www.intego.com Open in urlscan Pro
2606:4700::6812:c77 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.co/usI1BDDzZc
Effective URL:
https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Submission: On September 25 via api (September 25th 2020, 3:19:07 pm UTC) from US

Summary HTTP 141 Redirects Links 38 Behaviour Indicators

Summary

This website contacted 48 IPs in 9 countries across 35 domains to perform 141 HTTP transactions. The main IP is 2606:4700::6812:c77, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.intego.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 28th 2020. Valid for: a year.

This is the only time www.intego.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
50	2606:4700::68... 2606:4700::6812:c77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:2b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:818::200a	15169 (GOOGLE) (GOOGLE)
6	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
1	2a02:26f0:6c0... 2a02:26f0:6c00::210:ba20	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
3	192.0.77.2 192.0.77.2	2635 (AUTOMATTIC) (AUTOMATTIC)
4	2a00:1450:400... 2a00:1450:4001:821::200e	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:802::200e	15169 (GOOGLE) (GOOGLE)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
5	23.210.248.44 23.210.248.44	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:809::2008	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:3b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	96.126.99.139 96.126.99.139	63949 (LINODE-AP...) (LINODE-AP Linode)
2	2a00:1450:400... 2a00:1450:4001:81b::2003	15169 (GOOGLE) (GOOGLE)
2 3	2a03:2880:f02... 2a03:2880:f02d:e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	151.101.36.84 151.101.36.84	54113 (FASTLY) (FASTLY)
2	151.101.112.134 151.101.112.134	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:81e::200e	15169 (GOOGLE) (GOOGLE)
1	23.210.250.213 23.210.250.213	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:80b::200e	15169 (GOOGLE) (GOOGLE)
3	192.0.77.48 192.0.77.48	2635 (AUTOMATTIC) (AUTOMATTIC)
1	216.58.206.2 216.58.206.2	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:820::200e	15169 (GOOGLE) (GOOGLE)
2	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2620:116:800d... 2620:116:800d:21:36a9:ecb:e518:b308	16509 (AMAZON-02) (AMAZON-02)
1	182.22.24.252 182.22.24.252	23816 (YAHOO Yah...) (YAHOO Yahoo Japan Corporation)
3	2606:4700::68... 2606:4700::6812:a813	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	151.101.192.134 151.101.192.134	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:821::200d	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
1	2600:9000:206... 2600:9000:206e:f800:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:819::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0c::9b	15169 (GOOGLE) (GOOGLE)
2	182.22.30.220 182.22.30.220	23816 (YAHOO Yah...) (YAHOO Yahoo Japan Corporation)
2	2a00:1288:f03... 2a00:1288:f03d:1fa::2000	10310 (YAHOO-1) (YAHOO-1)
4	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:824::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:818::2003	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
1	212.82.100.181 212.82.100.181	34010 (YAHOO-IRD) (YAHOO-IRD)
1	104.244.42.200 104.244.42.200	13414 (TWITTER) (TWITTER)
141	48

1 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

50 2606:4700::6812:c77 (United States)

ASN13335 (CLOUDFLARENET, US)

www.intego.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:2b (Netherlands)

ASN20446 (HIGHWINDS3, US)

netdna.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:818::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00::210:ba20 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

platform.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i2.wp.com

i2.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i1.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:821::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.youtube-nocookie.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:802::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.210.248.44 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-44.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:3b (Netherlands)

ASN20446 (HIGHWINDS3, US)

netdna.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 96.126.99.139 (Fremont, United States)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: nb-96-126-99-139.fremont.nodebalancer.linode.com

fireside.fm	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f02d:e:face:b00c:0:2 (Ireland) 2 redirects

ASN32934 (FACEBOOK, US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
web.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.36.84 (Amsterdam, Netherlands)

ASN54113 (FASTLY, US)

widgets.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.112.134 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

macsecurityblog.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81e::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.210.250.213 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-250-213.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.0.77.48 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: s.w.org

s.w.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.206.2 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra16s20-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:820::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:36a9:ecb:e518:b308 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 182.22.24.252 (Tokyo, Japan)

ASN23816 (YAHOO Yahoo Japan Corporation, JP)

s.yimg.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6812:a813 (United States)

ASN13335 (CLOUDFLARENET, US)

c.disquscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.192.134 (United States)

ASN54113 (FASTLY, US)

disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206e:f800:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 182.22.30.220 (Tokyo, Japan)

ASN23816 (YAHOO Yahoo Japan Corporation, JP)

b91.yahoo.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1288:f03d:1fa::2000 (United Kingdom)

ASN10310 (YAHOO-1, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f12d:83:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:818::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.82.100.181 (Switzerland)

ASN34010 (YAHOO-IRD, GB)

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.200 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
50	intego.com www.intego.com	645 KB
7	facebook.com 2 redirects graph.facebook.com www.facebook.com web.facebook.com	2 KB
7	gstatic.com fonts.gstatic.com ssl.gstatic.com	27 KB
7	google.com apis.google.com accounts.google.com www.google.com	110 KB
7	twitter.com platform.twitter.com syndication.twitter.com	34 KB
5	wp.com i2.wp.com i0.wp.com i1.wp.com stats.wp.com pixel.wp.com	6 KB
4	disqus.com macsecurityblog.disqus.com disqus.com	32 KB
4	facebook.net connect.facebook.net	231 KB
4	addthis.com s7.addthis.com m.addthis.com	190 KB
4	youtube.com www.youtube.com	2 KB
4	linkedin.com platform.linkedin.com www.linkedin.com	57 KB
3	disquscdn.com c.disquscdn.com	223 KB
3	google-analytics.com www.google-analytics.com	20 KB
3	w.org s.w.org	1 KB
2	yimg.com s.yimg.com	7 KB
2	yahoo.co.jp b91.yahoo.co.jp	2 KB
2	google.de www.google.de	598 B
2	doubleclick.net googleads.g.doubleclick.net stats.g.doubleclick.net	1 KB
2	quantserve.com secure.quantserve.com pixel.quantserve.com	8 KB
2	bing.com bat.bing.com	8 KB
2	gravatar.com secure.gravatar.com	10 KB
2	bootstrapcdn.com netdna.bootstrapcdn.com	39 KB
1	yahoo.com sp.analytics.yahoo.com	857 B
1	quantcount.com rules.quantcount.com	1 KB
1	yimg.jp s.yimg.jp	3 KB
1	googleadservices.com www.googleadservices.com	11 KB
1	addthisedge.com v1.addthisedge.com	520 B
1	moatads.com z.moatads.com	1 KB
1	ytimg.com s.ytimg.com	34 KB
1	pinterest.com widgets.pinterest.com	376 B
1	youtube-nocookie.com www.youtube-nocookie.com
1	fireside.fm fireside.fm
1	googletagmanager.com www.googletagmanager.com	42 KB
1	googleapis.com fonts.googleapis.com	1 KB
1	t.co t.co	416 B
141	35

	Domain	Requested by
50	www.intego.com	t.co www.intego.com
6	platform.twitter.com	www.intego.com platform.twitter.com
5	ssl.gstatic.com	www.intego.com
4	www.facebook.com	www.intego.com connect.facebook.net
4	connect.facebook.net	www.intego.com connect.facebook.net t.co
4	apis.google.com	www.intego.com apis.google.com
4	www.youtube.com	www.intego.com apis.google.com
3	c.disquscdn.com	macsecurityblog.disqus.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com www.intego.com
3	s.w.org	www.intego.com
3	www.linkedin.com	www.intego.com platform.linkedin.com
3	s7.addthis.com	www.intego.com s7.addthis.com
2	web.facebook.com	2 redirects
2	s.yimg.com	t.co s.yimg.com
2	b91.yahoo.co.jp	www.intego.com
2	www.google.de	www.intego.com
2	www.google.com	www.intego.com
2	disqus.com	macsecurityblog.disqus.com
2	bat.bing.com	t.co www.intego.com
2	macsecurityblog.disqus.com	www.intego.com
2	fonts.gstatic.com	fonts.googleapis.com
2	secure.gravatar.com	www.intego.com
2	netdna.bootstrapcdn.com	www.intego.com netdna.bootstrapcdn.com
1	syndication.twitter.com	www.intego.com
1	sp.analytics.yahoo.com	s.yimg.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	pixel.quantserve.com	www.intego.com
1	rules.quantcount.com	secure.quantserve.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	accounts.google.com	apis.google.com
1	s.yimg.jp	www.googletagmanager.com
1	secure.quantserve.com	t.co
1	www.googleadservices.com	www.googletagmanager.com
1	m.addthis.com	s7.addthis.com
1	v1.addthisedge.com	s7.addthis.com
1	pixel.wp.com	www.intego.com
1	z.moatads.com	s7.addthis.com
1	s.ytimg.com	www.youtube.com
1	widgets.pinterest.com	www.intego.com
1	graph.facebook.com	www.intego.com
1	www.youtube-nocookie.com	www.intego.com
1	fireside.fm	www.intego.com
1	www.googletagmanager.com	www.intego.com
1	stats.wp.com	www.intego.com
1	i1.wp.com	www.intego.com
1	i0.wp.com	www.intego.com
1	i2.wp.com	www.intego.com
1	platform.linkedin.com	www.intego.com
1	fonts.googleapis.com	www.intego.com
1	t.co
141	50

This site contains links to these domains. Also see Links.

Domain
support.intego.com
www.facebook.com
twitter.com
www.linkedin.com
plus.google.com
pinterest.com
foto.wuestenigel.com
creativecommons.org
www.blockchain.com
en.wikipedia.org
www.sentinelone.com
eclecticlight.co
developer.apple.com
whois-history.whoisxmlapi.com
www.macrumors.com
blog.trendmicro.com
documents.trendmicro.com
podcasts.apple.com
podcast.intego.com
www.instagram.com
www.youtube.com
security.thejoshmeister.com
itunes.apple.com
facebook.com
youtube.com

Subject Issuer	Validity	Valid
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-28` - `2021-08-28`	a year	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2020-09-22` - `2021-10-12`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
platform.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-13` - `2021-08-18`	a year	crt.sh
platform.linkedin.com DigiCert SHA2 Secure Server CA	`2020-07-03` - `2022-07-08`	2 years	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
*.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.apis.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
odc-prod-01.oracle.com DigiCert Secure Site ECC CA-1	`2020-07-22` - `2021-10-13`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh
*.fireside.fm Sectigo RSA Domain Validation Secure Server CA	`2020-04-13` - `2022-07-16`	2 years	crt.sh
*.gstatic.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2020-05-01` - `2020-11-01`	6 months	crt.sh
*.pinterest.com DigiCert SHA2 High Assurance Server CA	`2020-07-16` - `2021-08-04`	a year	crt.sh
*.disqus.com DigiCert SHA2 Secure Server CA	`2020-04-20` - `2022-05-09`	2 years	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
*.w.org Sectigo RSA Domain Validation Secure Server CA	`2019-12-19` - `2021-12-18`	2 years	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
www.bing.com Microsoft IT TLS CA 2	`2019-04-30` - `2021-04-30`	2 years	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2019-10-04` - `2020-10-07`	a year	crt.sh
edge01.yahoo.co.jp Cybertrust Japan SureServer CA G4	`2020-07-28` - `2021-08-27`	a year	crt.sh
accounts.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
www.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
mscedge01.yahoo.co.jp Cybertrust Japan SureServer CA G4	`2020-08-04` - `2021-09-03`	a year	crt.sh
*.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-09-10` - `2020-10-28`	2 months	crt.sh
*.google.de GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-08-01` - `2021-01-28`	6 months	crt.sh
syndication.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh

This page contains 16 frames:

Primary Page: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Frame ID: 6EE7A435ED3FC6B9354D435E96CBEE6D
Requests: 131 HTTP requests in this frame

Frame: https://fireside.fm/player/v2/GegHgcrH+8gxBbG1E?theme=dark
Frame ID: CB6E2F6E79CFBF7DBDA5755BC9EBB6BF
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube-nocookie.com/embed/nCVaZVfnkTY?&list=PLL1eIqHwwN-MY4WwZvjNYcqo02CbtoB7J&autohide=2&color=red&controls=1&disablekb=0&fs=1&iv_load_policy=1&modestbranding=0&rel=0&showinfo=0&theme=dark&vq=default&enablejsapi=1
Frame ID: E2DEF5807CF949C9EAAE25BBF2ADFAA3
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/subscribe_embed?usegapi=1&channel=IntegoVideo&layout=default&count=default&theme=default&origin=https%3A%2F%2Fwww.intego.com&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.hc3rLxj9u8o.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCMtAagp6kGxB19Nep_bTJunj37kww%2Fm%3D__features__
Frame ID: D3F9AAE080E1BC223445C05FEC87B4F1
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2d7d9a6d04538bf11c7b23641e75738c.html?origin=https%3A%2F%2Fwww.intego.com
Frame ID: 01A1B5EBDDC517D7021F2FD7CAA41500
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 3268271FC3FCDC93EAE44D2BBFDDF681
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 781AE09D065BED696E54FBE78539844F
Requests: 1 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.intego.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.hc3rLxj9u8o.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCMtAagp6kGxB19Nep_bTJunj37kww%2Fm%3D__features__
Frame ID: 1498F6B88AEF8DEF044499170B832101
Requests: 1 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=macsecurityblog&t_i=92058%20https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2F%3Fp%3D92058&t_u=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&t_e=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat&t_d=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog&t_t=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat&s_o=default
Frame ID: A470AAAF8C3B70E58C9A5BD935E34406
Requests: 1 HTTP requests in this frame

Frame: https://www.linkedin.com/pages-extensions/FollowCompany?id=28855&counter=none&xdOrigin=https%3A%2F%2Fwww.intego.com&xdChannel=668ce378-72a1-4f0d-9953-e86bd99bfc00&xd_origin_host=https%3A%2F%2Fwww.intego.com
Frame ID: FBAC4C790FBA94227F1BE984A825EE46
Requests: 1 HTTP requests in this frame

Frame: https://www.linkedin.com/pages-extensions/FollowCompany?id=28855&counter=none&xdOrigin=https%3A%2F%2Fwww.intego.com&xdChannel=668ce378-72a1-4f0d-9953-e86bd99bfc00&xd_origin_host=https%3A%2F%2Fwww.intego.com
Frame ID: 64227D3F3246EF527F9BA9DF488CBE24
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/follow_button.2d7d9a6d04538bf11c7b23641e75738c.en.html
Frame ID: 4601AB9C234AA795D9CC223FD4FB7B4F
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/embed/index.html?dnt=true&embedId=twitter-widget-1&frame=false&hideCard=false&hideThread=false&id=1282860187397746689&lang=en&origin=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&theme=light&widgetsVersion=219d021%3A1598982042171&width=500px
Frame ID: FED84D19CE46D3B325D84AB1BE90356D
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/subscribe_embed?action_card=1&channelid=UCtFlc7zQcFj3C_62jVGfghA&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.hc3rLxj9u8o.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCMtAagp6kGxB19Nep_bTJunj37kww%2Fm%3D__features__
Frame ID: 7956DB32F2EE06594A87E49231DB3B1B
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/v2.8/plugins/like.php?action=like&app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17bc57732298e8%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff25f705dc2ca13c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.facebook.com%2Fintego&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&_rdc=1&_rdr
Frame ID: 3F8A2FDC00E6538149F8BEFF41FBA3CB
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/v2.8/plugins/like_box.php?app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df29438fc4560a8%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff25f705dc2ca13c%26relation%3Dparent.parent&color_scheme=light&container_width=290&header=true&href=https%3A%2F%2Fwww.facebook.com%2Fintego&locale=en_US&sdk=joey&show_border=true&show_faces=false&stream=true&_rdc=1&_rdr
Frame ID: CEFA1A3848D4BEFA4520AD0D67FF1706
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://t.co/usI1BDDzZc Page URL
https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/ Page URL

Page Statistics

141
Requests

99 %
HTTPS

66 %
IPv6

35
Domains

50
Subdomains

48
IPs

9
Countries

1750 kB
Transfer

3801 kB
Size

11
Cookies

38 Outgoing links

These are links going to different origins than the main page.

