trenchcoat
Free · no sign-up Get the extension
Website report · 28 Oct 2026

research.checkpoint.com

“Tricks from the Past deployed via signed ChatGPT and Claude binaries - Check Point Research”

Template-written 165 evidence items Code reader analysed 15 scripts
What this means for you

Check Point Research talked to 50 outside services on a first visit, including 25 that measure visits or show ads.E7E32E18E50

  • Tech check: the site claims ai / agents and a working app / platform, and its public page shows matching evidence.E163E164E22E52E148
  • Before you click anything, the page loads analytics or ad services: Google Analytics / Tag Manager, Meta Pixel, Microsoft Clarity, Google Ads / DoubleClick, LinkedIn Ads and 5 more.E7E32E18E50E49E23
  • 67 cookies were set in your browser, 36 of them by other companies' domains.E58E64E65E67E68
  • Some features send data to AI providers: OpenAI.E22E52

Tech check

What the site says about itself, next to what its public page actually loads. Facts only, no verdict: you decide.

Evidence found

AI / agents

“…UNDER ATTACK? Latest Publications CPR Podcast Channel AI Research Intelligence Reports Resources About Us SUBSC…”E163

It talks to AI services: OpenAIE22E52

AI-looking endpoints: /api/ai/page-summary, /api/ai/guiding-questions, /api/ai/run-prompt/unitE148E149E150

Evidence found

A working app / platform

“…n Uzbek Tatar The malware continues to resolve Windows API functions dynamically from kernel32.dll and ntdll.dll…”E164

Calls to its own backend: /wp-json/contact-form-7/v1/contact-forms/26727/feedback/schema, /wp-json/contact-form-7/v1/contact-forms/26727/refill, /trameas/g/collectE135E136E137

Calls its own backend /wp-json/contact-form-7/v1/contact-forms/26727/feedback/schema, /wp-json/contact-form-7/v1/contact-forms/26727/refill, /trameas/g/collectE135E136E137
Wallet code none seen
Contract calls in its code none seen
Talks to AI services OpenAIE22E52
Live connections none seen

What it is

  • The Internet Archive first saved this site on 2017-08-27 (3349 days ago).E165
  • The site describes itself as: “Latest Research by our Team”E2
  • It's built with jQuery (common tools for building web apps).E127
  • In your browser it stores data in your browser's built-in database and saves small bits of data in your browser.E131E132
  • It has sections such as /contact, /disclosure-policy, /latest-publications, /cpr-podcast-channel, /ai-research and /intelligence-reports.E162
  • While loading, it called 3 endpoints on its own servers, such as /wp-json/contact-form-7/v1/contact-forms/26727/feedback/schema, /wp-json/contact-form-7/v1/contact-forms/26727/refill and /trameas/g/collect.E135E136E137

Where your data goes

Analytics & trackingCount visits and record what you do on the page. 7
www.googletagmanager.comGoogle Analytics / Tag Manager: Google's visitor analytics and tag loader 7×E7
analytics.google.comGoogle Analytics / Tag Manager: Google's visitor analytics and tag loader 3×E32
connect.facebook.netMeta Pixel: Facebook/Meta tracking pixel (ad measurement) 2×E18
k.clarity.msMicrosoft Clarity: session recording and heatmaps 5×E50
c.clarity.msMicrosoft Clarity: session recording and heatmaps 2×E49
www.clarity.msMicrosoft Clarity: session recording and heatmaps 2×E23
scripts.clarity.msMicrosoft Clarity: session recording and heatmaps 1×E38
AdvertisingShow ads and follow you across sites to target them. 18
googleads.g.doubleclick.netGoogle Ads / DoubleClick: Google's ad network (serving and measuring ads) 5×E30
pagead2.googlesyndication.comGoogle Ads / DoubleClick: Google's ad network (serving and measuring ads) 2×E9
ad.doubleclick.netGoogle Ads / DoubleClick: Google's ad network (serving and measuring ads) 1×E13
cm.g.doubleclick.netGoogle Ads / DoubleClick: Google's ad network (serving and measuring ads) 1×E44
stats.g.doubleclick.netGoogle Ads / DoubleClick: Google's ad network (serving and measuring ads) 1×E33
px.ads.linkedin.comLinkedIn Ads: LinkedIn ad tracking (Insight Tag) 4×E28
snap.licdn.comLinkedIn Ads: LinkedIn ad tracking (Insight Tag) 1×E16
www.facebook.comMeta / Facebook: Facebook ad tracking 1×E39
bat.bing.comMicrosoft Advertising: Bing ads conversion tracking 3×E19
c.bing.comMicrosoft Advertising: Bing ads conversion tracking 1×E51
alb.reddit.comReddit Pixel: Reddit ad tracking 2×E27
www.redditstatic.comReddit Pixel: Reddit ad tracking 1×E21
cdn.taboola.comTaboola: sponsored-content ads 4×E20
trc-events.taboola.comTaboola: sponsored-content ads 2×E57
trc.taboola.comTaboola: sponsored-content ads 2×E35
cds.taboola.comTaboola: sponsored-content ads 1×E48
pips.taboola.comTaboola: sponsored-content ads 1×E46
secure.adnxs.comXandr / AppNexus: programmatic ad exchange 1×E40
AI providersSend text or data to an AI model. 2
bzrcdn.openai.comOpenAI: AI models (ChatGPT's maker) 2×E22
bzr.openai.comOpenAI: AI models (ChatGPT's maker) 1×E52
Consent & bot protectionCookie banners, CAPTCHAs and bot checks. 2
cdn.cookielaw.orgOneTrust: cookie consent banner 12×E10
geolocation.onetrust.comOneTrust: cookie consent banner 1×E11
Social & embedsEmbedded videos, posts and share buttons. 1
www.youtube.comYouTube: embedded videos 2×E24
CDNs & hostingDeliver files (scripts, images) quickly from servers near you. 1
cdn.jsdelivr.netjsDelivr: open-source file CDN 1×E6
Not identifiedServices we don't have in our list yet. 19
www.google.comnot identified 16×E12
b.6sc.conot identified 13×E45
trackingapi.trendemon.comnot identified 9×E43
a56a6a6f5963.813093c6.us-west-1.token.awswaf.comnot identified 8×E54
script.crazyegg.comnot identified 4×E17
tags.srv.stackadapt.comnot identified 4×E36
c.6sc.conot identified 3×E41
pic.trendemon.comnot identified 3×E53
assets.trendemon.comnot identified 2×E34
j.6sc.conot identified 2×E14
munchkin.marketo.netnot identified 2×E15
750-dqh-528.mktoresp.comnot identified 1×E37
a56a6a6f5963.813093c6.us-west-1.captcha.awswaf.comnot identified 1×E55
contentdsp.comnot identified 1×E25
epsilon.6sense.comnot identified 1×E47
ipv6.6sc.conot identified 1×E42
pixel-config.reddit.comnot identified 1×E26
static.captcha.awswaf.comnot identified 1×E56
www.linkedin.comnot identified 1×E31

