co
cdn.onesignal.com
code.jquery.com
connect.facebook.net
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
img.onesignal.com
j.6sc.co
l.sharethis.com
munchkin.marketo.net
onesignal.com
platform-api.sharethis.com
platform-cdn.sharethis.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
research.checkpoint.com
sc1.checkpoint.com
secure.adnxs.com
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
trackingapi.trendemon.com
use.fontawesome.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
104.122.24.32
104.244.42.131
104.244.42.5
13.107.42.14
13.32.99.51
141.193.213.21
18.66.122.15
192.28.144.124
199.232.16.157
2001:4860:4802:32::36
2001:4860:4802:36::178
2001:4de0:ac18::1:a:3b
23.205.237.4
2600:9000:20eb:da00:c:abe:f440:93a1
2600:9000:21f3:5c00:1d:85c3:6640:93a1
2606:4700:3032::ac43:a9f7
2606:4700::6812:e134
2606:4700::6812:e234
2620:1ec:21::14
2a00:1450:4001:813::200a
2a00:1450:4001:82a::2003
2a00:1450:4001:82b::2004
2a00:1450:4001:82b::2008
2a00:1450:4001:82f::2003
2a00:1450:400c:c06::9c
2a02:26f0:3500:16::215:14a3
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f107:83:face:b00c:0:25de
35.168.228.181
37.252.172.123
52.57.224.87
52.58.117.7
96.16.137.162
0222ddcd7ee438945126889c7f076c87973506d0c747e858005b8a50d46c812f
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8
0d3872a4a141baff670beb7e64aeef40234a0faa27a0aab40b4428cd377572b7
0fc686423c26cb1030032fd7e4f2dd664c4b08517a8990c0b46269dd4e01910b
0fe8bcbcd24ab838fbbd773001253fc0353956e81c5ba9c8e23951ebdbae305a
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
145eb008d49de71b20b1cf3af97811af227b223c812d0f4a35929604c6180c04
1998582382fbf956231d65be84b76e08c0c86e5ced8a99c703bdec416d876d76
1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e
234b9bab83aa0c52e9e5192995427a2bc44876cf1a11545ed631f369b8dc6534
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2b02c99b94bd29097fd168548bea6dfc28c9ffd3c2d751c1f375c9da902d8f63
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255
35436a26851b1eafd22845313b120ae9dbe7cf7e437f086ced89e4aa0042047c
3643b2c826a615065303aa44b8f463eb854d77934f5f25dc1f74f60d4698f9f0
3b9364ccc4bcf3ca52021353ee5e8b53fdccb100217f7bb41696203c22a3d45f
408ddad0ef179adef886bffc95c5851680e2e1a3d9f04a03f5bb8d1efb73344c
41b758f84ab2dd5da6f7ba488813d17410ebb48bc2074d304c26d63c5ece003d
43ca94d55e3813bb9304cae5f890914b1ed56b7bc5d1196f5c1e6e3da2a67f8a
481a0574246e281316ffa0e15399bf5388bb81ae550ce0401a0353b6bb2d1e5a
519b650a4661d30815ffeb31959d71e7df5012c6b6dddfb5a00768a256bbd004
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57e48df5586242df165fa8424ae8cb9e360c8e81b6a711736bf1f395a2c02a2f
5917f947cb7952d6d88e104efe0ce5657bb548073c1cffb64884b7847b1809e2
5ae95e748ad12444cd760e245c02264cea3e8deb41fabd95f1e0784b81f72783
5b5a251371eb5ee909740dd838a9778aa62fe7dbd553500545e9352cccd4e68e
5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57
5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009
6048e330c0f362be46b20de45d35a5ace57a04be04a29da10448d6949f6f69ce
67affcd8e2f46a4ab641f378e973888030cc93455e54b6a042cb0691056549d2
768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
791d8c8cb135d3d53915096e999d3857b6ee16966c20a019f38699f09f6aa2ff
7c93346d4f681a0be90d1dfc19346382a4700f1810f41caa54415688dee1777f
7e0c4a1ed3d232553d98c82ea0e04cee8975d0a67df819e161f96e7c32179e8c
7f5bd223eafa1c6d1aff21c91c6bfb825f7f36830d97eef41c432681ed671f85
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
843114448aaeeda7e8caa0cf76d61e0c63b8bffccd34517483363fdb15cdc80c
847eb36b4dc4b05f94052dcd98077319e74d882334a106bb9ca451ba211c9c2c
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
88cbb2cb1c1bb1b74f1c390cf890f9b0a025e07b612c84e587e1763010919632
91a50850c517899e1c975079158949f7a500ddf5a7307fe36bf50092926beedc
94c5f6452ee3b876e465971b68020bc726229818b2ddb59ca2a400063cbcff5d
953d6908ab55929254e46c77e5c751a6e2df7ab84430f134edc3bb62d8f7d32f
9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a22d6b8782097b7cd9588ab582e119bfd6290278275661e9d0f96b2baec0cb8e
a59bba774218f207179b30aa8bbd21bad0f7355a52321e08138bd77a308c27d5
a8da941d8a446516c824ebc9fb77b42e6b92c6deed1daed266bd821ed27bc516
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae3754c54a0880a98a94c423d3e67f39b5b6f3c63516dafa33866e3e74c9f97d
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242
b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1
b71f76186117ab510aca8eb8208815da837acdd4b29e171c9897993175c28878
b7cfb1c9430d90b22b3f4497543a4cfef719dc40a3cce130cad766171abe8bbe
bb3d017273ed487674d9766d8401cf458228596adcc0c3a6024f44ae715090db
c0f7ef8329ae6da56bd269492901fb024a05d7b67e977995a82b506af4b3b030
c66036f1288dcf003502e4f687e102a7ec6afe8bfa29daa9a5bb5ab62eb3567c
c7987fa399af086aa19748e7504ca702d17233ab72abbb1a078880ac9c3a9cce
cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120
d12c6745eca14e06d4dea70f4c2bd875769b349770d04300477ab18d0db005d4
d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51
dadbb59b37bfea4c78c6e15c8cbb96dfba84526e43a0767dc244fd062a841aba
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd9e3b2906f31cde9f53110cfe8d52a2c3ca6ff430e344829d0fa66cdd1489e8
e1d017f7421f0b19ff2b282f852335f835f6d381119164d6a22ca1813954f74f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e99a52151c294c42df9ab0df1048d2403af8d1cf94817c26c706c8d75d002743
eee6d8fe37122ba1538560131fe5c95f9a4b6c45e2059076a7a92513fcb12f20
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef9e48bd5f604cd8d52ac00607fc60c2f4276a7e88c3f2bce907c7aaec90ed41
efc737b4f58cfe73a9bd0e57d7570365701381da31e628b269e7217a0ce3359d
f377a3e89420810b6b1ced2534d5dfdc41da58e0602cad130f5240fd39a45bbd
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe2df9f6df4b4a8d7174d259f563b8d9e28e4c03f8f4092fd9db6044e0e64c32