URL: https://support.intego.com/home
Title: Knowledge Base

Search URL Search Domain Scan URL

URL: https://support.intego.com/hc/requests/new
Title: Contact Support

Search URL Search Domain Scan URL

URL: https://support.intego.com/access/unauthenticated?return_to=http%3A%2F%2Fsupport.intego.com%2Frequests
Title: Check Your Requests

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Title: Shares

Search URL Search Domain Scan URL

URL: https://twitter.com/share?url=https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Title: Tweets

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Title: Shares

Search URL Search Domain Scan URL

URL: https://plus.google.com/share?url=https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Title: Shares

Search URL Search Domain Scan URL

URL: https://pinterest.com/pin/create/button/?url=https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Title: Pins

Search URL Search Domain Scan URL

URL: https://foto.wuestenigel.com/cryptocurrencies-on-a-computer-parts/
Title: Marco Vech

Search URL Search Domain Scan URL

URL: https://creativecommons.org/licenses/by/2.0/
Title: CC BY 2.0

Search URL Search Domain Scan URL

URL: https://www.blockchain.com/btc/address/13V56Qzz1ARMZYV3snBaKtSWxeYoLx2gUg
Title: Bitcoin

Search URL Search Domain Scan URL

URL: https://www.blockchain.com/eth/address/0xDf1108ba2D50b4a4e648DeC1053c8F2e3b97DCdF
Title: Ethereum/Tether

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Firesheep
Title: Firesheep

Search URL Search Domain Scan URL

URL: https://www.sentinelone.com/blog/mojaves-security-hardening-user-protections-bypassed/
Title: Phil Stokes’ research

Search URL Search Domain Scan URL

URL: https://eclecticlight.co/2018/11/12/who-put-that-in-my-full-disk-access-list-ssh-and-mojaves-privacy-protection/
Title: detailed by Howard Oakley

Search URL Search Domain Scan URL

URL: https://eclecticlight.co/2020/08/20/the-vulnerability-in-remote-login-ssh-persists/
Title: follow-up article

Search URL Search Domain Scan URL

URL: https://developer.apple.com/security-bounty/
Title: Apple’s own Security Bounty

Search URL Search Domain Scan URL

URL: https://whois-history.whoisxmlapi.com/lookup-report/JPRqQZVJRM
Title: WHOIS history for adobestats[.]com as of Aug 24

Search URL Search Domain Scan URL

URL: https://whois-history.whoisxmlapi.com/lookup-report/QNRPpm3xRA
Title: WHOIS history for flixprice[.]com as of Aug 24

Search URL Search Domain Scan URL

URL: https://whois-history.whoisxmlapi.com/lookup-report/1pRKqgG45w
Title: WHOIS history for titiez[.]com as of Aug 24

Search URL Search Domain Scan URL

URL: https://www.macrumors.com/2020/08/24/xcode-malware-infiltrate-app-store/
Title: speculate

Search URL Search Domain Scan URL

URL: https://twitter.com/IntegoSecurity/status/1125910524519018497
Title: far too late

Search URL Search Domain Scan URL

URL: https://blog.trendmicro.com/trendlabs-security-intelligence/xcsset-mac-malware-infects-xcode-projects-performs-uxss-attack-on-safari-other-browsers-leverages-zero-day-exploits/
Title: this blog post

Search URL Search Domain Scan URL

URL: https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf
Title: this technical brief PDF

Search URL Search Domain Scan URL

URL: https://podcasts.apple.com/us/podcast/intego-mac-podcast/id1293834627

Search URL Search Domain Scan URL

URL: https://podcast.intego.com/149
Title: episode 149

Search URL Search Domain Scan URL

URL: https://podcast.intego.com/
Title: Intego Mac Podcast

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Intego
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.instagram.com/intego_security/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://twitter.com/IntegoSecurity
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/IntegoVideo?sub_confirmation=1
Title: YouTube

Search URL Search Domain Scan URL

URL: https://twitter.com/theJoshMeister
Title: @theJoshMeister

Search URL Search Domain Scan URL

URL: https://security.thejoshmeister.com/
Title: security.thejoshmeister.com

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/us/podcast/intego-mac-podcast/id1293834627

Search URL Search Domain Scan URL

URL: http://facebook.com/Intego
Title: Facebook

Search URL Search Domain Scan URL

URL: http://twitter.com/integosecurity
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/intego
Title: LinkedIn

Search URL Search Domain Scan URL

URL: http://youtube.com/user/IntegoVideo
Title: YouTube

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/usI1BDDzZc Page URL
https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 143

https://web.facebook.com/v2.8/plugins/like.php?action=like&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17bc57732298e8%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff25f705dc2ca13c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.facebook.com%2Fintego&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small HTTP 302
https://www.facebook.com/v2.8/plugins/like.php?action=like&app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17bc57732298e8%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff25f705dc2ca13c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.facebook.com%2Fintego&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&_rdc=1&_rdr

Request Chain 144

https://web.facebook.com/v2.8/plugins/like_box.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df29438fc4560a8%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff25f705dc2ca13c%26relation%3Dparent.parent&color_scheme=light&container_width=290&header=true&href=https%3A%2F%2Fwww.facebook.com%2Fintego&locale=en_US&sdk=joey&show_border=true&show_faces=false&stream=true HTTP 302
https://www.facebook.com/v2.8/plugins/like_box.php?app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df29438fc4560a8%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff25f705dc2ca13c%26relation%3Dparent.parent&color_scheme=light&container_width=290&header=true&href=https%3A%2F%2Fwww.facebook.com%2Fintego&locale=en_US&sdk=joey&show_border=true&show_faces=false&stream=true&_rdc=1&_rdr

141 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 usI1BDDzZc
t.co/ 430 B
416 B 162ms
157ms Document
text/html 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/usI1BDDzZc

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

:method: GET
:authority: t.co
:scheme: https
:path: /usI1BDDzZc
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
cache-control: private,max-age=300
content-encoding: gzip
content-length: 227
content-type: text/html; charset=utf-8
date: Fri, 25 Sep 2020 15:18:43 GMT
expires: Fri, 25 Sep 2020 15:23:43 GMT
server: tsa_o
set-cookie: muc=adf9894c-b617-4496-a371-4f1a1cfceee8; Max-Age=63072000; Expires=Sun, 25 Sep 2022 15:18:43 GMT; Domain=t.co; Secure; SameSite=None
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: 1e6c24ca0787fb8e3f4da78df64e5975
x-response-time: 125
x-xss-protection: 0

GET
H2 200 Primary Request / Show response
www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/ 92 KB
25 KB 57ms
24ms Document
text/html 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Requested by: Host: t.co
URL: https://t.co/usI1BDDzZc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 49b34be224fe432a99c8609e9f61bf4f07144fc9b6b90325b7cc304b1271547f

Request headers

:method: GET
:authority: www.intego.com
:scheme: https
:path: /mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://t.co/usI1BDDzZc
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://t.co/usI1BDDzZc

Response headers

status: 200
date: Fri, 25 Sep 2020 15:18:43 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d6dccbc0b65ae0b6fa3693e0ba2a3c3b11601047123; expires=Sun, 25-Oct-20 15:18:43 GMT; path=/; domain=.intego.com; HttpOnly; SameSite=Lax
vary: Accept-Encoding
cache-control: max-age=86400
expires: Fri, 25 Sep 2020 16:30:06 GMT
age: 756
x-varnish-cache: HIT
cf-cache-status: HIT
cf-request-id: 0567716ff8000097e4523ea200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5d85b82cc81197e4-FRA
content-encoding: gzip

GET
H2 200 style.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/ 135 B
314 B 72ms
14ms Stylesheet
text/css 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9eeea020cc6ec6c8b66b20c48a9b69a5f14b8097bdb91c5420998eb842bcbae0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 718
cf-polished: origSize=512
status: 200
cf-request-id: 05677170b6000097e4523ef200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-200"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82df8c597e4-FRA
cf-bgj: minify

GET
H2 200 font-awesome.css
netdna.bootstrapcdn.com/font-awesome/3.1.1/css/ 23 KB
5 KB 1826ms
9ms Stylesheet
text/css 2001:4de0:ac19::1:b:2b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://netdna.bootstrapcdn.com/font-awesome/3.1.1/css/font-awesome.css

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

a2d30057d0a8007fb75fb8a6e4f82f59d3858d29ea176db9c73f665209e86123

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Dec 2018 18:35:19 GMT
status: 200
etag: "1544639719"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 4713

GET
H2 200 css
fonts.googleapis.com/ 16 KB
1 KB 79ms
29ms Stylesheet
text/css 2a00:1450:4001:818::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:200,400,700,200italic,400italic,700italic

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8f2cf36a9df3e0af8f1b226a1440c9a6fd4cda5c4b4548150236c8d1a1b094e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 25 Sep 2020 15:18:44 GMT
server: ESF
date: Fri, 25 Sep 2020 15:18:44 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 25 Sep 2020 15:18:44 GMT

GET
H2 200 widget.css
www.intego.com/mac-security-blog/wp-content/plugins/yet-another-related-posts-plugin/style/ 606 B
464 B 65ms
15ms Stylesheet
text/css 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/plugins/yet-another-related-posts-plugin/style/widget.css?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 765af1bf46f65a6bb9108eea31286465e8a28f1c649030afff11b51b45cb25d4

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1976
cf-polished: origSize=771
status: 200
cf-request-id: 05677170b6000097e4523f0200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-303"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82df8c697e4-FRA
cf-bgj: minify

GET
H2 200 style.min.css
www.intego.com/mac-security-blog/wp-includes/css/dist/block-library/ 52 KB
8 KB 68ms
19ms Stylesheet
text/css 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-includes/css/dist/block-library/style.min.css?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1976
status: 200
content-length: 7643
cf-request-id: 05677170b7000097e4523f1200000001
last-modified: Tue, 05 May 2020 06:38:24 GMT
server: cloudflare
etag: W/"5eb109e0-d159"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b82df8c797e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 light_style.css
www.intego.com/mac-security-blog/wp-content/plugins/jquery-collapse-o-matic/ 884 B
501 B 66ms
16ms Stylesheet
text/css 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/plugins/jquery-collapse-o-matic/light_style.css?ver=1.6
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d077683ec63c7d44f473554e688628da6cfdf84c0f223b6be00f2476600433a5

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 718
cf-polished: origSize=1043
status: 200
cf-request-id: 05677170b7000097e4523f2200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-413"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82df8c897e4-FRA
cf-bgj: minify

GET
H2 200 bootstrap.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 99 KB
16 KB 74ms
25ms Stylesheet
text/css 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/bootstrap.css?ver=1.0
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3fb4cab423b2441335fc682b79687d8eb806aceb384c937c9b28534580593fd4

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 718
cf-polished: origSize=121622
status: 200
cf-request-id: 05677170b9000097e4523f3200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-1db16"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82df8cb97e4-FRA
cf-bgj: minify

GET
H2 200 bootstrap-responsive.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 16 KB
4 KB 66ms
17ms Stylesheet
text/css 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/bootstrap-responsive.css?ver=1.0
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c082b0b5901359803e620e04dee50986beef023bdc7413d1e47d571bc73a7500

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 718
cf-polished: origSize=21797
status: 200
cf-request-id: 05677170b9000097e4523f4200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-5525"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82df8cc97e4-FRA
cf-bgj: minify

GET
H2 200 layout-responsive.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 2 KB
785 B 67ms
18ms Stylesheet
text/css 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout-responsive.css?ver=1.0
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f2b93287eebae3a6ac1f7efadd39373abd95e1ee24620ef4f156b0fe1a496be4

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 718
cf-polished: origSize=2755
status: 200
cf-request-id: 05677170b9000097e4523f5200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-ac3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82df8cd97e4-FRA
cf-bgj: minify

GET
H2 200 jetpack.css
www.intego.com/mac-security-blog/wp-content/plugins/jetpack/css/ 73 KB
13 KB 89ms
40ms Stylesheet
text/css 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/plugins/jetpack/css/jetpack.css?ver=8.6.1
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a9cab6b997431283ce8f789f1efd7d1b74f27e79c9f545a623ee1387ce7409ac

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1976
cf-polished: origSize=74986
status: 200
cf-request-id: 05677170b9000097e4523f6200000001
last-modified: Mon, 06 Jul 2020 16:18:19 GMT
server: cloudflare
etag: W/"5f034ecb-124ea"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82df8ce97e4-FRA
cf-bgj: minify

GET
H2 200 advanced-recent-posts-widget.css
www.intego.com/mac-security-blog/wp-content/plugins/advanced-recent-posts-widget/css/ 582 B
391 B 65ms
17ms Stylesheet
text/css 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/plugins/advanced-recent-posts-widget/css/advanced-recent-posts-widget.css?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f538d5803d00836b5f946264abb64976a6416ab4cc16f8f83455a025a08ad014

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1976
cf-polished: origSize=744
status: 200
cf-request-id: 05677170b9000097e4523f7200000001
last-modified: Mon, 06 Jul 2020 16:18:19 GMT
server: cloudflare
etag: W/"5f034ecb-2e8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82df8cf97e4-FRA
cf-bgj: minify

GET
H2 200 jquery.adrotate.clicktracker.js Show response
www.intego.com/mac-security-blog/wp-content/plugins/adrotate/library/ 199 B
263 B 73ms
24ms Script
application/javascript 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/plugins/adrotate/library/jquery.adrotate.clicktracker.js
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1ec59a067ba6ca9573c5443f4162b16b1b3349c34669eb4e7f4be7a20bdc85e5

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1976
cf-polished: origSize=373
status: 200
cf-request-id: 05677170b9000097e4523f8200000001
last-modified: Mon, 06 Jul 2020 16:18:19 GMT
server: cloudflare
etag: W/"5f034ecb-175"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82df8d097e4-FRA
cf-bgj: minify

GET
H2 200 jquery.js Show response
www.intego.com/mac-security-blog/wp-includes/js/jquery/ 95 KB
33 KB 91ms
43ms Script
application/javascript 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8c7ee0238fa5cd80a02ef9870a7fff498ef52097181cb73edb9219dc022fd919

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 718
cf-polished: origSize=96873
status: 200
cf-request-id: 05677170bc000097e4523f9200000001
last-modified: Fri, 17 May 2019 04:25:54 GMT
server: cloudflare
etag: W/"5cde37d2-17a69"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82df8d197e4-FRA
cf-bgj: minify

GET
H2 200 jquery-migrate.min.js Show response
www.intego.com/mac-security-blog/wp-includes/js/jquery/ 10 KB
4 KB 89ms
41ms Script
application/javascript 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1976
status: 200
content-length: 4014
cf-request-id: 05677170bc000097e4523fa200000001
last-modified: Fri, 20 May 2016 06:11:28 GMT
server: cloudflare
etag: W/"573eaa90-2748"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b82df8d297e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 bootstrap.min.js Show response
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/ 25 KB
7 KB 71ms
23ms Script
application/javascript 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/bootstrap.min.js?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7587369160233b751c90ccc2043b7fdfd7eb1f0d9aa610371b43f4b3419fa83f

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1976
status: 200
content-length: 6816
cf-request-id: 05677170bc000097e4523fb200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-648f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b82df8d397e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 html5shiv.js Show response
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/ 2 KB
1 KB 73ms
26ms Script
application/javascript 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/html5shiv.js?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b859cc611126401cdc38d803ac7c5967ee5da1a626e00318700ea88df55da1b9

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1976
cf-polished: origSize=2376
status: 200
cf-request-id: 05677170bc000097e4523fc200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-948"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82df8d597e4-FRA
cf-bgj: minify

GET
H2 200 modernizr-1.6.min.js Show response
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/ 9 KB
4 KB 74ms
27ms Script
application/javascript 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/modernizr-1.6.min.js?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0140ed5069f22e4aa8bb1a1fc615c39fc55d7d64e94be541615f1c5a30ae479b

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1976
status: 200
content-length: 3717
cf-request-id: 05677170bc000097e4523fd200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-255b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b82df8d697e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 scripts.js Show response
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/ 10 KB
3 KB 97ms
60ms Script
application/javascript 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/scripts.js?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7456721b1c3d2c1c24d4ed813a2795d0907dc1c0b2748e566e8dabf3d1126dcb

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1976
cf-polished: origSize=17410
status: 200
cf-request-id: 05677170bc000097e4523fe200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-4402"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82df8d797e4-FRA
cf-bgj: minify

GET
H2 200 tracking.js Show response
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/ 3 KB
1005 B 77ms
42ms Script
application/javascript 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/tracking.js
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f5eb3447e5e14f6907295baf22ba454cf3a88b4cd41abd61e6286e975d3608a0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 3245
cf-polished: origSize=4190
status: 200
cf-request-id: 05677170bc000097e4523ff200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-105e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82df8d997e4-FRA
cf-bgj: minify

GET
H2 200 widgets.js Show response
platform.twitter.com/ 95 KB
29 KB 94ms
26ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: a761b426004caba495cdac2c93ce7dd306c47bc4d7bdc63c4840c3d8182396a9

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 28881
x-served-by: cache-bwi5137-BWI, cache-fra19146-FRA
last-modified: Tue, 01 Sep 2020 20:40:54 GMT
etag: "a58136137a93f33c1d165df7d4d973f8+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=1800
accept-ranges: bytes
tw-cdn: FT

GET
H/1.1 200
OK in.js Show response
platform.linkedin.com/ 181 KB
55 KB 121ms
9ms Script
text/javascript 2a02:26f0:6c00::210:ba20
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin.com/in.js
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00::210:ba20 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: Play /
Resource Hash: 9397e430232fd1a326c8e8ca1473007c96f8c84a0fa2820c4ca16d4e311d1fde