How key features work

AI features

Parts of the site talk to AI services or AI endpoints (bzrcdn.openai.com, bzr.openai.com, /api/ai/page-summary, /api/ai/guiding-questions and 1 more). Text you type there may be sent to them.E22E52E148E149

bzrcdn.openai.combzr.openai.com/api/ai/page-summary/api/ai/guiding-questions/api/ai/run-prompt/unit

Loading its content

Its content loads from its own API while you browse (/wp-json/contact-form-7/v1/contact-forms/26727/feedback/schema, /wp-json/contact-form-7/v1/contact-forms/26727/refill and /trameas/g/collect).E135E136E137

/wp-json/contact-form-7/v1/contact-forms/26727/feedback/schema/wp-json/contact-form-7/v1/contact-forms/26727/refill/trameas/g/collect

Drawing and editing in the browser

The page draws and edits graphics in your browser using the canvas.E134

canvas

Measuring what you do

Visits and clicks are measured with Google Analytics / Tag Manager, Meta Pixel and Microsoft Clarity (found in its traffic or its code).E7E32E18E50E49

Google Analytics / Tag ManagerMeta PixelMicrosoft Clarity

How ads get picked

Ads are chosen through ad networks and exchanges (Google Ads / DoubleClick and LinkedIn Ads); they receive details about your visit to bid on the ad space.E30E9E13E44

Google Ads / DoubleClickLinkedIn Ads

Saving data on your device

It saves data in your browser (IndexedDB (a browser database), localStorage and sessionStorage), so some things persist between visits.E131E132E125E126

indexeddblocal_storagelocalStoragesessionStorage

Video

Videos are embedded from YouTube.E24

YouTube

Cookies and storage

Names only. We never store the values.

CookieSet forKeptWhose
taboola_session_idE58taboola.com until you close the browserother company
__cf_bmE59research.checkpoint.com about 0 daysthe site
_gcl_auE60checkpoint.com about 90 daysthe site
referralURLE61checkpoint.com until you close the browserthe site
OptanonConsentE62checkpoint.com about 400 daysthe site
_rdt_uuidE63checkpoint.com about 90 daysthe site
__cf_bmE64bzrcdn.openai.com about 0 daysother company
_cfuvidE65bzrcdn.openai.com until you close the browserother company
_cfuvidE66research.checkpoint.com until you close the browserthe site
__Secure-YNIDE67youtube.com about 180 daysother company
YSCE68youtube.com until you close the browserother company
VISITOR_INFO1_LIVEE69youtube.com about 180 daysother company
VISITOR_PRIVACY_METADATAE70youtube.com about 180 daysother company
__Secure-ROLLOUT_TOKENE71youtube.com about 180 daysother company
__obrefE72checkpoint.com about 365 daysthe site
li_sugrE73linkedin.com about 90 daysother company
bcookieE74linkedin.com about 365 daysother company
lidcE75linkedin.com about 1 daysother company
__cf_bmE76linkedin.com about 0 daysother company
_gaE77checkpoint.com about 400 daysthe site
sa-user-idE78contentdsp.com about 365 daysother company
sa-user-id-v2E79contentdsp.com about 365 daysother company
sa-user-id-v4E80contentdsp.com about 365 daysother company
UserMatchHistoryE81linkedin.com about 30 daysother company
AnalyticsSyncHistoryE82linkedin.com about 30 daysother company
IDEE83doubleclick.net about 400 daysother company
bscookieE84www.linkedin.com about 365 daysother company
sa-user-idE85research.checkpoint.com about 365 daysthe site
sa-user-id-v2E86research.checkpoint.com about 365 daysthe site
sa-user-id-v3E87research.checkpoint.com about 365 daysthe site
sa-user-id-v4E88research.checkpoint.com about 365 daysthe site
_ce.sE89checkpoint.com about 365 daysthe site
_mkto_trkE90checkpoint.com about 400 daysthe site
_uetsidE91checkpoint.com about 1 daysthe site
_uetvidE92checkpoint.com about 390 daysthe site
t_gidE93taboola.com about 365 daysother company
t_pt_gidE94taboola.com about 365 daysother company
_fbpE95checkpoint.com about 90 daysthe site
MUIDE96bing.com about 390 daysother company
MRE97bat.bing.com about 7 daysother company