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-LI-UUID: /CUx3KUOOBaQcgeLdisAAA==
Date: Fri, 25 Sep 2020 15:18:44 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV6
Server: Play
X-Li-Pop: prod-eda6
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Cache-Control: public, max-age=3600
Connection: keep-alive
X-LI-Proto: http/1.1
Content-Length: 55598
X-CDN: AKAM
X-Li-Fabric: prod-lva1
Expires: Fri, 25 Sep 2020 15:56:13 GMT

GET
H2 200 btn_search.png
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/ 1 KB
1 KB 26ms
20ms Image
image/webp 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/btn_search.png
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85c1eb2c2a173feceba14abe8344fe9c7cb12aa1353f083f28a62f1a366763b9

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
cf-cache-status: HIT
age: 3146
cf-polished: origFmt=png, origSize=2462
status: 200
content-disposition: inline; filename="btn_search.webp"
content-length: 1104
cf-request-id: 056771736b000097e45202f200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: "5f034ecc-99e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b8324bb097e4-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 5ad29f4111ce14911abaa98cbbcdea42
secure.gravatar.com/avatar/ 1 KB
1 KB 46ms
12ms Image
image/png 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/5ad29f4111ce14911abaa98cbbcdea42?s=18&d=mm&r=g
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 270deaa4889841d35cc851365432365bf62d81c1159ad4a1099def85ce6f8bed

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 4
date: Fri, 25 Sep 2020 15:18:44 GMT
last-modified: Wed, 21 Nov 2018 15:20:13 GMT
server: nginx
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="5ad29f4111ce14911abaa98cbbcdea42.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/5ad29f4111ce14911abaa98cbbcdea42?s=18&d=mm&r=g>; rel="canonical"
content-length: 1051
expires: Fri, 25 Sep 2020 15:23:44 GMT

GET
H2 200 Xcodeproj-infected-with-XCSSET-Mac-malware-logo-600x300-1.png
www.intego.com/mac-security-blog/wp-content/uploads/2020/08/ 67 KB
67 KB 592ms
591ms Image
image/png 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/uploads/2020/08/Xcodeproj-infected-with-XCSSET-Mac-malware-logo-600x300-1.png
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f1cdac0359446f4055570e505f21ef9e35944fbc99ae9f22a1f1c750b958733c

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:45 GMT
cf-cache-status: REVALIDATED
status: 200
content-length: 68232
cf-request-id: 05677173b7000097e452036200000001
last-modified: Fri, 21 Aug 2020 21:39:06 GMT
server: cloudflare
etag: "5f403efa-10a88"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b832bc1597e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 Xcode-icon-Big-Sur-512-300x300.jpg
www.intego.com/mac-security-blog/wp-content/uploads/2020/08/ 17 KB
17 KB 707ms
706ms Image
image/jpeg 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/uploads/2020/08/Xcode-icon-Big-Sur-512-300x300.jpg
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f9d053ff298bf8178d03311f9b490059ccdf3791d02348c3971907f4e0d1b03

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:46 GMT
cf-cache-status: MISS
status: 200
content-length: 17647
cf-request-id: 056771760a000097e452061200000001
last-modified: Mon, 24 Aug 2020 15:00:00 GMT
server: cloudflare
etag: "5f43d5f0-44ef"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b8367e6b97e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 Bitcoin-Ripple-Ethereum-cryptocurrencies-on-computer-parts-by-Marco-Vech-modified-325x220-1.jpg
www.intego.com/mac-security-blog/wp-content/uploads/2020/02/ 28 KB
28 KB 591ms
591ms Image
image/webp 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/uploads/2020/02/Bitcoin-Ripple-Ethereum-cryptocurrencies-on-computer-parts-by-Marco-Vech-modified-325x220-1.jpg
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dd181d190b0d09b0d51c5ab338983be4d084fbec3af3dbe6e739e9f55014c5b6

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:46 GMT
cf-cache-status: REVALIDATED
cf-polished: qual=85, origFmt=jpeg, origSize=41624
status: 200
content-disposition: inline; filename="Bitcoin-Ripple-Ethereum-cryptocurrencies-on-computer-parts-by-Marco-Vech-modified-325x220-1.webp"
content-length: 28614
cf-request-id: 05677177b7000097e452075200000001
last-modified: Fri, 14 Feb 2020 23:03:27 GMT
server: cloudflare
etag: "5e47273f-a298"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b839285797e4-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 cookies-300x171.png
www.intego.com/mac-security-blog/wp-content/uploads/2020/08/ 73 KB
74 KB 886ms
841ms Image
image/png 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/uploads/2020/08/cookies-300x171.png
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 75cb79bd603606b3fb0454b9cedeb147e5b325f3139959b1f079b41bcf077261

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:47 GMT
cf-cache-status: MISS
status: 200
content-length: 75087
cf-request-id: 0567717930000097e452087200000001
last-modified: Mon, 24 Aug 2020 18:56:04 GMT
server: cloudflare
etag: "5f440d44-1254f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b83b8a0597e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 safari-150x150.png
www.intego.com/mac-security-blog/wp-content/uploads/2019/06/ 26 KB
26 KB 766ms
722ms Image
image/png 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/uploads/2019/06/safari-150x150.png
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eafd487d44de8fc38a461abc3f2d2e9c40bd170ba23556561447f679ff105a4

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:47 GMT
cf-cache-status: MISS
status: 200
content-length: 26593
cf-request-id: 0567717930000097e452088200000001
last-modified: Fri, 28 Jun 2019 13:36:47 GMT
server: cloudflare
etag: "5d1617ef-67e1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b83b8a0697e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 GitHub_Logo-300x123.png
www.intego.com/mac-security-blog/wp-content/uploads/2020/08/ 6 KB
6 KB 624ms
580ms Image
image/png 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/uploads/2020/08/GitHub_Logo-300x123.png
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 06ab70caac9ecdf9ccce5eb0b75786dae3f3c6805f6c71f044bc3818e734f2bd

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:46 GMT
cf-cache-status: MISS
status: 200
content-length: 6055
cf-request-id: 0567717933000097e45208a200000001
last-modified: Mon, 24 Aug 2020 19:14:29 GMT
server: cloudflare
etag: "5f441195-17a7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b83b8a0b97e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 big-sur-600.jpeg
www.intego.com/mac-security-blog/wp-content/uploads/2020/08/ 31 KB
32 KB 621ms
577ms Image
image/webp 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/uploads/2020/08/big-sur-600.jpeg
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 74bb956c78140b9e3228afbcc5c520080df82ea13e945766657928838ec56515

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:46 GMT
cf-cache-status: REVALIDATED
cf-polished: qual=85, origFmt=jpeg, origSize=94608
status: 200
content-disposition: inline; filename="big-sur-600.webp"
content-length: 31966
cf-request-id: 0567717933000097e45208b200000001
last-modified: Mon, 17 Aug 2020 09:34:39 GMT
server: cloudflare
etag: "5f3a4f2f-17190"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b83b8a0c97e4-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 X9-Mac-Antivirus-Launch-300x150.png
www.intego.com/mac-security-blog/wp-content/uploads/2016/06/ 47 KB
47 KB 890ms
847ms Image
image/png 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/uploads/2016/06/X9-Mac-Antivirus-Launch-300x150.png
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 318006d41558b563729ff43d06d5aff24b9b95c942091bbd94214b9720688b50

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:47 GMT
cf-cache-status: MISS
status: 200
content-length: 47876
cf-request-id: 0567717933000097e45208c200000001
last-modified: Mon, 20 Jun 2016 03:34:07 GMT
server: cloudflare
etag: "5767642f-bb04"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b83b8a0e97e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 ios9-podcasts-app-tile-50x50.png
www.intego.com/mac-security-blog/wp-content/uploads/2017/10/ 2 KB
2 KB 32ms
20ms Image
image/webp 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/uploads/2017/10/ios9-podcasts-app-tile-50x50.png
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4813a9ef082680ede099e57bad023ef37cb204fe87ec0de1de1534cc7b1b4103

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:46 GMT
cf-cache-status: HIT
age: 1100
cf-polished: origFmt=png, origSize=3407
status: 200
content-disposition: inline; filename="ios9-podcasts-app-tile-50x50.webp"
content-length: 2176
cf-request-id: 0567717a1a000097e452099200000001
last-modified: Tue, 31 Oct 2017 12:56:46 GMT
server: cloudflare
etag: "59f8730e-d4f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b83cfad797e4-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 5ad29f4111ce14911abaa98cbbcdea42
secure.gravatar.com/avatar/ 8 KB
8 KB 58ms
16ms Image
image/png 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/5ad29f4111ce14911abaa98cbbcdea42?s=60&d=mm&r=g
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 33f30681793311916b1626535ca2990a9efcbf10f26d2c2a6565edfb6979c4ec

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 4
date: Fri, 25 Sep 2020 15:18:46 GMT
last-modified: Wed, 21 Nov 2018 15:20:13 GMT
server: nginx
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="5ad29f4111ce14911abaa98cbbcdea42.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/5ad29f4111ce14911abaa98cbbcdea42?s=60&d=mm&r=g>; rel="canonical"
content-length: 8249
expires: Fri, 25 Sep 2020 15:23:46 GMT

GET
H2 200 privacy-hero-400.jpeg
i2.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2020/09/ 1 KB
1 KB 220ms
34ms Image
image/jpeg 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2020/09/privacy-hero-400.jpeg?resize=40%2C40&ssl=1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

79e23a92dfcac7cfec15c82dfcbd83d3db7cb9222a8a1a60963d0bec57977163

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 5
date: Fri, 25 Sep 2020 15:18:46 GMT
x-content-type-options: nosniff
x-bytes-saved: 76
last-modified: Thu, 24 Sep 2020 15:27:34 GMT
server: nginx
etag: "183d327cfe0bbfca"
vary: Accept
content-type: image/jpeg
status: 200
cache-control: public, max-age=63115200
link: <https://www.intego.com/mac-security-blog/wp-content/uploads/2020/09/privacy-hero-400.jpeg>; rel="canonical"
content-length: 1148
expires: Sun, 25 Sep 2022 03:27:34 GMT

GET
H2 200 Intego-Mac-Podcast-New-Episode-Featured.png
i0.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2018/07/ 478 B
786 B 159ms
60ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2018/07/Intego-Mac-Podcast-New-Episode-Featured.png?resize=40%2C40&ssl=1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

8e647ae3b97c4adb3970662d2945d1be4cf09e75712de88eb2b3adf793d16bcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 8
date: Fri, 25 Sep 2020 15:18:46 GMT
x-content-type-options: nosniff
x-bytes-saved: 1060
last-modified: Fri, 26 Jun 2020 18:35:39 GMT
server: nginx
etag: "48790abe968542f8"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <https://www.intego.com/mac-security-blog/wp-content/uploads/2018/07/Intego-Mac-Podcast-New-Episode-Featured.png>; rel="canonical"
content-length: 478
expires: Mon, 27 Jun 2022 06:35:39 GMT

GET
H2 200 ios-software-update-available-icon-400x260.png
i1.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2019/01/ 582 B
875 B 161ms
57ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2019/01/ios-software-update-available-icon-400x260.png?resize=40%2C40&ssl=1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

a4d96a2b0a51347fa935513d95b0f49d7f6fcebb5357fd7129974758bb5b5680

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 6
date: Fri, 25 Sep 2020 15:18:46 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Sep 2020 05:02:19 GMT
server: nginx
etag: "c7cecc8dfda40704"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <https://www.intego.com/mac-security-blog/wp-content/uploads/2019/01/ios-software-update-available-icon-400x260.png>; rel="canonical"
content-length: 582
expires: Sun, 18 Sep 2022 17:02:19 GMT

GET
H2 200 Intego-Podcast-iTunes.png
www.intego.com/mac-security-blog/wp-content/uploads/2017/10/ 11 KB
11 KB 20ms
18ms Image
image/webp 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/uploads/2017/10/Intego-Podcast-iTunes.png
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 658e8b2fc6e603ce4afb0f39cd09d2ff743c9fcbeaaea5dc58097184d34da56d

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:46 GMT
cf-cache-status: HIT
age: 2270
cf-polished: origFmt=png, origSize=16774
status: 200
content-disposition: inline; filename="Intego-Podcast-iTunes.webp"
content-length: 11048
cf-request-id: 0567717a3f000097e45209a200000001
last-modified: Wed, 25 Oct 2017 16:25:31 GMT
server: cloudflare
etag: "59f0bafb-4186"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b83d3afc97e4-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 related.css
www.intego.com/mac-security-blog/wp-content/plugins/yet-another-related-posts-plugin/style/ 495 B
400 B 23ms
21ms Stylesheet
text/css 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/plugins/yet-another-related-posts-plugin/style/related.css?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aeed123aaf3d21619c5676888e47328a2f0f9994ea86268b5ad0072825bc29fb

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1976
cf-polished: origSize=647
status: 200
cf-request-id: 056771713d000097e452008200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-287"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82ec96397e4-FRA
cf-bgj: minify

GET
H2 200 comment-reply.min.js Show response
www.intego.com/mac-security-blog/wp-includes/js/ 2 KB
1 KB 23ms
22ms Script
application/javascript 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-includes/js/comment-reply.min.js?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a37ca4608218cccdfb8b6d4edbdfbf375d0e1368b46397e3b7049e0cbf5bc1f6

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1976
status: 200
content-length: 1159
cf-request-id: 0567717167000097e45200b200000001
last-modified: Mon, 06 Apr 2020 12:02:02 GMT
server: cloudflare
etag: W/"5e8b1a3a-974"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b82f098d97e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 comment_count.js Show response
www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/ 708 B
651 B 13ms
12ms Script
application/javascript 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.17
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b385fd0614f2927f0e7fdc03ccdb2428e3a93de0c7fe467149b34213cc32c0f6

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 718
cf-polished: origSize=889
status: 200
cf-request-id: 056771717f000097e45200d200000001
last-modified: Mon, 06 Jul 2020 16:18:19 GMT
server: cloudflare
etag: W/"5f034ecb-379"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82f399e97e4-FRA
cf-bgj: minify

GET
H2 200 comment_embed.js Show response
www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/ 828 B
533 B 30ms
19ms Script
application/javascript 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.17
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e7f5a831ead8920451598097754bb1d4fbf16fff1fd90794b950724867345794

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 718
cf-polished: origSize=1150
status: 200
cf-request-id: 05677171a0000097e45200e200000001
last-modified: Mon, 06 Jul 2020 16:18:19 GMT
server: cloudflare
etag: W/"5f034ecb-47e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82f69b697e4-FRA
cf-bgj: minify

GET
H2 200 collapse.js Show response
www.intego.com/mac-security-blog/wp-content/plugins/jquery-collapse-o-matic/js/ 14 KB
3 KB 14ms
13ms Script
application/javascript 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/plugins/jquery-collapse-o-matic/js/collapse.js?ver=1.6.19
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01fdf346f2f8d129c118d71f735fb3a76656059b38000829b908a1a118a5492f

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 2463
cf-polished: origSize=20438
status: 200
cf-request-id: 05677171ba000097e452010200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-4fd6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82f99cb97e4-FRA
cf-bgj: minify

GET
H2 200 wp-embed.min.js Show response
www.intego.com/mac-security-blog/wp-includes/js/ 1 KB
873 B 17ms
17ms Script
application/javascript 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-includes/js/wp-embed.min.js?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1976
status: 200
content-length: 769
cf-request-id: 05677171c9000097e452011200000001
last-modified: Mon, 06 Apr 2020 12:02:02 GMT
server: cloudflare
etag: W/"5e8b1a3a-59a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b82fa9db97e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 iframe_api Show response
www.youtube.com/ 859 B
1 KB 34ms
27ms Script
application/javascript 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api?ver=5.4.2

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

bb419846a6c750ceac7e697b479216945b7597dea49905e30d1fc040a3194099

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:44 GMT
x-content-type-options: nosniff
server: YouTube Frontend Proxy
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
status: 200
cache-control: no-cache
content-type: application/javascript
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Tue, 27 Apr 1971 19:44:06 GMT

GET
H2 200 platform.js Show response
apis.google.com/js/ 49 KB
19 KB 35ms
34ms Script
application/javascript 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/platform.js?ver=5.4.2

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3daa2574bee66a8fd18b5323d1b22f5562ed8d497aa17986446eb877a703bba6

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-C9cgkwNEr0Cehvtvtg3nww' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
x-frame-options: SAMEORIGIN
etag: "3ed774a03f695fbc831e1717a4f45942"
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
content-security-policy: script-src 'report-sample' 'nonce-C9cgkwNEr0Cehvtvtg3nww' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin: *
expires: Fri, 25 Sep 2020 15:18:44 GMT