localStorageE125: sa-user-id, eng_mt, _uetvid_exp, ga_visitor_id, trd_acc_2336, trd_acc_2336_ts, _gcl_ls, _uetsid, sa-user-id-v3, sa-user-id-v2, 1790937:session-data, lastExternalReferrerTime, trd_frequencyControlHistory, _uetsid_exp, _6signalTTL, sa-user-id-v4, _uetvid, lastExternalReferrer, taboola global:user-id, trd_vid_l

sessionStorageE126: oaiq_cs:G51hiux4Mg3swRdFuW8p1Q, wpEmojiSettingsSupports, _rdt_cfg, _cltk

Pages and API calls

Pages it links to

//contact/disclosure-policy/latest-publications/cpr-podcast-channel/ai-research/intelligence-reports/about-us/subscription/category/2024/2026/2023/2019/2022/2017/2020/privacy-policy

Endpoints

Called while loading (seen) or named in the code (code).

research.checkpoint.com/wp-json/contact-form-7/v1/contact-forms/26727/feedback/schemaseenE135
research.checkpoint.com/wp-json/contact-form-7/v1/contact-forms/26727/refillseenE136
www.checkpoint.com/trameas/g/collectseenE137
/v3/company/detailscodeE138
/v1/company/detailscodeE139
/v1/sffcodeE140
/api/PreSavedParamscodeE141
/api/MarketingAutomation/set-emailcodeE142
/api/experience/new-leadcodeE143
/api/content/recommendcodeE144
/api/content/recommend-from-poolcodeE145
/api/experience/streamcodeE146
/api/Experience/surveycodeE147
/api/ai/page-summarycodeE148
/api/ai/guiding-questionscodeE149
/api/ai/run-prompt/unitcodeE150
/api/experience/personal-streamcodeE151
/api/experience/personal-embeddedcodeE152
/api/experience/personalcodeE153
/api/events/upliftcodeE154
/api/eventscodeE155
/api/marketingautomationcodeE156
/api/cta/personalcodeE157
/api/experience/otw-campaigncodeE158
/api/experience/ace-campaignscodeE159
/api/Identity/mecodeE160
/api/settingscodeE161

Evidence

Every sentence above points to one of these. Code references show the file, line:column and the short identifier that matched, never the site's code itself.