GET
H2 200 e-202039.js Show response
stats.wp.com/ 9 KB
3 KB 143ms
24ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202039.js
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:46 GMT
content-encoding: gzip
server: nginx
etag: W/"5c6340e3-350a"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
expires: Sun, 19 Sep 2021 22:23:43 GMT

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 353 KB
114 KB 109ms
40ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
server: nginx/1.15.8
etag: "5ed917ff-5834c"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
status: 200
cache-control: public, max-age=600
date: Fri, 25 Sep 2020 15:18:44 GMT
x-host: s7.addthis.com
content-length: 116323

GET
H2 200 reset.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 773 B
549 B 59ms
13ms Stylesheet
text/css 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/reset.css
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82f1278f66b192a223e306d884f8db595ef3b6d829cc1544807b9bf40019403e

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 718
cf-polished: origSize=1184
status: 200
cf-request-id: 0567717116000097e452002200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-4a0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82e892797e4-FRA
cf-bgj: minify

GET
H2 200 layout.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 24 KB
6 KB 58ms
12ms Stylesheet
text/css 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 451b07379c15f95edc328f4b3b71d3d3b67cda7fe5b85251b39f866d0189f943

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 718
cf-polished: origSize=30630
status: 200
cf-request-id: 0567717116000097e452003200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-77a6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82e892897e4-FRA
cf-bgj: minify

GET
H2 200 wrapper.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 96 KB
23 KB 61ms
16ms Stylesheet
text/css 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/wrapper.css
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cd42913991b63df247c37543d4b233d0579e3765af6e88565d36b8ddf91693bc

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 2389
cf-polished: origSize=109585
status: 200
cf-request-id: 0567717116000097e452004200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-1ac11"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82e892997e4-FRA
cf-bgj: minify

GET
H2 200 referrer-overrides.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 125 B
222 B 59ms
15ms Stylesheet
text/css 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/referrer-overrides.css
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aaffceab986a8d791cfef18d2d1e28fe2dcaf40a8bdfaf4fd393b1a91c6f072b

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 718
cf-polished: origSize=141
status: 200
cf-request-id: 0567717116000097e452005200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-8d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82e892b97e4-FRA
cf-bgj: minify

GET
H2 200 print.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 2 KB
457 B 55ms
11ms Stylesheet
text/css 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/print.css
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 884a2330198f498e36d9e77bb5c7f4971b3d70c4411cf306a3afca8bb50bb94d

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:44 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 718
cf-polished: origSize=3073
status: 200
cf-request-id: 0567717116000097e452006200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-c01"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85b82e892d97e4-FRA
cf-bgj: minify

GET
H2 200 wp-emoji-release.min.js Show response
www.intego.com/mac-security-blog/wp-includes/js/ 14 KB
5 KB 18ms
14ms Script
application/javascript 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-includes/js/wp-emoji-release.min.js?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:46 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1977
status: 200
content-length: 4653
cf-request-id: 0567717a5a000097e45209b200000001
last-modified: Mon, 06 Apr 2020 12:02:02 GMT
server: cloudflare
etag: W/"5e8b1a3a-364d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b83d5b0f97e4-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 150 KB
42 KB 35ms
24ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-9WJ8

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c9a89d2f60c10e0ddd38bd870c2ec6aa6db7f00f6cb44113f7e195fe55263def

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:46 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42512
x-xss-protection: 0
expires: Fri, 25 Sep 2020 15:18:46 GMT

GET
H2 200 logo.svg
www.intego.com/sites/all/themes/intego_3/dist/images/_include-raw/ 2 KB
1 KB 21ms
16ms Image
image/svg+xml 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/sites/all/themes/intego_3/dist/images/_include-raw/logo.svg

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/wrapper.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5539ebc747e005bcd0bcdf9e946d3469107a18d1996595c39a2445a886468674

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/wrapper.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2391
status: 200
cf-request-id: 05677179c4000097e452092200000001
last-modified: Thu, 24 Sep 2020 15:06:19 GMT
server: cloudflare
etag: W/"dea433-7af-5b0108ad910c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=1209600
cf-ray: 5d85b83c6a8597e4-FRA
expires: Thu, 08 Oct 2020 15:19:13 GMT

GET
H2 200 blog_header_bg.gif
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/ 3 KB
3 KB 20ms
15ms Image
image/webp 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/blog_header_bg.gif
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: af0c90c79167796746d77eb0f20a739e66fa7fcd774680c7ba25cce5292d5ba5

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:46 GMT
cf-cache-status: HIT
age: 2391
cf-polished: origFmt=gif, origSize=5992
status: 200
content-disposition: inline; filename="blog_header_bg.webp"
content-length: 3064
cf-request-id: 05677179c4000097e452091200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: "5f034ecc-1768"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b83c6a8497e4-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 33ms
7ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c038085bd64c19c9f10dbf5d50967e4336ad5db48ff87111cb181e9a05cbaab0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: 1tsg6ofcCcKcwxuLKM18SA==
status: 200
cross-origin-resource-policy: cross-origin
expires: Fri, 25 Sep 2020 15:38:08 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1778
etag: "16c8e21ad71aa777023cb101b393a96a"
x-fb-debug: t+HoSnKrRkF9tHpst1axpUCxIPvWg+CZP3xpDptYbKgV7xfma4lMUfzr5+e3wXRdQTHsz0TIkNHQ9Y45xO2U0g==
x-fb-trip-id: 1460883810
x-fb-content-md5: 5806e0fba4e794faf6e40a3d79f115b0
date: Fri, 25 Sep 2020 15:18:46 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

GET
H2 200 share_divider.png
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/ 166 B
361 B 12ms
10ms Image
image/webp 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/share_divider.png
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ffa8b5c0d78def1b71617c0ae00e01b295bc29e2e227ba0dc84469a9ba39259c

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:46 GMT
cf-cache-status: HIT
age: 3147
cf-polished: origFmt=png, origSize=1219
status: 200
content-disposition: inline; filename="share_divider.webp"
content-length: 166
cf-request-id: 0567717a6b000097e45209c200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: "5f034ecc-4c3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b83d7b1f97e4-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 DagnyWebPro.woff
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/ 39 KB
39 KB 35ms
18ms Font
font/woff 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/DagnyWebPro.woff
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 364c1179390530ea06c6636e2f314aa1091d460c4c6e369c6689a0fe31672054

Request headers

Origin: https://www.intego.com
Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:46 GMT
cf-cache-status: HIT
age: 67
status: 200
content-length: 40116
cf-request-id: 0567717a18000097e452095200000001
last-modified: Thu, 24 Sep 2020 17:55:33 GMT
server: cloudflare
etag: "5f6cdd95-9cb4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
cache-control: max-age=86400
accept-ranges: bytes
cf-ray: 5d85b83cfad097e4-FRA
expires: Sat, 26 Sep 2020 15:15:36 GMT

GET
H2 200 fontawesome-webfont.woff
netdna.bootstrapcdn.com/font-awesome/3.1.1/font/ 34 KB
34 KB 27ms
9ms Font
font/woff 2001:4de0:ac19::1:b:3b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://netdna.bootstrapcdn.com/font-awesome/3.1.1/font/fontawesome-webfont.woff?v=3.1.0

Requested by

Host: netdna.bootstrapcdn.com
URL: https://netdna.bootstrapcdn.com/font-awesome/3.1.1/css/font-awesome.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:3b , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

4e58b78b5844a988d67532b4683a6e8b3235b3d56d319727e65f460805bbdec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.intego.com
Referer: https://netdna.bootstrapcdn.com/font-awesome/3.1.1/css/font-awesome.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Dec 2018 18:35:43 GMT
status: 200
etag: "1544639743"
vary: Accept-Encoding
x-cache: HIT
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 34418

GET
H2 200 DagnyWebPro-Bold.woff
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/ 40 KB
40 KB 36ms
19ms Font
font/woff 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/DagnyWebPro-Bold.woff
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 142bb04454d6124c28f12d43249615ae8903c9742ea86c024ef0602f4dd1446e

Request headers

Origin: https://www.intego.com
Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:46 GMT
cf-cache-status: HIT
age: 67
status: 200
content-length: 40940
cf-request-id: 0567717a18000097e452096200000001
last-modified: Thu, 24 Sep 2020 17:55:33 GMT
server: cloudflare
etag: "5f6cdd95-9fec"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
cache-control: max-age=86400
accept-ranges: bytes
cf-ray: 5d85b83cfad197e4-FRA
expires: Sat, 26 Sep 2020 15:15:00 GMT

GET
H2 200 DagnyWebPro-BoldItalic.woff
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/ 40 KB
40 KB 47ms
31ms Font
font/woff 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/DagnyWebPro-BoldItalic.woff
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e48d539ca17fdd4a1ea4d56c769df1b9469535132e9cc45d187e8cf4560ab57d

Request headers

Origin: https://www.intego.com
Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:46 GMT
cf-cache-status: HIT
age: 3148
status: 200
content-length: 41232
cf-request-id: 0567717a18000097e452097200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: "5f034ecc-a110"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
cache-control: max-age=86400
accept-ranges: bytes
cf-ray: 5d85b83cfad297e4-FRA
expires: Fri, 25 Sep 2020 15:08:12 GMT

GET
H2 200 DagnyWebPro-Thin.woff
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/ 38 KB
38 KB 46ms
33ms Font
font/woff 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/DagnyWebPro-Thin.woff
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 593b81ecc28e013924cc0bd0b78a6a990c0e01ffbf31ef576d5f6086829ab9a0

Request headers

Origin: https://www.intego.com
Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:46 GMT
cf-cache-status: HIT
age: 67
status: 200
content-length: 38836
cf-request-id: 0567717a19000097e452098200000001
last-modified: Thu, 24 Sep 2020 17:55:33 GMT
server: cloudflare
etag: "5f6cdd95-97b4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
cache-control: max-age=86400
accept-ranges: bytes
cf-ray: 5d85b83cfad397e4-FRA
expires: Sat, 26 Sep 2020 15:10:49 GMT

GET
H/1.1 200
OK GegHgcrH+8gxBbG1E
fireside.fm/player/v2/ Frame CB6E 0
0 775ms
198ms Document
text/html 96.126.99.139
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://fireside.fm/player/v2/GegHgcrH+8gxBbG1E?theme=dark

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

96.126.99.139 Fremont, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

nb-96-126-99-139.fremont.nodebalancer.linode.com

Software

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: fireside.fm
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

Content-Type: text/html; charset=utf-8
Status: 200 OK
Surrogate-Control: max-age=2592000
Cache-Control: public, no-cache
Referrer-Policy: strict-origin-when-cross-origin
X-Permitted-Cross-Domain-Policies: none
X-XSS-Protection: 1; mode=block
X-Request-Id: 7839beeb-7939-43de-a3b3-9707e06725ac
X-Download-Options: noopen
ETag: W/"08045e480b020888851015354ffa5560"
X-Runtime: 0.022046
X-Content-Type-Options: nosniff nosniff
Date: Fri, 25 Sep 2020 12:24:34 GMT
X-Backend-Server: web01.fireside.fm
Content-Encoding: gzip
X-Url: /player/v2/GegHgcrH+8gxBbG1E?theme=dark
X-Host: fireside.fm
X-Server: cache01.fireside.fm
Vary: Accept-Encoding
Age: 10454
Accept-Ranges: bytes
Content-Length: 6662
Connection: close

GET
H2 200 nCVaZVfnkTY
www.youtube-nocookie.com/embed/ Frame E2DE 0
0 94ms
86ms Document
text/html 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube-nocookie.com/embed/nCVaZVfnkTY?&list=PLL1eIqHwwN-MY4WwZvjNYcqo02CbtoB7J&autohide=2&color=red&controls=1&disablekb=0&fs=1&iv_load_policy=1&modestbranding=0&rel=0&showinfo=0&theme=dark&vq=default&enablejsapi=1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube-nocookie.com
:scheme: https
:path: /embed/nCVaZVfnkTY?&list=PLL1eIqHwwN-MY4WwZvjNYcqo02CbtoB7J&autohide=2&color=red&controls=1&disablekb=0&fs=1&iv_load_policy=1&modestbranding=0&rel=0&showinfo=0&theme=dark&vq=default&enablejsapi=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

status: 200
cache-control: no-cache
content-length: 10761
expires: Tue, 27 Apr 1971 19:44:06 GMT
strict-transport-security: max-age=31536000
content-type: text/html; charset=utf-8
content-encoding: br
x-content-type-options: nosniff
date: Fri, 25 Sep 2020 15:18:47 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 sidebar_divider.jpg
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/ 154 B
473 B 20ms
19ms Image
image/webp 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/sidebar_divider.jpg
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 25b786ec50525130cddd67183bc696608e1fc88651fe5d1d953667e9f4643c4d

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:47 GMT
cf-cache-status: HIT
age: 2392
cf-polished: qual=85, origFmt=jpeg, origSize=1779
status: 200
content-disposition: inline; filename="sidebar_divider.webp"
content-length: 154
cf-request-id: 0567717ca8000097e4520b3200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: "5f034ecc-6f3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85b8410d7297e4-FRA
cf-bgj: imgq:85,h2pri

GET
DATA 200
OK truncated
/ 529 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8ecf7fe958f132008eb2eaeda1a079451a62372838a6c18d9e1353f64e48172a

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 558 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 93b94b74b73c37bcb3e6d8cada57b5ce45d7bd3fe5e3b2b6194a702d1353e1a0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 978 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 62d2cc93ab8f52afb7379b9fabdc6f383f7700367cda04191ad1a8158c449c23

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 746 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 114773206c8b1ef17f1865f1fd0acb5ee36aa4f666718144698063fd295a0f65

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 124d5d7d1a1e13e129ad8ffbba218f6fd857f706d9af89d05d2686a0627ce127

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3-Q050 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 13 KB
13 KB 42ms
24ms Font
font/woff2 2a00:1450:4001:81b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:200,400,700,200italic,400italic,700italic

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

487f2e9da2ff0740755a5ef01dc15a2888b89537795895203a831b13b199d8bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.intego.com
Referer: https://fonts.googleapis.com/css?family=Source+Sans+Pro:200,400,700,200italic,400italic,700italic
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 18:27:27 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:11 GMT
server: sffe
age: 247880
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12976
x-xss-protection: 0
expires: Wed, 22 Sep 2021 18:27:27 GMT

GET
H3-Q050 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 13 KB
13 KB 42ms
24ms Font
font/woff2 2a00:1450:4001:81b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:200,400,700,200italic,400italic,700italic

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ecf76895be1cf9e8b3edb254030e9c9c1d8f3c2efc1f9dc7e04ceff29eccae9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.intego.com
Referer: https://fonts.googleapis.com/css?family=Source+Sans+Pro:200,400,700,200italic,400italic,700italic
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 18:24:39 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:14 GMT
server: sffe
age: 248048
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13324
x-xss-protection: 0
expires: Wed, 22 Sep 2021 18:24:39 GMT

GET
H2 400 / Show response
graph.facebook.com/ 202 B
586 B 4442ms
4418ms XHR
application/json 2a03:2880:f02d:e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?id=https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

91080af66784a2e01039ce6d96482e2ee1c4435e4f44491ec96948a112f54283

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
www-authenticate: OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
status: 400
x-fb-rev: 1002724411
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 151
pragma: no-cache
x-fb-debug: 6rJK9c/Yq1vQa+fJwRQOrlUwpmuKX+FB+nrGHgsK0afuXuJIid7mmbCr7QGT7QTdsZwA9J1tWSwUrj9mycxx8A==
x-fb-trace-id: HBh7MSJiDzB
date: Fri, 25 Sep 2020 15:18:52 GMT
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-fb-request-id: AdkSHo1Dp0T5EtvjBZyTFLD
cache-control: no-store
facebook-api-version: v3.1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 404 share
www.linkedin.com/countserv/count/ 0
0 266ms
264ms Script
text/html 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.linkedin.com/countserv/count/share?url=https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/&callback=jQuery11240756576729365116_1601047126235&_=1601047126236
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 count.json Show response
widgets.pinterest.com/v1/urls/ 153 B
376 B 418ms
91ms Script
application/javascript 151.101.36.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://widgets.pinterest.com/v1/urls/count.json?source=6&url=https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/&callback=jQuery11240756576729365116_1601047126237&_=1601047126238

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.36.84 Amsterdam, Netherlands, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

eac868d5fecdb7cc71ff2864391c82842088e55a7a70b8f6ff5206ef7c7618c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 0
status: 200
vary: accept-encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: must-revalidate, max-age=887
x-envoy-upstream-service-time: 0
accept-ranges: none
x-pinterest-rid: 5958595162300482
expires: Fri, 25 Sep 2020 15:33:48 GMT

GET
H/1.1 200
OK count.js Show response
macsecurityblog.disqus.com/ 1 KB
1 KB 254ms
79ms Script
application/javascript 151.101.112.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://macsecurityblog.disqus.com/count.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.17