E1
Page title: Tricks from the Past deployed via signed ChatGPT and Claude binaries - Check Point Research
page title · https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/
E2
Page description: Latest Research by our Team
page description · https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/
E3
Site name: Check Point Research
page site_name · https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/
E4
Main heading: TRICKS FROM THE PAST DEPLOYED VIA SIGNED CHATGPT AND CLAUDE BINARIES
page h1 · https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/
E5
48 request(s) to research.checkpoint.com
types: 20 image, 12 stylesheet, 10 script
GET https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/ · image · 48 requests · network recording
E6
1 request(s) to cdn.jsdelivr.net
types: 1 script
GET https://cdn.jsdelivr.net/npm/sharer.js@latest/sharer.min.js · script · network recording
E7
7 request(s) to www.googletagmanager.com
types: 7 script
GET https://www.googletagmanager.com/gtm.js · script · 7 requests · network recording
E8
1 request(s) to sc1.checkpoint.com
types: 1 script
GET https://sc1.checkpoint.com/sc1/js/js.cookie.min.js · script · network recording
E9
2 request(s) to pagead2.googlesyndication.com
types: 2 fetch
GET https://pagead2.googlesyndication.com/ccm/collect · fetch · 2 requests · network recording
E10
12 request(s) to cdn.cookielaw.org
types: 5 fetch, 3 script, 3 image
GET https://cdn.cookielaw.org/consent/6be79097-5aaa-4b3b-8be4-f464d92cf186/OtAutoBlock.js · fetch · 12 requests · network recording
E11
1 request(s) to geolocation.onetrust.com
types: 1 xhr
GET https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location · xhr · network recording
E12
16 request(s) to www.google.com
types: 11 fetch, 5 image
GET https://www.google.com/ccm/collect · fetch · 16 requests · network recording
E13
1 request(s) to ad.doubleclick.net
types: 1 fetch
GET https://ad.doubleclick.net/ccm/s/collect · fetch · network recording
E14
2 request(s) to j.6sc.co
types: 2 script
GET https://j.6sc.co/j/e1efa08e-e135-4766-9e10-b54f0663900a.js · script · 2 requests · network recording
E15
2 request(s) to munchkin.marketo.net
types: 2 script
GET https://munchkin.marketo.net/munchkin.js · script · 2 requests · network recording
E16
1 request(s) to snap.licdn.com
types: 1 script
GET https://snap.licdn.com/li.lms-analytics/insight.min.js · script · network recording
E17
4 request(s) to script.crazyegg.com
types: 2 script, 2 xhr
GET https://script.crazyegg.com/pages/scripts/0041/7614.js · script · 4 requests · network recording
E18
2 request(s) to connect.facebook.net
types: 2 script
GET https://connect.facebook.net/en_US/fbevents.js · script · 2 requests · network recording
E19
3 request(s) to bat.bing.com
types: 2 script, 1 image
GET https://bat.bing.com/bat.js · script · 3 requests · network recording
E20
4 request(s) to cdn.taboola.com
types: 4 script
GET https://cdn.taboola.com/libtrc/unip/1790937/tfa.js · script · 4 requests · network recording
E21
1 request(s) to www.redditstatic.com
types: 1 script
GET https://www.redditstatic.com/ads/pixel.js · script · network recording
E22
2 request(s) to bzrcdn.openai.com
types: 1 script, 1 fetch
GET https://bzrcdn.openai.com/sdk/oaiq.min.js · script · 2 requests · network recording
E23
2 request(s) to www.clarity.ms
types: 2 script
GET https://www.clarity.ms/tag/yelnsbtjht · script · 2 requests · network recording
E24
2 request(s) to www.youtube.com
types: 2 script
GET https://www.youtube.com/iframe_api · script · 2 requests · network recording
E25
1 request(s) to contentdsp.com
types: 1 script
GET https://contentdsp.com/events.js · script · network recording
E26
1 request(s) to pixel-config.reddit.com
types: 1 xhr
GET https://pixel-config.reddit.com/pixels/t2_4tg2dank/config · xhr · network recording
E27
2 request(s) to alb.reddit.com
types: 2 fetch
GET https://alb.reddit.com/rp · fetch · 2 requests · network recording
E28
4 request(s) to px.ads.linkedin.com
types: 3 image, 1 fetch
GET https://px.ads.linkedin.com/wa/ · image · 4 requests · network recording
E29
5 request(s) to www.checkpoint.com
types: 3 fetch, 2 document
GET https://www.checkpoint.com/trameas/g/collect · fetch · 5 requests · network recording
E30
5 request(s) to googleads.g.doubleclick.net
types: 5 script
GET https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071902137/ · script · 5 requests · network recording
E31
1 request(s) to www.linkedin.com
types: 1 image
GET https://www.linkedin.com/px/li_sync · image · network recording
E32
3 request(s) to analytics.google.com
types: 3 fetch
GET https://analytics.google.com/g/collect · fetch · 3 requests · network recording
E33
1 request(s) to stats.g.doubleclick.net
types: 1 ping
GET https://stats.g.doubleclick.net/g/collect · ping · network recording
E34
2 request(s) to assets.trendemon.com
types: 2 script
GET https://assets.trendemon.com/tag/trends.min.js · script · 2 requests · network recording
E35
2 request(s) to trc.taboola.com
types: 1 script, 1 image
GET https://trc.taboola.com/1790937/trc/3/json · script · 2 requests · network recording
E36
4 request(s) to tags.srv.stackadapt.com
types: 2 xhr, 1 stylesheet, 1 fetch
GET https://tags.srv.stackadapt.com/sa.css · xhr · 4 requests · network recording
E37
1 request(s) to 750-dqh-528.mktoresp.com
types: 1 ping
GET https://750-dqh-528.mktoresp.com/webevents/visitWebPage · ping · network recording
E38
1 request(s) to scripts.clarity.ms
types: 1 script
GET https://scripts.clarity.ms/0.8.73-beta/clarity.js · script · network recording
E39
1 request(s) to www.facebook.com
types: 1 ping
GET https://www.facebook.com/tr/ · ping · network recording
E40
1 request(s) to secure.adnxs.com
types: 1 xhr
GET https://secure.adnxs.com/getuidj · xhr · network recording
E41
3 request(s) to c.6sc.co
types: 3 xhr
GET https://c.6sc.co/ · xhr · 3 requests · network recording
E42
1 request(s) to ipv6.6sc.co
types: 1 xhr
GET https://ipv6.6sc.co/ · xhr · network recording
E43
9 request(s) to trackingapi.trendemon.com
types: 7 script, 2 image
GET https://trackingapi.trendemon.com/api/settings/2336 · script · 9 requests · network recording
E44
1 request(s) to cm.g.doubleclick.net
types: 1 image
GET https://cm.g.doubleclick.net/pixel · image · network recording
E45
13 request(s) to b.6sc.co
types: 13 image
GET https://b.6sc.co/v1/beacon/img.gif · image · 13 requests · network recording
E46
1 request(s) to pips.taboola.com
types: 1 xhr
GET https://pips.taboola.com/ · xhr · network recording
E47
1 request(s) to epsilon.6sense.com
types: 1 xhr
GET https://epsilon.6sense.com/v3/company/details · xhr · network recording
E48
1 request(s) to cds.taboola.com
types: 1 xhr
GET https://cds.taboola.com/ · xhr · network recording
E49
2 request(s) to c.clarity.ms
types: 2 image
GET https://c.clarity.ms/c.gif · image · 2 requests · network recording
E50
5 request(s) to k.clarity.ms
types: 5 xhr
GET https://k.clarity.ms/collect · xhr · 5 requests · network recording
E51
1 request(s) to c.bing.com
types: 1 image
GET https://c.bing.com/c.gif · image · network recording
E52
1 request(s) to bzr.openai.com
types: 1 fetch
GET https://bzr.openai.com/v1/sdk/events · fetch · network recording
E53
3 request(s) to pic.trendemon.com
types: 3 image
GET https://pic.trendemon.com/images/closex.png · image · 3 requests · network recording
E54
8 request(s) to a56a6a6f5963.813093c6.us-west-1.token.awswaf.com
types: 6 fetch, 2 script
GET https://a56a6a6f5963.813093c6.us-west-1.token.awswaf.com/a56a6a6f5963/c3e8f71e82c9/d467c77d1021/challenge.js · fetch · 8 requests · network recording
E55
1 request(s) to a56a6a6f5963.813093c6.us-west-1.captcha.awswaf.com
types: 1 script
GET https://a56a6a6f5963.813093c6.us-west-1.captcha.awswaf.com/a56a6a6f5963/c3e8f71e82c9/d467c77d1021/captcha.js · script · network recording
E56
1 request(s) to static.captcha.awswaf.com
types: 1 stylesheet
GET https://static.captcha.awswaf.com/fonts/AmazonEmberLt/stylesheet.css · stylesheet · network recording
E57
2 request(s) to trc-events.taboola.com
types: 2 xhr
GET https://trc-events.taboola.com/1790937/log/3/unip · xhr · 2 requests · network recording
E58
Cookie 'taboola_session_id' set for taboola.com
session cookie
cookie taboola_session_id on taboola.com · value not stored
E59
Cookie '__cf_bm' set for research.checkpoint.com
kept for about 0 days
cookie __cf_bm on research.checkpoint.com · value not stored
E60
Cookie '_gcl_au' set for checkpoint.com
kept for about 90 days
cookie _gcl_au on checkpoint.com · value not stored
E61
Cookie 'referralURL' set for checkpoint.com
session cookie
cookie referralURL on checkpoint.com · value not stored
E62
Cookie 'OptanonConsent' set for checkpoint.com
kept for about 400 days
cookie OptanonConsent on checkpoint.com · value not stored
E63
Cookie '_rdt_uuid' set for checkpoint.com
kept for about 90 days
cookie _rdt_uuid on checkpoint.com · value not stored
E64
Cookie '__cf_bm' set for bzrcdn.openai.com
kept for about 0 days
cookie __cf_bm on bzrcdn.openai.com · value not stored
E65
Cookie '_cfuvid' set for bzrcdn.openai.com
session cookie
cookie _cfuvid on bzrcdn.openai.com · value not stored
E66
Cookie '_cfuvid' set for research.checkpoint.com
session cookie
cookie _cfuvid on research.checkpoint.com · value not stored
E67
Cookie '__Secure-YNID' set for youtube.com
kept for about 180 days
cookie __Secure-YNID on youtube.com · value not stored
E68
Cookie 'YSC' set for youtube.com
session cookie
cookie YSC on youtube.com · value not stored
E69
Cookie 'VISITOR_INFO1_LIVE' set for youtube.com
kept for about 180 days
cookie VISITOR_INFO1_LIVE on youtube.com · value not stored
E70
Cookie 'VISITOR_PRIVACY_METADATA' set for youtube.com
kept for about 180 days
cookie VISITOR_PRIVACY_METADATA on youtube.com · value not stored
E71
Cookie '__Secure-ROLLOUT_TOKEN' set for youtube.com