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 15:18:47 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Age: 1013688
P3P: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 871
X-XSS-Protection: 1; mode=block
Last-Modified: Mon, 24 Aug 2020 22:36:24 GMT
Server: nginx
ETag: "5f4440e8-367"
Strict-Transport-Security: max-age=300; includeSubdomains
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=300
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect

GET
H/1.1 200
OK embed.js Show response
macsecurityblog.disqus.com/ 71 KB
23 KB 254ms
80ms Script
application/javascript 151.101.112.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://macsecurityblog.disqus.com/embed.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.17

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

38497b0d65727db13d0658eb04d053c42b367565ff7bb8b2469389f0cafdcf6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 15:18:47 GMT
Content-Encoding: gzip
Server: openresty
Age: 68
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Cache-Control: private, max-age=60
X-Service: router
Strict-Transport-Security: max-age=300; includeSubdomains
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 23081

GET
H3-Q050 200 www-widgetapi.js Show response
s.ytimg.com/yts/jsbin/www-widgetapi-vfllbqYNH/ 94 KB
34 KB 160ms
83ms Script
text/javascript 2a00:1450:4001:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s.ytimg.com/yts/jsbin/www-widgetapi-vfllbqYNH/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api?ver=5.4.2

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c91a37f448e0d90f9079566ec4114aac6a37bb32ff0fc1c28d47c6b31646d87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 21:01:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65850
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34491
x-xss-protection: 0
last-modified: Thu, 24 Sep 2020 19:01:52 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=691200
accept-ranges: bytes
timing-allow-origin: https://www.youtube.com
expires: Fri, 02 Oct 2020 21:01:17 GMT

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.hc3rLxj9u8o.O/m=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCMtAagp6kGxB19Nep_bTJunj37kww/ 116 KB
41 KB 299ms
0ms Script
text/javascript 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.hc3rLxj9u8o.O/m=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCMtAagp6kGxB19Nep_bTJunj37kww/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/platform.js?ver=5.4.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b8e8b6c26d7b34cc48b04df5633f14745f22c06826c70ac7e5f3a226bfcb869

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 11:23:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 02 Aug 2020 22:35:54 GMT
server: sffe
age: 359717
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41995
x-xss-protection: 0
expires: Tue, 21 Sep 2021 11:23:31 GMT

GET
H2 200 cb=gapi.loaded_1 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.hc3rLxj9u8o.O/m=auth/exm=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCMtAagp6kGxB19Nep_bTJunj37kww/ 119 KB
40 KB 313ms
19ms Script
text/javascript 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.hc3rLxj9u8o.O/m=auth/exm=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCMtAagp6kGxB19Nep_bTJunj37kww/cb=gapi.loaded_1

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/platform.js?ver=5.4.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

521ceb171869c1862404b31bd4768200aa4c5a1cb53ab27bb8e9d4e08a424a32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 11:12:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 02 Aug 2020 22:35:54 GMT
server: sffe
age: 360370
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41259
x-xss-protection: 0
expires: Tue, 21 Sep 2021 11:12:38 GMT

GET
H2 200 subscribe_embed
www.youtube.com/ Frame D3F9 0
0 212ms
51ms Document
text/html 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/subscribe_embed?usegapi=1&channel=IntegoVideo&layout=default&count=default&theme=default&origin=https%3A%2F%2Fwww.intego.com&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.hc3rLxj9u8o.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCMtAagp6kGxB19Nep_bTJunj37kww%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/platform.js?ver=5.4.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /subscribe_embed?usegapi=1&channel=IntegoVideo&layout=default&count=default&theme=default&origin=https%3A%2F%2Fwww.intego.com&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.hc3rLxj9u8o.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCMtAagp6kGxB19Nep_bTJunj37kww%2Fm%3D__features__
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

status: 200
strict-transport-security: max-age=31536000
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
expires: Tue, 27 Apr 1971 19:44:06 GMT
x-content-type-options: nosniff
content-length: 1637
content-encoding: br
cache-control: no-cache
content-type: text/html; charset=utf-8
date: Fri, 25 Sep 2020 15:18:48 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: GPS=1; path=/; domain=.youtube.com; expires=Fri, 25-Sep-2020 15:48:48 GMT YSC=rzXSL2SVGE4; path=/; domain=.youtube.com; secure; httponly; samesite=None VISITOR_INFO1_LIVE=EbesaYBRGKw; path=/; domain=.youtube.com; secure; expires=Wed, 24-Mar-2021 15:18:48 GMT; httponly; samesite=None
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 167ms
24ms Script
application/x-javascript 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:48 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: FBAF69B7861DE212
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=63169
accept-ranges: bytes
content-length: 948
x-amz-id-2: mINJDBnKUfP83RzDJ6hQaYSGPvMPOM770jd+gXVSD8LFScfPdVPaVzI4W2IwmrtEKhDna93Nv9A=

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 201 KB
61 KB 61ms
18ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=4dbdfce6c3edf8c2d6f5568db1643bc3&ua=modern_es6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

a374e4a800bf1c52c2f548b954aca207cd7424b16fd3ab37493e57de0351ee08

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Origin: https://www.intego.com
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: sIm3kX8taen9Tp7TYie8Gg==
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 62354
etag: "a9f8328cc12f976a5af4422b7b25e24d"
x-fb-debug: hHY3pt/JTj4p7Hz+YRlIqGyqXwfYnZ+b3HTihsDx87B8MTrUwv1mkiMHJykBgvtVco3z/BMDZVtMtXT56yGK3w==
x-fb-trip-id: 1460883810
x-fb-content-md5: 46aea296a97517c482e7249960e77173
x-frame-options: DENY
date: Fri, 25 Sep 2020 15:18:48 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
expires: Sat, 25 Sep 2021 14:24:40 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
115 B 34ms
28ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A8.6.1&blog=72832157&post=92058&tz=-7&srv=www.intego.com&host=www.intego.com&ref=https%3A%2F%2Ft.co%2FusI1BDDzZc&fcp=2514&rand=0.1294790925355862
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Fri, 25 Sep 2020 15:18:48 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 overlay-virus-dude.png
www.intego.com/sites/all/themes/ubertheme/images/bundles/ 6 KB
7 KB 16ms
15ms Image
image/webp 2606:4700::6812:c77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/sites/all/themes/ubertheme/images/bundles/overlay-virus-dude.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:c77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

033cde881de209390d39c3f291aa9cc39c412c29fd794af7277830b34da8785a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:18:48 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 3149
cf-polished: origFmt=png, origSize=11045
status: 200
content-disposition: inline; filename="overlay-virus-dude.webp"
content-length: 6504
cf-request-id: 05677181ed000097e45213a200000001
last-modified: Thu, 24 Sep 2020 15:06:21 GMT
server: cloudflare
etag: "e58d48-2b25-5b0108af79540"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Sat, 24 Oct 2020 15:19:13 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5d85b8497b5997e4-FRA
cf-bgj: imgq:85,h2pri

GET
H3-Q050 200 iframe_api Show response
www.youtube.com/ 859 B
899 B 33ms
31ms Script
application/javascript 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

bb419846a6c750ceac7e697b479216945b7597dea49905e30d1fc040a3194099

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:48 GMT
x-content-type-options: nosniff
server: YouTube Frontend Proxy
content-type: application/javascript
status: 200
cache-control: no-cache
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Tue, 27 Apr 1971 19:44:06 GMT

GET
H2 200 widget_iframe.2d7d9a6d04538bf11c7b23641e75738c.html
platform.twitter.com/widgets/ Frame 01A1 0
0 32ms
26ms Document
text/html 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2d7d9a6d04538bf11c7b23641e75738c.html?origin=https%3A%2F%2Fwww.intego.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: platform.twitter.com
:scheme: https
:path: /widgets/widget_iframe.2d7d9a6d04538bf11c7b23641e75738c.html?origin=https%3A%2F%2Fwww.intego.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

status: 200
last-modified: Tue, 01 Sep 2020 17:58:17 GMT
cache-control: public, max-age=315360000
content-type: text/html; charset=utf-8
etag: "9fa476ae827f556d5b037fe43632370d+gzip"
content-encoding: gzip
access-control-allow-methods: GET
access-control-allow-origin: *
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
accept-ranges: bytes
date: Fri, 25 Sep 2020 15:18:48 GMT
x-served-by: cache-bwi5127-BWI, cache-fra19146-FRA
x-cache: HIT, HIT
vary: Accept-Encoding
tw-cdn: FT
content-length: 5825

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/ra-569401e58e179871/ 771 B
520 B 577ms
575ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/ra-569401e58e179871/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 301bec0edd5575e96ea21fd09c50c5964ee72d565a65fd7d8db6020d64c05cd3

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:49 GMT
content-encoding: gzip
etag: 749965747--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
cache-control: public, max-age=55, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 344

GET
H2 200 300lo.json Show response
m.addthis.com/live/red_lojson/ 90 B
250 B 239ms
186ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://m.addthis.com/live/red_lojson/300lo.json?si=5f6e0a58acee43bc&bkl=0&bl=0&pdt=236&sid=5f6e0a58acee43bc&pub=ra-569401e58e179871&rev=v8.28.7-wp&ln=en&pc=men&cb=0&ab=-&dp=www.intego.com&dr=t.co&fp=mac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&fr=usI1BDDzZc&of=0&pd=0&irt=0&vcl=0&md=0&ct=0&tct=0&abt=0&cdn=0&pi=1&rb=4&gen=100&chr=UTF-8&colc=1601047128628&jsl=8321&skipb=1&callback=addthis.cbs.jsonp__147894163978216750
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 3810d28e63ef9ded2c013f6c826fdf2cefe98a590e656f36fe38597a5eb83c40

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Fri, 25 Sep 2020 15:18:48 GMT
cache-control: max-age=0, no-cache, no-store, no-transform
content-disposition: attachment; filename=1.txt
content-length: 90
content-type: application/javascript;charset=utf-8

GET sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 3268 0
0

GET
H2 200 sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 781A 0
0 46ms
41ms Document
text/html 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:method: GET
:authority: s7.addthis.com
:scheme: https
:path: /static/sh.f48a1a04fe8dbf021b4cda1d.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

status: 200
server: nginx/1.15.8
content-type: text/html
last-modified: Mon, 09 Sep 2019 15:34:57 GMT
etag: W/"5d767121-1115f"
timing-allow-origin: *
cache-control: public, max-age=86313600
p3p: CP="NON ADM OUR DEV IND COM STA"
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
content-length: 25412
date: Fri, 25 Sep 2020 15:18:49 GMT
vary: Accept-Encoding
x-host: s7.addthis.com

GET
H2 200 1f641.svg
s.w.org/images/core/emoji/12.0.0-1/svg/ 512 B
514 B 95ms
30ms Image
image/svg+xml 192.0.77.48
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/12.0.0-1/svg/1f641.svg

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

87bcc22d43cfa00bd1cf5e3a35aad79150b4ce804899db3ea93efe57eeb6dbf7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 1
date: Fri, 25 Sep 2020 15:18:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 08 Apr 2019 05:13:21 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1f643.svg
s.w.org/images/core/emoji/12.0.0-1/svg/ 538 B
368 B 93ms
30ms Image
image/svg+xml 192.0.77.48
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/12.0.0-1/svg/1f643.svg

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

61043862bfca6af330c3434cbf67360d72e2b11192f86b69321fe68f216c70f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 1
date: Fri, 25 Sep 2020 15:18:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 06 Nov 2019 15:22:34 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1f514.svg
s.w.org/images/core/emoji/12.0.0-1/svg/ 314 B
353 B 92ms
31ms Image
image/svg+xml 192.0.77.48
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/12.0.0-1/svg/1f514.svg

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

5f70fb8150f0a1f184b40f86d012db040d229056b9b0d8c681f08987cb124e5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 1
date: Fri, 25 Sep 2020 15:18:48 GMT
x-content-type-options: nosniff
last-modified: Mon, 08 Apr 2019 05:13:21 GMT
server: nginx
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 314
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 29 KB
11 KB 41ms
40ms Script
text/javascript 216.58.206.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-9WJ8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s20-in-f2.1e100.net

Software

cafe /

Resource Hash

2d25f06ba5a1e228262948c457155e24a1d91bfb5dad460bd1dcfe2106011f20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 11315
x-xss-protection: 0
server: cafe
etag: 17904044164015545428
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 25 Sep 2020 15:18:48 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-9WJ8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 2707
date: Fri, 25 Sep 2020 14:33:41 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Fri, 25 Sep 2020 16:33:41 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 26 KB
8 KB 64ms
31ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: t.co
URL: https://t.co/usI1BDDzZc
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 5c622f5433cbb6ea1df5c0dd8671e55ef7d1464366074730473c453de50a579b

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:48 GMT
content-encoding: gzip
last-modified: Thu, 16 Jul 2020 20:00:00 GMT
x-msedge-ref: Ref A: DDC188AD82D04C558C95B6F378F84ED0 Ref B: FRAEDGE1216 Ref C: 2020-09-25T15:18:48Z
status: 200
etag: "0e0bdafab5bd61:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 8022

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 135 KB
34 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: t.co
URL: https://t.co/usI1BDDzZc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

097afea517679d2e0b986d77cb3fe7808026882b52ca074a050e03e7a4a6996b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 34302
x-xss-protection: 0
pragma: public
x-fb-debug: JVvsolk9WxYKFTCis8J992Phg3hBOr/n6oJii+p8cYUkbZ8N6P5zrZTx8iQa6E2y+aYy+afsiEsN0b3mz0e57w==
x-fb-trip-id: 1460883810
date: Fri, 25 Sep 2020 15:18:48 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 aquant.js Show response
secure.quantserve.com/ 22 KB
8 KB 12ms
9ms Script
application/javascript 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/aquant.js?a=p-NVNd7-g373ynZ
Requested by: Host: t.co
URL: https://t.co/usI1BDDzZc
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 403bfa21e733c139da9d7d87c48fa0ebbed91514fbbadf34cbc455294a004389

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:48 GMT
content-encoding: gzip
etag: "M/QWkfLVS4vR+GrkCudkBg=="
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Fri, 02 Oct 2020 15:18:48 GMT

GET
H2 200 conversion.js Show response
s.yimg.jp/images/listing/tool/cv/ 6 KB
3 KB 819ms
275ms Script
application/javascript 182.22.24.252
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.yimg.jp/images/listing/tool/cv/conversion.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-9WJ8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 182.22.24.252 Tokyo, Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: 593718d567cc4d6767d63be77ac6505dedee76cc656526945c90f9e1869cbc53

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Fri, 25 Sep 2020 15:16:16 GMT
content-encoding: gzip
last-modified: Sun, 19 Jul 2020 22:59:48 GMT
server: ATS
age: 153
vary: Accept-Encoding
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
status: 200
cache-control: public, max-age=600
accept-ranges: bytes
content-type: application/javascript
content-length: 2041
via: http/1.1 edge1344.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge1367.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge1347.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ])
expires: Fri, 25 Sep 2020 15:26:16 GMT

GET
H2 200 FollowCompany.js Show response
www.linkedin.com/pages-extensions/ 1 KB
2 KB 205ms
198ms Script
application/javascript 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.linkedin.com/pages-extensions/FollowCompany.js?version=0.1.149

Requested by

Host: platform.linkedin.com
URL: https://platform.linkedin.com/in.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

275fb4a7bdeab3c59caff1c0ea88bf1adc9f4cfc377a9bec7b28517d13e2fd37

Security Headers

Name	Value
Content-Security-Policy	default-src ; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://.linkedin.com dms.licdn.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: ; font-src data: ; child-src blob: ; style-src 'unsafe-inline' 'self' static-src.linkedin.com .licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com .ads.linkedin.com .licdn.com www.google-analytics.com platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; report-uri https://www.linkedin.com/platform-telemetry/csp?f=nf
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; child-src blob: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com www.google-analytics.com platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; report-uri https://www.linkedin.com/platform-telemetry/csp?f=nf
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'none'; connect-src 'self' www.linkedin.com www.google-analytics.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://linkedin.sc.omtrdc.net/b/ss/ static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; script-src 'sha256-THuVhwbXPeTR0HszASqMOnIyxqEgvGyBwSPBKBF/iMc=' 'sha256-PyCXNcEkzRWqbiNr087fizmiBBrq9O6GGD8eV3P09Ik=' 'sha256-2SQ55Erm3CPCb+k03EpNxU9bdV3XL9TnVTriDs7INZ4=' 'sha256-S/KSPe186K/1B0JEjbIXcCdpB97krdzX05S+dHnQjUs=' platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'self' 'unsafe-inline' static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; media-src dms.licdn.com; child-src blob: *; frame-src 'self' lnkd.demdex.net linkedin.cdn.qualaroo.com; manifest-src 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=g
status: 200
vary: Accept-Encoding
content-length: 487
x-li-uuid: /e6gk+EPOBbgeTKVhisAAA==
pragma: no-cache
last-modified: Fri, 01 Feb 1980 00:00:00 GMT
x-li-pop: afd-prod-esv5
x-msedge-ref: Ref A: B4C4CCA180A64766873B1FAAF4ECCB3B Ref B: FRAEDGE1111 Ref C: 2020-09-25T15:18:48Z
date: Fri, 25 Sep 2020 15:18:48 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
content-type: application/javascript; charset=utf-8
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
etag: "aeca3562e6a808680067cc4146054104b5dba8fd"
accept-ranges: bytes
x-li-proto: http/2
x-li-fabric: prod-lor1
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 lounge.6525595c7a9874fa10bd041275e40f17.css
c.disquscdn.com/next/embed/styles/ 0
22 KB 160ms
11ms Other
text/css 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.6525595c7a9874fa10bd041275e40f17.css

Requested by

Host: macsecurityblog.disqus.com
URL: https://macsecurityblog.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5692644
status: 200
strict-transport-security: max-age=300; includeSubdomains
content-length: 22092
x-xss-protection: 1; mode=block
timing-allow-origin: *
last-modified: Mon, 20 Jul 2020 23:36:39 GMT
server: cloudflare
etag: "5f162a87-564c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
cf-request-id: 05677185f20000062114b31200000001
accept-ranges: bytes
cf-ray: 5d85b84fed1d0621-FRA
expires: Wed, 21 Jul 2021 18:01:24 GMT

GET
H2 200 common.bundle.e07f4f02bedd02259fb3f3e092970560.js
c.disquscdn.com/next/embed/ 0
88 KB 44ms
12ms Other
application/javascript 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.e07f4f02bedd02259fb3f3e092970560.js

Requested by

Host: macsecurityblog.disqus.com
URL: https://macsecurityblog.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2285911
status: 200
strict-transport-security: max-age=300; includeSubdomains
content-length: 89940
x-xss-protection: 1; mode=block
timing-allow-origin: *
last-modified: Sun, 30 Aug 2020 04:13:44 GMT
server: cloudflare
etag: "5f4b2778-15f54"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
cf-request-id: 05677185f50000062114b33200000001
accept-ranges: bytes
cf-ray: 5d85b84fed220621-FRA
expires: Mon, 30 Aug 2021 04:20:17 GMT

GET
H2 200 lounge.bundle.fce6c302b518ce1fcbc2efc174b77740.js
c.disquscdn.com/next/embed/ 0
113 KB 64ms
33ms Other
application/javascript 2606:4700::6812:a813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.fce6c302b518ce1fcbc2efc174b77740.js

Requested by

Host: macsecurityblog.disqus.com
URL: https://macsecurityblog.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 234220
status: 200
strict-transport-security: max-age=300; includeSubdomains
content-length: 115595
x-xss-protection: 1; mode=block
timing-allow-origin: *
last-modified: Tue, 22 Sep 2020 19:35:14 GMT
server: cloudflare
etag: "5f6a51f2-1c38b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
cf-request-id: 05677185f50000062114b34200000001
accept-ranges: bytes
cf-ray: 5d85b84fed240621-FRA
expires: Wed, 22 Sep 2021 22:15:04 GMT

GET
H/1.1 200
OK config.js
disqus.com/next/ 0
8 KB 164ms
36ms Other
application/javascript 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: macsecurityblog.disqus.com
URL: https://macsecurityblog.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 15:18:49 GMT
X-Content-Type-Options: nosniff
Content-Type: application/javascript; charset=UTF-8
Server: nginx
Age: 48
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 7253
X-XSS-Protection: 1; mode=block

GET
H2 200 postmessageRelay
accounts.google.com/o/oauth2/ Frame 1498 0
0 103ms
101ms Document
text/html 2a00:1450:4001:821::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.intego.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.hc3rLxj9u8o.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCMtAagp6kGxB19Nep_bTJunj37kww%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.hc3rLxj9u8o.O/m=auth/exm=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCMtAagp6kGxB19Nep_bTJunj37kww/cb=gapi.loaded_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-gJjfClWkQqbUnPLZuJz4Bg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Xss-Protection	0

Request headers

:method: GET
:authority: accounts.google.com
:scheme: https
:path: /o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.intego.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.hc3rLxj9u8o.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCMtAagp6kGxB19Nep_bTJunj37kww%2Fm%3D__features__
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: NID=204=mMOrLNb1HS2YvyFsVwLuY8IxBtWWXXLrKgPNhhyAx_6ieMfN4AmONi0ahT21uLcsN-xCljALctfeuj26zncgtS6rPiFLbqkjrmAXC1mUXE0l4szh_2AyrJpTtSIqqzhYbt1nmr9EXi3vZiVa-0bOCF-K3gLkKWwio8VPIHMu4v8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 25 Sep 2020 15:18:49 GMT
content-security-policy: script-src 'report-sample' 'nonce-gJjfClWkQqbUnPLZuJz4Bg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
content-encoding: gzip
server: ESF
x-xss-protection: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK /
disqus.com/embed/comments/ Frame A470 0
0 358ms
218ms Document
text/html 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/embed/comments/?base=default&f=macsecurityblog&t_i=92058%20https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2F%3Fp%3D92058&t_u=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&t_e=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat&t_d=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog&t_t=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat&s_o=default

Requested by

Host: macsecurityblog.disqus.com
URL: https://macsecurityblog.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: disqus.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

Connection: keep-alive
Content-Length: 2729
Server: nginx
Content-Type: text/html; charset=utf-8
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Last-Modified: Mon, 24 Aug 2020 21:03:33 GMT
ETag: W/"lounge:view:8177074350.c6b2bb256626c47047c035c0e8ec5d6f.2"
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control: stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Encoding: gzip
Date: Fri, 25 Sep 2020 15:18:49 GMT
Age: 0
Vary: Accept-Encoding
Strict-Transport-Security: max-age=300; includeSubdomains

GET
H2 200 layers.33f5b85045a5f2308467.js Show response
s7.addthis.com/static/ 263 KB
76 KB 46ms
45ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.33f5b85045a5f2308467.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

137e41c449677deb7c8da3afde63fc781b095bb028f78b789be44192e8e3f4be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
server: nginx/1.15.8
etag: W/"5ed917ff-41b9f"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86313600
date: Fri, 25 Sep 2020 15:18:49 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77540

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1060047950/ 3 KB
1 KB 54ms
51ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1060047950/?random=1601047129453&cv=9&fst=1601047129453&num=1&label=6cqzCOKomwIQzpi8-QM&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&ref=https%3A%2F%2Ft.co%2FusI1BDDzZc&tiba=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e792a27da441fdb78a5a362164f95b59d19c3f2ba818641bf5937bbdadea686c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 15:18:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1143
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
148 B 42ms
31ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=4033358&Ver=2&mid=d513da30-ef0a-17d5-3ed0-21b6dd536e43&sid=1d59061988d4331ea94e3215fd3d5b0b&vid=ab937a4efdc9e8a6c00b6f0217281db7&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Mac%20malware%20exposed%3A%20XCSSET,%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog&p=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&r=https%3A%2F%2Ft.co%2FusI1BDDzZc&lt=4826&evt=pageLoad&msclkid=N&sv=1&rn=449074
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Fri, 25 Sep 2020 15:18:48 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: CF18A549311C495B904F1FC7EF87E0FE Ref B: FRAEDGE1216 Ref C: 2020-09-25T15:18:49Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-NVNd7-g373ynZ.js Show response
rules.quantcount.com/ 728 B
1 KB 77ms
21ms Script
application/x-javascript 2600:9000:206e:f800:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-NVNd7-g373ynZ.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/aquant.js?a=p-NVNd7-g373ynZ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:f800:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c73d6c78c4bb48a6815c7ddd5bc944b047754369d4043ccb6ab2fde88f42add4

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:01:27 GMT
via: 1.1 7c17b3af9cda4d5f0ff45961b7be9fdc.cloudfront.net (CloudFront)
last-modified: Mon, 10 Apr 2017 23:48:01 GMT
server: AmazonS3
age: 1043
etag: "51657b8ebdb4c9107bbbc84946bfb9b5"
x-cache: Hit from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
content-length: 728
x-amz-cf-id: MCYWXsG4MXFympJH7q3rVqhq_tcktZg_B3vnYGmHt9YT0H7QVk9jJw==

GET
H3-Q050 200 ec.js Show response
www.google-analytics.com/plugins/ua/ 3 KB
1 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ec.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 14:55:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 1384
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1306
x-xss-protection: 0
expires: Fri, 25 Sep 2020 15:55:45 GMT

GET
H2 200 1722534091368523 Show response
connect.facebook.net/signals/config/ 524 KB
133 KB 79ms
78ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1722534091368523?v=2.9.24&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3eab02e002142b491bfeaaea2ee12490872bc5429dfb0889914660c783194563

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: EI9t8fW72WFIC9M1IYrJb8cnrduWRUa+qG9y8KeYQ5G6UrKG1dP42KZzea383kQCgmUMXP+OpqoWscgXJJcTOw==
x-fb-trip-id: 1460883810
x-frame-options: DENY
date: Fri, 25 Sep 2020 15:18:49 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 button.e24f3bcdec527b80b9c80e88b62047c3.js Show response
platform.twitter.com/js/ 7 KB
2 KB 124ms
123ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.e24f3bcdec527b80b9c80e88b62047c3.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: da3e524928bcca821af2551eb6f9e9ae2449ceb48642cce4f2dae23383098537

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:49 GMT
content-encoding: gzip
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 2295
x-served-by: cache-bwi5140-BWI, cache-fra19146-FRA
last-modified: Tue, 01 Sep 2020 17:58:08 GMT
etag: "2288bbd5e30b6dba457d3d615de9e136+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
accept-ranges: bytes
tw-cdn: FT

GET
H2 200 horizon_tweet.890a062bcacdb49527deac08bf9879da.js Show response
platform.twitter.com/js/ 6 KB
2 KB 124ms
124ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/horizon_tweet.890a062bcacdb49527deac08bf9879da.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 23b775e4e3b5b93742dad8a1bbfacb2ffc3271a15dbfc6d3ded21d713f2c3489

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:49 GMT
content-encoding: gzip
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 2197
x-served-by: cache-bwi5140-BWI, cache-fra19146-FRA
last-modified: Tue, 01 Sep 2020 17:58:08 GMT
etag: "8069bf9882ddc98f8144708faf345f30+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
accept-ranges: bytes
tw-cdn: FT

GET FollowCompany
www.linkedin.com/pages-extensions/ Frame FBAC 0
0

GET
H2 200 FollowCompany
www.linkedin.com/pages-extensions/ Frame 6422 0
0 216ms
210ms Document
text/html 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.linkedin.com/pages-extensions/FollowCompany?id=28855&counter=none&xdOrigin=https%3A%2F%2Fwww.intego.com&xdChannel=668ce378-72a1-4f0d-9953-e86bd99bfc00&xd_origin_host=https%3A%2F%2Fwww.intego.com

Requested by

Host: platform.linkedin.com
URL: https://platform.linkedin.com/in.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src ; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://.linkedin.com dms.licdn.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: ; font-src data: ; child-src blob: ; style-src 'unsafe-inline' 'self' static-src.linkedin.com .licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com .ads.linkedin.com .licdn.com www.google-analytics.com platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; report-uri https://www.linkedin.com/platform-telemetry/csp?f=nf
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.linkedin.com
:scheme: https
:path: /pages-extensions/FollowCompany?id=28855&counter=none&xdOrigin=https%3A%2F%2Fwww.intego.com&xdChannel=668ce378-72a1-4f0d-9953-e86bd99bfc00&xd_origin_host=https%3A%2F%2Fwww.intego.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

status: 200
cache-control: no-cache, no-store
pragma: no-cache
content-length: 818
content-type: text/html
content-encoding: gzip
expires: Thu, 01 Jan 1970 00:00:00 GMT
vary: Accept-Encoding
set-cookie: JSESSIONID=ajax:0693393777264190266; SameSite=None; Path=/; Domain=.www.linkedin.com; Secure lang=v=2&lang=en-us; SameSite=None; Path=/; Domain=linkedin.com; Secure bcookie="v=2&bb40028d-eef8-4ade-8889-ccbf33bea629"; domain=.linkedin.com; Path=/; Secure; Expires=Mon, 26-Sep-2022 02:56:22 GMT; SameSite=None bscookie="v=1&20200925151850911f766c-f693-4a66-8381-bfce7b22002aAQFhbvh3uMbtBKjTmjUQBrXc3MWno8vE"; domain=.www.linkedin.com; Path=/; Secure; Expires=Mon, 26-Sep-2022 02:56:22 GMT; HttpOnly; SameSite=None lissc=1; domain=.linkedin.com; Path=/; Secure; Expires=Sat, 25-Sep-2021 15:18:50 GMT; SameSite=None lidc="b=OGST06:g=1901:u=1:i=1601047130:t=1601133530:s=AQFABCth09d0JSCiFH3aArCH5T-2ynhi"; Expires=Sat, 26 Sep 2020 15:18:50 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-xss-protection: 1; mode=block
content-security-policy-report-only: default-src 'none'; connect-src 'self' www.linkedin.com www.google-analytics.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://linkedin.sc.omtrdc.net/b/ss/ static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; script-src 'sha256-THuVhwbXPeTR0HszASqMOnIyxqEgvGyBwSPBKBF/iMc=' 'sha256-PyCXNcEkzRWqbiNr087fizmiBBrq9O6GGD8eV3P09Ik=' 'sha256-2SQ55Erm3CPCb+k03EpNxU9bdV3XL9TnVTriDs7INZ4=' 'sha256-S/KSPe186K/1B0JEjbIXcCdpB97krdzX05S+dHnQjUs=' platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'self' 'unsafe-inline' static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; media-src dms.licdn.com; child-src blob: *; frame-src 'self' lnkd.demdex.net linkedin.cdn.qualaroo.com; manifest-src 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=g
content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; child-src blob: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com www.google-analytics.com platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; report-uri https://www.linkedin.com/platform-telemetry/csp?f=nf
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-li-fabric: prod-lor1
x-li-pop: afd-prod-esv5
x-li-proto: http/2
x-li-uuid: zYhS6OEPOBawFUpM7ioAAA==
x-msedge-ref: Ref A: 4F13EA9CFD764D4DBEFBE8709C4D6597 Ref B: FRAEDGE1111 Ref C: 2020-09-25T15:18:50Z
date: Fri, 25 Sep 2020 15:18:49 GMT

GET
H2 200 pixel;r=1975653052;labels=_fp.event.Default;rf=0;a=p-NVNd7-g373ynZ;url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F;ref=https%3A%2F%2Ft.co...
pixel.quantserve.com/ 35 B
370 B 25ms
22ms Image
image/gif 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1975653052;labels=_fp.event.Default;rf=0;a=p-NVNd7-g373ynZ;url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F;ref=https%3A%2F%2Ft.co%2FusI1BDDzZc;fpan=1;fpa=P0-1109666615-1601047130011;ns=0;ce=1;qjs=1;qv=4f9b77f5-20200917130726;cm=;gdpr=0;d=intego.com;je=0;sr=1600x1200x24;enc=n;dst=1;et=1601047130011;tzo=-120;ogl=locale.en_US%2Ctype.article%2Ctitle.Mac%20malware%20exposed%3A%20XCSSET%252C%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog%2Cdescription.Intego%20has%20been%20deeply%20investigating%20XCSSET%252C%20an%20intriguing%20new%20Mac%20malware%20speci%2Curl.https%3A%2F%2Fwww%252Eintego%252Ecom%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-%2Csite_name.The%20Mac%20Security%20Blog%2Cimage.https%3A%2F%2Fwww%252Eintego%252Ecom%2Fmac-security-blog%2Fwp-content%2Fuploads%2F2020%2F08%2FXcodeproj-in%2Cimage%3Awidth.400%2Cimage%3Aheight.260

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 15:18:50 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
status: 200
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/1060047950/ 42 B
109 B 22ms
21ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1060047950/?random=1601047129453&cv=9&fst=1601046000000&num=1&label=6cqzCOKomwIQzpi8-QM&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&frm=0&url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&ref=https%3A%2F%2Ft.co%2FusI1BDDzZc&tiba=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog&async=1&fmt=3&is_vtc=1&random=662989821&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 15:18:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/1060047950/ 42 B
107 B 21ms
20ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1060047950/?random=1601047129453&cv=9&fst=1601046000000&num=1&label=6cqzCOKomwIQzpi8-QM&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&frm=0&url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&ref=https%3A%2F%2Ft.co%2FusI1BDDzZc&tiba=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog&async=1&fmt=3&is_vtc=1&random=662989821&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 15:18:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
86 B 14ms
14ms XHR
text/plain 2a00:1450:400c:c0c::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-1724183-7&cid=533712204.1601047130&jid=81743974&gjid=1608510258&_gid=911144077.1601047130&_u=aGBAgAALCAAAAE~&z=1908464213