kept for about 180 days
cookie __Secure-ROLLOUT_TOKEN on youtube.com · value not stored
E72
Cookie '__obref' set for checkpoint.com
kept for about 365 days
cookie __obref on checkpoint.com · value not stored
E73
Cookie 'li_sugr' set for linkedin.com
kept for about 90 days
cookie li_sugr on linkedin.com · value not stored
E74
Cookie 'bcookie' set for linkedin.com
kept for about 365 days
cookie bcookie on linkedin.com · value not stored
E75
Cookie 'lidc' set for linkedin.com
kept for about 1 days
cookie lidc on linkedin.com · value not stored
E76
Cookie '__cf_bm' set for linkedin.com
kept for about 0 days
cookie __cf_bm on linkedin.com · value not stored
E77
Cookie '_ga' set for checkpoint.com
kept for about 400 days
cookie _ga on checkpoint.com · value not stored
E78
Cookie 'sa-user-id' set for contentdsp.com
kept for about 365 days
cookie sa-user-id on contentdsp.com · value not stored
E79
Cookie 'sa-user-id-v2' set for contentdsp.com
kept for about 365 days
cookie sa-user-id-v2 on contentdsp.com · value not stored
E80
Cookie 'sa-user-id-v4' set for contentdsp.com
kept for about 365 days
cookie sa-user-id-v4 on contentdsp.com · value not stored
E81
Cookie 'UserMatchHistory' set for linkedin.com
kept for about 30 days
cookie UserMatchHistory on linkedin.com · value not stored
E82
Cookie 'AnalyticsSyncHistory' set for linkedin.com
kept for about 30 days
cookie AnalyticsSyncHistory on linkedin.com · value not stored
E83
Cookie 'IDE' set for doubleclick.net
kept for about 400 days
cookie IDE on doubleclick.net · value not stored
E84
Cookie 'bscookie' set for www.linkedin.com
kept for about 365 days
cookie bscookie on www.linkedin.com · value not stored
E85
Cookie 'sa-user-id' set for research.checkpoint.com
kept for about 365 days
cookie sa-user-id on research.checkpoint.com · value not stored
E86
Cookie 'sa-user-id-v2' set for research.checkpoint.com
kept for about 365 days
cookie sa-user-id-v2 on research.checkpoint.com · value not stored
E87
Cookie 'sa-user-id-v3' set for research.checkpoint.com
kept for about 365 days
cookie sa-user-id-v3 on research.checkpoint.com · value not stored
E88
Cookie 'sa-user-id-v4' set for research.checkpoint.com
kept for about 365 days
cookie sa-user-id-v4 on research.checkpoint.com · value not stored
E89
Cookie '_ce.s' set for checkpoint.com
kept for about 365 days
cookie _ce.s on checkpoint.com · value not stored
E90
Cookie '_mkto_trk' set for checkpoint.com
kept for about 400 days
cookie _mkto_trk on checkpoint.com · value not stored
E91
Cookie '_uetsid' set for checkpoint.com
kept for about 1 days
cookie _uetsid on checkpoint.com · value not stored
E92
Cookie '_uetvid' set for checkpoint.com
kept for about 390 days
cookie _uetvid on checkpoint.com · value not stored
E93
Cookie 't_gid' set for taboola.com
kept for about 365 days
cookie t_gid on taboola.com · value not stored
E94
Cookie 't_pt_gid' set for taboola.com
kept for about 365 days
cookie t_pt_gid on taboola.com · value not stored
E95
Cookie '_fbp' set for checkpoint.com
kept for about 90 days
cookie _fbp on checkpoint.com · value not stored
E96
Cookie 'MUID' set for bing.com
kept for about 390 days
cookie MUID on bing.com · value not stored
E97
Cookie 'MR' set for bat.bing.com
kept for about 7 days
cookie MR on bat.bing.com · value not stored
E98
Cookie '_an_uid' set for research.checkpoint.com
kept for about 7 days
cookie _an_uid on research.checkpoint.com · value not stored
E99
Cookie '_gd_visitor' set for research.checkpoint.com
kept for about 400 days
cookie _gd_visitor on research.checkpoint.com · value not stored
E100
Cookie '_gd_session' set for research.checkpoint.com
kept for about 0 days
cookie _gd_session on research.checkpoint.com · value not stored
E101
Cookie '6suuid' set for 6sc.co
kept for about 400 days
cookie 6suuid on 6sc.co · value not stored
E102
Cookie '_gd_svisitor' set for research.checkpoint.com
kept for about 400 days
cookie _gd_svisitor on research.checkpoint.com · value not stored
E103
Cookie '_clck' set for checkpoint.com
kept for about 365 days
cookie _clck on checkpoint.com · value not stored
E104
Cookie 'CLID' set for www.clarity.ms
kept for about 365 days
cookie CLID on www.clarity.ms · value not stored
E105
Cookie 'trd_cid' set for checkpoint.com
kept for about 365 days
cookie trd_cid on checkpoint.com · value not stored
E106
Cookie 'MR' set for c.bing.com
kept for about 7 days
cookie MR on c.bing.com · value not stored
E107
Cookie 'SRM_B' set for c.bing.com
kept for about 390 days
cookie SRM_B on c.bing.com · value not stored
E108
Cookie 'SM' set for c.clarity.ms
session cookie
cookie SM on c.clarity.ms · value not stored
E109
Cookie 'MUID' set for clarity.ms
kept for about 390 days
cookie MUID on clarity.ms · value not stored
E110
Cookie 'MR' set for c.clarity.ms
kept for about 7 days
cookie MR on c.clarity.ms · value not stored
E111
Cookie 'ANONCHK' set for c.clarity.ms
kept for about 0 days