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Fri, 25 Sep 2020 15:18:50 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://www.intego.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
131 B 6ms
6ms Image
image/gif 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&a=131620701&t=pageview&_s=1&dl=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&dr=https%3A%2F%2Ft.co%2FusI1BDDzZc&ul=en-us&de=UTF-8&dt=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAgAALC~&jid=81743974&gjid=1608510258&cid=533712204.1601047130&tid=UA-1724183-7&_gid=911144077.1601047130&gtm=2wg9g19WJ8&cg3=&cd3=!!!!&z=1275943266

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Sep 2020 20:29:28 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 67762
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK /
b91.yahoo.co.jp/pagead/conversion/1000324116/ 42 B
909 B 1166ms
323ms Image
image/gif 182.22.30.220
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b91.yahoo.co.jp/pagead/conversion/1000324116/?random=1601047130088&cv=9&fst=1601047130088&num=1&fmt=3&value=0&label=2ZHECN3Sq2oQi-v4oAM&guid=ON&disvt=true&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&ref=https%3A%2F%2Ft.co%2FusI1BDDzZc&tiba=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog&hn=www.googleadservices.com&async=1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

182.22.30.220 Tokyo, Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),

Reverse DNS

Software

ATS /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 25 Sep 2020 15:18:51 GMT
Via: http/1.1 mscedge1005.img.bbt.yahoo.co.jp (ApacheTrafficServer [c sSf ])
X-Content-Type-Options: nosniff
Server: ATS
Timing-Allow-Origin: *
Age: 0
P3P: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Cache-Control: no-cache, must-revalidate, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
X-XSS-Protection: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK /
b91.yahoo.co.jp/pagead/conversion/1000324116/ 42 B
909 B 1156ms
324ms Image
image/gif 182.22.30.220
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b91.yahoo.co.jp/pagead/conversion/1000324116/?random=1601047130101&cv=9&fst=1601047130101&num=1&fmt=3&value=1&label=yGd0CMDksGoQi-v4oAM&guid=ON&disvt=true&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&ref=https%3A%2F%2Ft.co%2FusI1BDDzZc&tiba=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog&hn=www.googleadservices.com&async=1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

182.22.30.220 Tokyo, Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),

Reverse DNS

Software

ATS /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 25 Sep 2020 15:18:51 GMT
Via: http/1.1 mscedge1001.img.bbt.yahoo.co.jp (ApacheTrafficServer [c sSf ])
X-Content-Type-Options: nosniff
Server: ATS
Timing-Allow-Origin: *
Age: 0
P3P: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Cache-Control: no-cache, must-revalidate, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
X-XSS-Protection: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 15 KB
6 KB 69ms
23ms Script
application/javascript 2a00:1288:f03d:1fa::2000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: t.co
URL: https://t.co/usI1BDDzZc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

63896532a7015ab5b7288359c02124980a5075e9267f0ba3fbfc7c3f5038b478

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Fri, 25 Sep 2020 14:42:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2163
x-amz-server-side-encryption: AES256
status: 200
vary: Origin, Accept-Encoding
content-length: 5581
x-amz-id-2: x+D3osR5SYywq2Ljp1yI/JO4KlOep3ri5CQTIBt8SGg4JCRvY09qeoKKKEXd79SFe002k4CT5Lw=
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Sat, 30 Oct 2021 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Thu, 24 Sep 2020 23:08:16 GMT
server: ATS
etag: "49db10c8315384e8dad2e92a6841ed81-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: E23E0E11442A4098
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
x-amz-version-id: swANRqp_TdPZf97XDKuCKoVnrp7c.h.0
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 /
www.facebook.com/tr/ 44 B
332 B 6ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1722534091368523&ev=PageView&dl=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&rl=https%3A%2F%2Ft.co%2FusI1BDDzZc&if=false&ts=1601047130416&sw=1600&sh=1200&v=2.9.24&r=stable&ec=0&o=30&fbp=fb.1.1601047130406.235486935&it=1601047129858&coo=false&rqm=GET

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:50 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Fri, 25 Sep 2020 15:18:50 GMT

GET
H3-Q050 200 cb=gapi.loaded_2 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.hc3rLxj9u8o.O/m=gapi_iframes_style_bubble/exm=auth,ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCMtAagp6kGxB19Nep_bTJunj37kww/ 27 KB
9 KB 12ms
6ms Script
text/javascript 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.hc3rLxj9u8o.O/m=gapi_iframes_style_bubble/exm=auth,ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCMtAagp6kGxB19Nep_bTJunj37kww/cb=gapi.loaded_2

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/platform.js?ver=5.4.2

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2ada70caed6a7e67d4c10a6de4c07c7863d48d6819c700c39d6b24234d9b4f0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 11:20:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 02 Aug 2020 22:35:54 GMT
server: sffe
age: 359921
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9263
x-xss-protection: 0
expires: Tue, 21 Sep 2021 11:20:09 GMT

GET
H3-Q050 200 ga-audiences
www.google.com/ads/ 42 B
273 B 34ms
29ms Image
image/gif 2a00:1450:4001:824::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-1724183-7&cid=533712204.1601047130&jid=81743974&_u=aGBAgAALCAAAAE~&z=1891811261

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 15:18:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ga-audiences
www.google.de/ads/ 42 B
491 B 58ms
36ms Image
image/gif 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-1724183-7&cid=533712204.1601047130&jid=81743974&_u=aGBAgAALCAAAAE~&z=1891811261

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 15:18:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 follow_button.2d7d9a6d04538bf11c7b23641e75738c.en.html
platform.twitter.com/widgets/ Frame 4601 0
0 46ms
44ms Document
text/html 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/follow_button.2d7d9a6d04538bf11c7b23641e75738c.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: platform.twitter.com
:scheme: https
:path: /widgets/follow_button.2d7d9a6d04538bf11c7b23641e75738c.en.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

status: 200
last-modified: Tue, 01 Sep 2020 17:58:09 GMT
cache-control: public, max-age=315360000
content-type: text/html; charset=utf-8
etag: "ddc15fa67e38644c860f8d9dba000a69+gzip"
content-encoding: gzip
access-control-allow-methods: GET
access-control-allow-origin: *
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
accept-ranges: bytes
date: Fri, 25 Sep 2020 15:18:50 GMT
x-served-by: cache-bwi5147-BWI, cache-fra19146-FRA
x-cache: HIT, HIT
vary: Accept-Encoding
tw-cdn: FT
content-length: 13677

GET
H2 200 10013026.json Show response
s.yimg.com/wi/config/ 2 B
459 B 58ms
22ms XHR
application/json 2a00:1288:f03d:1fa::2000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10013026.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:16:12 GMT
x-content-type-options: nosniff
age: 159
status: 200
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id: BN7S4HCP4VFQ5W2T
x-amz-id-2: Z95WhmsUSPKwK1Ir+Kfz/0nBHkrAxChfdZLKmYDA3dVY+hq1CsdaHx5P30DMxLe3/qGxvat0KJw=
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
content-length: 2

GET
H2 200 index.html
platform.twitter.com/embed/ Frame FED8 0
0 35ms
29ms Document
text/html 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/index.html?dnt=true&embedId=twitter-widget-1&frame=false&hideCard=false&hideThread=false&id=1282860187397746689&lang=en&origin=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&theme=light&widgetsVersion=219d021%3A1598982042171&width=500px
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: platform.twitter.com
:scheme: https
:path: /embed/index.html?dnt=true&embedId=twitter-widget-1&frame=false&hideCard=false&hideThread=false&id=1282860187397746689&lang=en&origin=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&theme=light&widgetsVersion=219d021%3A1598982042171&width=500px
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

status: 200
last-modified: Wed, 09 Sep 2020 20:24:51 GMT
cache-control: public, max-age=1800
content-type: text/html; charset=utf-8
etag: "462a23b15781d788fb9d65f4cb1fe44d+gzip"
content-encoding: gzip
access-control-allow-methods: GET
access-control-allow-origin: *
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
accept-ranges: bytes
date: Fri, 25 Sep 2020 15:18:50 GMT
x-served-by: cache-bwi5137-BWI, cache-fra19146-FRA
x-cache: HIT, HIT
vary: Accept-Encoding
tw-cdn: FT
content-length: 301

GET
H2 200 subscribe_embed
www.youtube.com/ Frame 7956 0
0 62ms
57ms Document
text/html 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/subscribe_embed?action_card=1&channelid=UCtFlc7zQcFj3C_62jVGfghA&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.hc3rLxj9u8o.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCMtAagp6kGxB19Nep_bTJunj37kww%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.hc3rLxj9u8o.O/m=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCMtAagp6kGxB19Nep_bTJunj37kww/cb=gapi.loaded_0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /subscribe_embed?action_card=1&channelid=UCtFlc7zQcFj3C_62jVGfghA&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.hc3rLxj9u8o.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCMtAagp6kGxB19Nep_bTJunj37kww%2Fm%3D__features__
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

status: 200
content-encoding: br
strict-transport-security: max-age=31536000
content-type: text/html; charset=utf-8
x-content-type-options: nosniff
expires: Tue, 27 Apr 1971 19:44:06 GMT
content-length: 326
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
cache-control: no-cache
date: Fri, 25 Sep 2020 15:18:50 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: VISITOR_INFO1_LIVE=t0mqvbI1RKk; path=/; domain=.youtube.com; secure; expires=Wed, 24-Mar-2021 15:18:50 GMT; httponly; samesite=None YSC=ya09BnyIDsI; path=/; domain=.youtube.com; secure; httponly; samesite=None GPS=1; path=/; domain=.youtube.com; expires=Fri, 25-Sep-2020 15:48:50 GMT
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 border_3.gif
ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/ 43 B
161 B 15ms
7ms Image
image/gif 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/border_3.gif

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c8de81a1acb5f3788959ecc04eaa6526d5bdb29991157cecbef71042268c0374

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 09:06:25 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
age: 367945
content-type: image/gif
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
expires: Tue, 21 Sep 2021 09:06:25 GMT

GET
H2 200 spacer.gif
ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/ 43 B
98 B 21ms
16ms Image
image/gif 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/spacer.gif

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed1b73c6b4690cde9b521865b58e031293209bc0b2ba2b5716ecf4bf9885ee4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 09:06:25 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
age: 367945
content-type: image/gif
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
expires: Tue, 21 Sep 2021 09:06:25 GMT

GET
H2 200 bubbleSprite_3.png
ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/ 318 B
377 B 15ms
0ms Image
image/png 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/bubbleSprite_3.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

232334d177f358c07f8271994e6fc0c018abfce7c8910deb604de1440d741c45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 09:06:25 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
age: 367945
content-type: image/png
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 318
x-xss-protection: 0
expires: Tue, 21 Sep 2021 09:06:25 GMT

GET
H2 200 bubbleDropR_3.png
ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/ 116 B
174 B 40ms
0ms Image
image/png 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/bubbleDropR_3.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c7884164b248cb8d87de9edf64dc810e5753bb8ec0cd015800d7f39e08371c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 09:06:25 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
age: 367945
content-type: image/png
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 116
x-xss-protection: 0
expires: Tue, 21 Sep 2021 09:06:25 GMT

GET
H3-Q050 200 bubbleDropB_3.png
ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/ 117 B
471 B 83ms
13ms Image
image/png 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/bubbleDropB_3.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

984601230d8cbfe18370425e8e897037cc1a7adf831a691a9ede573cf44479d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 11:04:18 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
age: 360872
content-type: image/png
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 117
x-xss-protection: 0
expires: Tue, 21 Sep 2021 11:04:18 GMT

GET
H/1.1 200
OK sp.pl Show response
sp.analytics.yahoo.com/ 0
857 B 450ms
334ms Script
application/x-javascript 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Fri%2C%2025%20Sep%202020%2015%3A18%3A50%20GMT&n=-2d&b=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog&.yp=10013026&f=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&e=https%3A%2F%2Ft.co%2FusI1BDDzZc&enc=UTF-8&tagmgr=gtm

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 , Switzerland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 15:18:51 GMT
X-Content-Type-Options: nosniff
Age: 1
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Server: ATS
X-Frame-Options: DENY
Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security: max-age=31536000
Content-Type: application/x-javascript
Cache-Control: no-cache, private, must-revalidate
Accept-Ranges: bytes
Expires: Fri, 25 Sep 2020 15:18:51 GMT

GET
H2 200 jot
syndication.twitter.com/i/ 43 B
384 B 156ms
155ms Image
image/gif 104.244.42.200
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?dnt=1&l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Awithcount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1601047130611%2C%22dnt%22%3Atrue%2C%22client_version%22%3A%22219d021%3A1598982042171%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22follow%22%2C%22action%22%3A%22impression%22%7D%7D

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.200 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:18:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 111
pragma: no-cache
last-modified: Fri, 25 Sep 2020 15:18:50 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: c2314cccbef6bd77eaf848cc1d65a1cb
x-transaction: 005d3d8500b395fe
expires: Tue, 31 Mar 1981 05:00:00 GMT

POST
H2 200 /
www.facebook.com/tr/ 0
55 B 19ms
0ms Other
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryNctCCUPuVHhRu8BR

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Fri, 25 Sep 2020 15:18:50 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://www.intego.com
access-control-allow-credentials: true
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0

GET
H2

200

like.php
www.facebook.com/v2.8/plugins/ Frame 3F8A
Redirect Chain

https://web.facebook.com/v2.8/plugins/like.php?action=like&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17bc57732298e8%26domain%3Dwww.int...
https://www.facebook.com/v2.8/plugins/like.php?action=like&app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17bc57732298e8%26domain%3Dwww.inte...

0
0

97ms
88ms

Document
text/html

2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v2.8/plugins/like.php?action=like&app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17bc57732298e8%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff25f705dc2ca13c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.facebook.com%2Fintego&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&_rdc=1&_rdr

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=4dbdfce6c3edf8c2d6f5568db1643bc3&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /v2.8/plugins/like.php?action=like&app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17bc57732298e8%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff25f705dc2ca13c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.facebook.com%2Fintego&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&_rdc=1&_rdr
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: fr=0iCJrKfEOJiThvSPZ..Bfbgpa...1.0.Bfbgpa.
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: about:blank

Response headers

status: 200
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-xss-protection: 0
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
timing-allow-origin: *
strict-transport-security: max-age=15552000; preload
content-encoding: br
facebook-api-version: v3.1
x-content-type-options: nosniff
vary: Accept-Encoding
pragma: no-cache
content-type: text/html; charset="utf-8"
x-fb-debug: nl3l7G9i70dz/3x0I+zw42tCpSqWNLgACo8HQWor8QoLxPSeEcIGXo/5Nk7bwjQhktnMAF+u0ZVoTYCyZNuHRQ==
date: Fri, 25 Sep 2020 15:18:51 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

Redirect headers

status: 302
location: https://www.facebook.com/v2.8/plugins/like.php?action=like&app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df17bc57732298e8%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff25f705dc2ca13c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.facebook.com%2Fintego&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&_rdc=1&_rdr
x-fb-zr-redirect: 02|1601133531|FzBEAiAtTRUAey5cUuPda3JKtqYQCxkyNfgSmPT7Mj-EhBoaFQIgP_WrDxcEnS0aclQ-ShNsKdQNidYEgoD8ioERQaCRC34
strict-transport-security: max-age=15552000; preload
content-type: text/html; charset="utf-8"
x-fb-debug: nROVJanKKPjrmQEeP6TsYXeihU2XS185c2M/tSCY4ApDFW1fYwjWG5UoiQu51JEwj/11N3YM42Zcarqft6P7bA==
content-length: 0
date: Fri, 25 Sep 2020 15:18:51 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H2

200

like_box.php
www.facebook.com/v2.8/plugins/ Frame CEFA
Redirect Chain

https://web.facebook.com/v2.8/plugins/like_box.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df29438fc4560a8%26domain%3Dwww.intego.com%2...
https://www.facebook.com/v2.8/plugins/like_box.php?app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df29438fc4560a8%26domain%3Dwww.intego.com%26...

0
0

400ms
400ms

Document
text/html

2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v2.8/plugins/like_box.php?app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df29438fc4560a8%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff25f705dc2ca13c%26relation%3Dparent.parent&color_scheme=light&container_width=290&header=true&href=https%3A%2F%2Fwww.facebook.com%2Fintego&locale=en_US&sdk=joey&show_border=true&show_faces=false&stream=true&_rdc=1&_rdr

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=4dbdfce6c3edf8c2d6f5568db1643bc3&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /v2.8/plugins/like_box.php?app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df29438fc4560a8%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff25f705dc2ca13c%26relation%3Dparent.parent&color_scheme=light&container_width=290&header=true&href=https%3A%2F%2Fwww.facebook.com%2Fintego&locale=en_US&sdk=joey&show_border=true&show_faces=false&stream=true&_rdc=1&_rdr
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: fr=0iCJrKfEOJiThvSPZ..Bfbgpa...1.0.Bfbgpa.
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: about:blank

Response headers

status: 200
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-xss-protection: 0
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
timing-allow-origin: *
strict-transport-security: max-age=15552000; preload
content-encoding: br
facebook-api-version: v3.1
x-content-type-options: nosniff
vary: Accept-Encoding
pragma: no-cache
content-type: text/html; charset="utf-8"
x-fb-debug: 8gkYNhkLWidnm3tnGwWKteon7k12HU4Hlj9vezzRkGkdLCGOImp06NscJ1KeYenhtWv5/Lp35Wj06qS3/NF0Ng==
date: Fri, 25 Sep 2020 15:18:51 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

Redirect headers

status: 302
location: https://www.facebook.com/v2.8/plugins/like_box.php?app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df29438fc4560a8%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff25f705dc2ca13c%26relation%3Dparent.parent&color_scheme=light&container_width=290&header=true&href=https%3A%2F%2Fwww.facebook.com%2Fintego&locale=en_US&sdk=joey&show_border=true&show_faces=false&stream=true&_rdc=1&_rdr
x-fb-zr-redirect: 02|1601133531|FzBEAiBaOfZl-60yHbjTtk2CQ4c7LfExB0U43rOLAx5dvAsfxgIgSmtA6ZXMMTKcCBdf0VFFtlUbBS_DjJLO1wVQ2tnoDVU
strict-transport-security: max-age=15552000; preload
content-type: text/html; charset="utf-8"
x-fb-debug: NcycnoZMzGrrT4Vyn2RxTxPxz0KOc/CIPW4zHAEBR1nuZg4WiBq5XGTYVCuP0iIQ1Z6cR0JSGBmiliEH+M6jKA==
content-length: 0
date: Fri, 25 Sep 2020 15:18:51 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s7.addthis.com
URL: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Domain: www.linkedin.com
URL: https://www.linkedin.com/pages-extensions/FollowCompany?id=28855&counter=none&xdOrigin=https%3A%2F%2Fwww.intego.com&xdChannel=668ce378-72a1-4f0d-9953-e86bd99bfc00&xd_origin_host=https%3A%2F%2Fwww.intego.com

Verdicts & Comments Add Verdict or Comment

142 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.linkedin.com/	1970-01-19 12:45:33	Name: lidc Value: "b=OGST06:g=1901:u=1:i=1601047130:t=1601133530:s=AQFABCth09d0JSCiFH3aArCH5T-2ynhi"
.linkedin.com/	1970-01-19 21:29:43	Name: lissc Value: 1
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.www.linkedin.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: ajax:0693393777264190266
.linkedin.com/	1970-01-20 06:16:00	Name: bcookie Value: "v=2&bb40028d-eef8-4ade-8889-ccbf33bea629"
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: ya09BnyIDsI
.youtube.com/	1970-01-19 17:03:19	Name: VISITOR_INFO1_LIVE Value: t0mqvbI1RKk
.intego.com/	1970-01-19 14:53:43	Name: _fbp Value: fb.1.1601047130406.235486935
.intego.com/	1970-01-19 22:08:35	Name: __qca Value: P0-1109666615-1601047130011
.www.linkedin.com/	1970-01-20 06:16:00	Name: bscookie Value: "v=1&20200925151850911f766c-f693-4a66-8381-bfce7b22002aAQFhbvh3uMbtBKjTmjUQBrXc3MWno8vE"
.intego.com/	1970-01-19 12:44:07	Name: _dc_gtm_UA-1724183-7 Value: 1

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.intego.com/mac-security-blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.google.com
apis.google.com
b91.yahoo.co.jp
bat.bing.com
c.disquscdn.com
connect.facebook.net
disqus.com
fireside.fm
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
graph.facebook.com
i0.wp.com
i1.wp.com
i2.wp.com
m.addthis.com
macsecurityblog.disqus.com
netdna.bootstrapcdn.com
pixel.quantserve.com
pixel.wp.com
platform.linkedin.com
platform.twitter.com
rules.quantcount.com
s.w.org
s.yimg.com
s.yimg.jp
s.ytimg.com
s7.addthis.com
secure.gravatar.com
secure.quantserve.com
sp.analytics.yahoo.com
ssl.gstatic.com
stats.g.doubleclick.net
stats.wp.com
syndication.twitter.com
t.co
v1.addthisedge.com
web.facebook.com
widgets.pinterest.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.intego.com
www.linkedin.com
www.youtube-nocookie.com
www.youtube.com
z.moatads.com
s7.addthis.com
www.linkedin.com
104.244.42.197
104.244.42.200
151.101.112.134
151.101.12.157
151.101.192.134
151.101.36.84
182.22.24.252
182.22.30.220
192.0.76.3
192.0.77.2
192.0.77.48
2001:4de0:ac19::1:b:2b
2001:4de0:ac19::1:b:3b
212.82.100.181
216.58.206.2
23.210.248.44
23.210.250.213
2600:9000:206e:f800:6:44e3:f8c0:93a1
2606:4700::6812:a813
2606:4700::6812:c77
2620:116:800d:21:36a9:ecb:e518:b308
2620:1ec:21::14
2620:1ec:c11::200
2a00:1288:f03d:1fa::2000
2a00:1450:4001:800::2002
2a00:1450:4001:800::2003
2a00:1450:4001:802::2003
2a00:1450:4001:802::200e
2a00:1450:4001:808::2003
2a00:1450:4001:809::2008
2a00:1450:4001:80b::200e
2a00:1450:4001:818::2003
2a00:1450:4001:818::200a
2a00:1450:4001:819::2004
2a00:1450:4001:81b::2003
2a00:1450:4001:81e::200e
2a00:1450:4001:820::200e
2a00:1450:4001:821::200d
2a00:1450:4001:821::200e
2a00:1450:4001:824::2004
2a00:1450:400c:c0c::9b
2a02:26f0:6c00::210:ba20
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f02d:e:face:b00c:0:2
2a03:2880:f12d:83:face:b00c:0:25de
2a04:fa87:fffe::c000:4902
96.126.99.139
0140ed5069f22e4aa8bb1a1fc615c39fc55d7d64e94be541615f1c5a30ae479b
01fdf346f2f8d129c118d71f735fb3a76656059b38000829b908a1a118a5492f
033cde881de209390d39c3f291aa9cc39c412c29fd794af7277830b34da8785a
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
06ab70caac9ecdf9ccce5eb0b75786dae3f3c6805f6c71f044bc3818e734f2bd
097afea517679d2e0b986d77cb3fe7808026882b52ca074a050e03e7a4a6996b
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
114773206c8b1ef17f1865f1fd0acb5ee36aa4f666718144698063fd295a0f65
124d5d7d1a1e13e129ad8ffbba218f6fd857f706d9af89d05d2686a0627ce127
137e41c449677deb7c8da3afde63fc781b095bb028f78b789be44192e8e3f4be
142bb04454d6124c28f12d43249615ae8903c9742ea86c024ef0602f4dd1446e
1ec59a067ba6ca9573c5443f4162b16b1b3349c34669eb4e7f4be7a20bdc85e5
232334d177f358c07f8271994e6fc0c018abfce7c8910deb604de1440d741c45
23b775e4e3b5b93742dad8a1bbfacb2ffc3271a15dbfc6d3ded21d713f2c3489
25b786ec50525130cddd67183bc696608e1fc88651fe5d1d953667e9f4643c4d
270deaa4889841d35cc851365432365bf62d81c1159ad4a1099def85ce6f8bed
275fb4a7bdeab3c59caff1c0ea88bf1adc9f4cfc377a9bec7b28517d13e2fd37
2ada70caed6a7e67d4c10a6de4c07c7863d48d6819c700c39d6b24234d9b4f0b
2d25f06ba5a1e228262948c457155e24a1d91bfb5dad460bd1dcfe2106011f20
301bec0edd5575e96ea21fd09c50c5964ee72d565a65fd7d8db6020d64c05cd3
318006d41558b563729ff43d06d5aff24b9b95c942091bbd94214b9720688b50
33f30681793311916b1626535ca2990a9efcbf10f26d2c2a6565edfb6979c4ec
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
364c1179390530ea06c6636e2f314aa1091d460c4c6e369c6689a0fe31672054
3810d28e63ef9ded2c013f6c826fdf2cefe98a590e656f36fe38597a5eb83c40
38497b0d65727db13d0658eb04d053c42b367565ff7bb8b2469389f0cafdcf6d
3daa2574bee66a8fd18b5323d1b22f5562ed8d497aa17986446eb877a703bba6
3eab02e002142b491bfeaaea2ee12490872bc5429dfb0889914660c783194563
3eafd487d44de8fc38a461abc3f2d2e9c40bd170ba23556561447f679ff105a4
3fb4cab423b2441335fc682b79687d8eb806aceb384c937c9b28534580593fd4
403bfa21e733c139da9d7d87c48fa0ebbed91514fbbadf34cbc455294a004389
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
451b07379c15f95edc328f4b3b71d3d3b67cda7fe5b85251b39f866d0189f943
4813a9ef082680ede099e57bad023ef37cb204fe87ec0de1de1534cc7b1b4103
487f2e9da2ff0740755a5ef01dc15a2888b89537795895203a831b13b199d8bb
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
49b34be224fe432a99c8609e9f61bf4f07144fc9b6b90325b7cc304b1271547f
4b8e8b6c26d7b34cc48b04df5633f14745f22c06826c70ac7e5f3a226bfcb869
4e58b78b5844a988d67532b4683a6e8b3235b3d56d319727e65f460805bbdec4
521ceb171869c1862404b31bd4768200aa4c5a1cb53ab27bb8e9d4e08a424a32
5539ebc747e005bcd0bcdf9e946d3469107a18d1996595c39a2445a886468674
593718d567cc4d6767d63be77ac6505dedee76cc656526945c90f9e1869cbc53
593b81ecc28e013924cc0bd0b78a6a990c0e01ffbf31ef576d5f6086829ab9a0
5c622f5433cbb6ea1df5c0dd8671e55ef7d1464366074730473c453de50a579b
5f70fb8150f0a1f184b40f86d012db040d229056b9b0d8c681f08987cb124e5f
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
61043862bfca6af330c3434cbf67360d72e2b11192f86b69321fe68f216c70f2
62d2cc93ab8f52afb7379b9fabdc6f383f7700367cda04191ad1a8158c449c23
63896532a7015ab5b7288359c02124980a5075e9267f0ba3fbfc7c3f5038b478
658e8b2fc6e603ce4afb0f39cd09d2ff743c9fcbeaaea5dc58097184d34da56d
6c7884164b248cb8d87de9edf64dc810e5753bb8ec0cd015800d7f39e08371c1
6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0
7456721b1c3d2c1c24d4ed813a2795d0907dc1c0b2748e566e8dabf3d1126dcb
74bb956c78140b9e3228afbcc5c520080df82ea13e945766657928838ec56515
7587369160233b751c90ccc2043b7fdfd7eb1f0d9aa610371b43f4b3419fa83f
75cb79bd603606b3fb0454b9cedeb147e5b325f3139959b1f079b41bcf077261
765af1bf46f65a6bb9108eea31286465e8a28f1c649030afff11b51b45cb25d4
79e23a92dfcac7cfec15c82dfcbd83d3db7cb9222a8a1a60963d0bec57977163
7c91a37f448e0d90f9079566ec4114aac6a37bb32ff0fc1c28d47c6b31646d87
7f9d053ff298bf8178d03311f9b490059ccdf3791d02348c3971907f4e0d1b03
82f1278f66b192a223e306d884f8db595ef3b6d829cc1544807b9bf40019403e
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
85c1eb2c2a173feceba14abe8344fe9c7cb12aa1353f083f28a62f1a366763b9
87bcc22d43cfa00bd1cf5e3a35aad79150b4ce804899db3ea93efe57eeb6dbf7
884a2330198f498e36d9e77bb5c7f4971b3d70c4411cf306a3afca8bb50bb94d
8c7ee0238fa5cd80a02ef9870a7fff498ef52097181cb73edb9219dc022fd919
8e647ae3b97c4adb3970662d2945d1be4cf09e75712de88eb2b3adf793d16bcf
8ecf7fe958f132008eb2eaeda1a079451a62372838a6c18d9e1353f64e48172a
8f2cf36a9df3e0af8f1b226a1440c9a6fd4cda5c4b4548150236c8d1a1b094e6
91080af66784a2e01039ce6d96482e2ee1c4435e4f44491ec96948a112f54283
9397e430232fd1a326c8e8ca1473007c96f8c84a0fa2820c4ca16d4e311d1fde
93b94b74b73c37bcb3e6d8cada57b5ce45d7bd3fe5e3b2b6194a702d1353e1a0
96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea
984601230d8cbfe18370425e8e897037cc1a7adf831a691a9ede573cf44479d4
9eeea020cc6ec6c8b66b20c48a9b69a5f14b8097bdb91c5420998eb842bcbae0
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a2d30057d0a8007fb75fb8a6e4f82f59d3858d29ea176db9c73f665209e86123
a374e4a800bf1c52c2f548b954aca207cd7424b16fd3ab37493e57de0351ee08
a37ca4608218cccdfb8b6d4edbdfbf375d0e1368b46397e3b7049e0cbf5bc1f6
a4d96a2b0a51347fa935513d95b0f49d7f6fcebb5357fd7129974758bb5b5680
a761b426004caba495cdac2c93ce7dd306c47bc4d7bdc63c4840c3d8182396a9
a9cab6b997431283ce8f789f1efd7d1b74f27e79c9f545a623ee1387ce7409ac
aaffceab986a8d791cfef18d2d1e28fe2dcaf40a8bdfaf4fd393b1a91c6f072b
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aeed123aaf3d21619c5676888e47328a2f0f9994ea86268b5ad0072825bc29fb
af0c90c79167796746d77eb0f20a739e66fa7fcd774680c7ba25cce5292d5ba5
b385fd0614f2927f0e7fdc03ccdb2428e3a93de0c7fe467149b34213cc32c0f6
b859cc611126401cdc38d803ac7c5967ee5da1a626e00318700ea88df55da1b9
bb419846a6c750ceac7e697b479216945b7597dea49905e30d1fc040a3194099
bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d
c038085bd64c19c9f10dbf5d50967e4336ad5db48ff87111cb181e9a05cbaab0
c082b0b5901359803e620e04dee50986beef023bdc7413d1e47d571bc73a7500
c73d6c78c4bb48a6815c7ddd5bc944b047754369d4043ccb6ab2fde88f42add4
c8de81a1acb5f3788959ecc04eaa6526d5bdb29991157cecbef71042268c0374
c9a89d2f60c10e0ddd38bd870c2ec6aa6db7f00f6cb44113f7e195fe55263def
cd42913991b63df247c37543d4b233d0579e3765af6e88565d36b8ddf91693bc
d077683ec63c7d44f473554e688628da6cfdf84c0f223b6be00f2476600433a5
da3e524928bcca821af2551eb6f9e9ae2449ceb48642cce4f2dae23383098537
dd181d190b0d09b0d51c5ab338983be4d084fbec3af3dbe6e739e9f55014c5b6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e48d539ca17fdd4a1ea4d56c769df1b9469535132e9cc45d187e8cf4560ab57d
e792a27da441fdb78a5a362164f95b59d19c3f2ba818641bf5937bbdadea686c
e7f5a831ead8920451598097754bb1d4fbf16fff1fd90794b950724867345794
eac868d5fecdb7cc71ff2864391c82842088e55a7a70b8f6ff5206ef7c7618c0
eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746
ecf76895be1cf9e8b3edb254030e9c9c1d8f3c2efc1f9dc7e04ceff29eccae9c
ed1b73c6b4690cde9b521865b58e031293209bc0b2ba2b5716ecf4bf9885ee4b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1cdac0359446f4055570e505f21ef9e35944fbc99ae9f22a1f1c750b958733c
f2b93287eebae3a6ac1f7efadd39373abd95e1ee24620ef4f156b0fe1a496be4
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f538d5803d00836b5f946264abb64976a6416ab4cc16f8f83455a025a08ad014
f5eb3447e5e14f6907295baf22ba454cf3a88b4cd41abd61e6286e975d3608a0
ffa8b5c0d78def1b71617c0ae00e01b295bc29e2e227ba0dc84469a9ba39259c

www.intego.com Open in urlscan Pro 2606:4700::6812:c77 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

141 Requests

99 %HTTPS

66 %IPv6

35 Domains

50 Subdomains

48 IPs

9 Countries

1750 kBTransfer

3801 kBSize

11 Cookies

38 Outgoing links

Page URL History

Redirected requests

141 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.intego.com Open in urlscan Pro
2606:4700::6812:c77 Public Scan

Screenshot
Live screenshot

Full Image

141
Requests

99 %
HTTPS

66 %
IPv6

35
Domains

50
Subdomains

48
IPs

9
Countries

1750 kB
Transfer

3801 kB
Size

11
Cookies

141 HTTP transactions
5 data transactions