cookie ANONCHK on c.clarity.ms · value not stored
E112
Cookie 'trd_gavid_2336' set for trackingapi.trendemon.com
kept for about 365 days
cookie trd_gavid_2336 on trackingapi.trendemon.com · value not stored
E113
Cookie 'trd_gvid' set for trackingapi.trendemon.com
kept for about 365 days
cookie trd_gvid on trackingapi.trendemon.com · value not stored
E114
Cookie 'trd_vid_2336' set for trackingapi.trendemon.com
kept for about 365 days
cookie trd_vid_2336 on trackingapi.trendemon.com · value not stored
E115
Cookie 'trd_vid_l' set for checkpoint.com
kept for about 365 days
cookie trd_vid_l on checkpoint.com · value not stored
E116
Cookie 'trd_vuid_l' set for checkpoint.com
kept for about 365 days
cookie trd_vuid_l on checkpoint.com · value not stored
E117
Cookie 'trd_ma_cookie' set for checkpoint.com
kept for about 0 days
cookie trd_ma_cookie on checkpoint.com · value not stored
E118
Cookie '_clsk' set for checkpoint.com
kept for about 1 days
cookie _clsk on checkpoint.com · value not stored
E119
Cookie '__cf_bm' set for bzr.openai.com
kept for about 0 days
cookie __cf_bm on bzr.openai.com · value not stored
E120
Cookie '_cfuvid' set for bzr.openai.com
session cookie
cookie _cfuvid on bzr.openai.com · value not stored
E121
Cookie 'aws-waf-token' set for checkpoint.com
kept for about 4 days
cookie aws-waf-token on checkpoint.com · value not stored
E122
Cookie '_ga_KL320P6ET3' set for checkpoint.com
kept for about 400 days
cookie _ga_KL320P6ET3 on checkpoint.com · value not stored
E123
Cookie '_ga_48VXKGDGCV' set for checkpoint.com
kept for about 400 days
cookie _ga_48VXKGDGCV on checkpoint.com · value not stored
E124
Cookie '_rdt_em' set for checkpoint.com
kept for about 90 days
cookie _rdt_em on checkpoint.com · value not stored
E125
localStorage: 23 key(s) saved in your browser
localStorage keys: sa-user-id, eng_mt, _uetvid_exp, ga_visitor_id, trd_acc_2336, trd_acc_2336_ts, _gcl_ls, _uetsid, sa-user-id-v3, sa-user-id-v2, 1790937:session-data, lastExternalReferrerTime · values not stored
E126
sessionStorage: 4 key(s) saved in your browser
sessionStorage keys: oaiq_cs:G51hiux4Mg3swRdFuW8p1Q, wpEmojiSettingsSupports, _rdt_cfg, _cltk · values not stored
E127
jQuery found in the code
research.checkpoint.com/wp-includes/js/jquery/jquery-migrate.min.js @ 2:3045 · “jQuery.fn.” · pattern scan
E128
Google tag (gtag.js) found in the code
research.checkpoint.com/ (page HTML) @ 44:3987 · “googletagmanager.com/gtag” · pattern scan
E129
Meta Pixel found in the code
research.checkpoint.com/ (page HTML) @ 44:3597 · “connect.facebook.net/en_US/fbevents” · pattern scan
E130
Microsoft Clarity found in the code
research.checkpoint.com/ (page HTML) @ 44:547 · “clarity.ms” · pattern scan
E131
Uses the browser ability: indexeddb
stores data in your browser's built-in database
script.crazyegg.com…ned/commontransformations-scripts/28d0b4594b966007b972dd49d8df80e9.js @ 2:189615 · “indexedDB.open(” · pattern scan
E132
Uses the browser ability: local_storage
saves small bits of data in your browser
research.checkpoint.com/ (page HTML) @ 1916:104 · “localStorage.setItem(” · pattern scan
E133
Uses the browser ability: web_worker
runs work in a background thread
research.checkpoint.com/ (page HTML) @ 1950:2377 · “new Worker(” · pattern scan
E134
Uses the browser ability: canvas
draws graphics on a canvas
research.checkpoint.com/ (page HTML) @ 1950:1525 · “getContext("2d"” · pattern scan
E135
The page called /wp-json/contact-form-7/v1/contact-forms/26727/feedback/schema on research.checkpoint.com (GET)
GET https://research.checkpoint.com/wp-json/contact-form-7/v1/contact-forms/26727/feedback/schema · fetch · network recording
E136
The page called /wp-json/contact-form-7/v1/contact-forms/26727/refill on research.checkpoint.com (GET)
GET https://research.checkpoint.com/wp-json/contact-form-7/v1/contact-forms/26727/refill · fetch · network recording
E137
The page called /trameas/g/collect on www.checkpoint.com (GET)
GET https://www.checkpoint.com/trameas/g/collect · fetch · network recording
E138
The code names the endpoint /v3/company/details
j.6sc.co/6si.min.js @ 1:17267 · “/v3/company/details” · pattern scan
E139
The code names the endpoint /v1/company/details
j.6sc.co/6si.min.js @ 1:17304 · “/v1/company/details” · pattern scan
E140
The code names the endpoint /v1/sff
j.6sc.co/6si.min.js @ 2:11217 · “/v1/sff” · pattern scan
E141
The code names the endpoint /api/PreSavedParams
assets.trendemon.com/tag/trends.min.js @ 1:10628 · “/api/PreSavedParams” · pattern scan
E142
The code names the endpoint /api/MarketingAutomation/set-email
assets.trendemon.com/tag/trends.min.js @ 1:38203 · “/api/MarketingAutomation/set-email” · pattern scan
E143
The code names the endpoint /api/experience/new-lead
assets.trendemon.com/tag/trends.min.js @ 1:42167 · “/api/experience/new-lead” · pattern scan
E144
The code names the endpoint /api/content/recommend
assets.trendemon.com/tag/trends.min.js @ 1:59167 · “/api/content/recommend” · pattern scan
E145
The code names the endpoint /api/content/recommend-from-pool
assets.trendemon.com/tag/trends.min.js @ 1:175620 · “/api/content/recommend-from-pool” · pattern scan
E146
The code names the endpoint /api/experience/stream
assets.trendemon.com/tag/trends.min.js @ 1:243191 · “/api/experience/stream” · pattern scan
E147
The code names the endpoint /api/Experience/survey
assets.trendemon.com/tag/trends.min.js @ 1:295537 · “/api/Experience/survey” · pattern scan
E148
The code names the endpoint /api/ai/page-summary
assets.trendemon.com/tag/trends.min.js @ 1:326005 · “/api/ai/page-summary” · pattern scan
E149
The code names the endpoint /api/ai/guiding-questions
assets.trendemon.com/tag/trends.min.js @ 1:330825 · “/api/ai/guiding-questions” · pattern scan
E150
The code names the endpoint /api/ai/run-prompt/unit
assets.trendemon.com/tag/trends.min.js @ 1:332221 · “/api/ai/run-prompt/unit” · pattern scan
E151
The code names the endpoint /api/experience/personal-stream
assets.trendemon.com/tag/trends.min.js @ 1:409798 · “/api/experience/personal-stream” · pattern scan
E152
The code names the endpoint /api/experience/personal-embedded
assets.trendemon.com/tag/trends.min.js @ 1:410572 · “/api/experience/personal-embedded” · pattern scan
E153
The code names the endpoint /api/experience/personal
assets.trendemon.com/tag/trends.min.js @ 1:412560 · “/api/experience/personal” · pattern scan
E154
The code names the endpoint /api/events/uplift
assets.trendemon.com/tag/trends.min.js @ 1:414166 · “/api/events/uplift” · pattern scan
E155
The code names the endpoint /api/events
assets.trendemon.com/tag/trends.min.js @ 1:425314 · “/api/events” · pattern scan
E156
The code names the endpoint /api/marketingautomation
assets.trendemon.com/tag/trends.min.js @ 1:425368 · “/api/marketingautomation” · pattern scan
E157
The code names the endpoint /api/cta/personal
assets.trendemon.com/tag/trends.min.js @ 1:425672 · “/api/cta/personal” · pattern scan
E158
The code names the endpoint /api/experience/otw-campaign
assets.trendemon.com/tag/trends.min.js @ 1:428894 · “/api/experience/otw-campaign” · pattern scan
E159
The code names the endpoint /api/experience/ace-campaigns
assets.trendemon.com/tag/trends.min.js @ 1:429882 · “/api/experience/ace-campaigns” · pattern scan
E160
The code names the endpoint /api/Identity/me
assets.trendemon.com/tag/trends.min.js @ 1:447450 · “/api/Identity/me” · pattern scan
E161
The code names the endpoint /api/settings
assets.trendemon.com/tag/trends.min.js @ 1:448627 · “/api/settings” · pattern scan
E162
38 links to pages on the same site
page links · https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/ · /, /contact, /disclosure-policy, /latest-publications, /cpr-podcast-channel, /ai-research, /intelligence-reports, /about-us, /subscription, /category, /2024, /2026
E163
The site says: “…UNDER ATTACK? Latest Publications CPR Podcast Channel AI Research Intelligence Reports Resources About Us SUBSC…”
page text · https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/ · …UNDER ATTACK? Latest Publications CPR Podcast Channel AI Research Intelligence Reports Resources About Us SUBSC…
E164
The site says: “…n Uzbek Tatar The malware continues to resolve Windows API functions dynamically from kernel32.dll and ntdll.dll…”
page text · https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/ · …n Uzbek Tatar The malware continues to resolve Windows API functions dynamically from kernel32.dll and ntdll.dll…
E165
The Internet Archive first saved research.checkpoint.com on 2017-08-27 and has snapshots from 914 different days
page web archive · https://web.archive.org/web/20170827053959/research.checkpoint.com

Limits

  • We only see what your browser sees: code and requests on a first visit, without logging in or accepting cookie banners. What the servers do with data is invisible from outside.
  • Site code is usually minified (compressed), so names are partly lost and some code may be only partly analysed.
  • Some trackers only load after you accept cookies or log in, so the real list can be longer.
  • We visited from a server in the United States. Sites load different trackers and cookie banners in different countries (visitors in the EU usually get a consent banner first).
  • The tech check compares the site's own words with what its public page loads. Work done on servers, in private code or in separate apps isn't visible here, so 'nothing found' means not visible on the public page, not that it doesn't exist.
  • This text was written from fixed templates because no AI writer was available. It uses exactly the same evidence.
  • The code reader hit its size budget on parts of 17 large bundle file(s); those parts weren't fully analysed.

Facts, not judgements: this page describes what the code and traffic show, not anyone's intent. Not financial advice. Case id ihk6jYvm.