www.scmagazine.com Open in urlscan Pro
2606:4700:20::681a:2d7  Public Scan

16 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 45

• https://api.b2c.com/api/init-131xlxqjsfx7lh82dpc.js HTTP 307
• https://api-34-220-64-140.b2c.com/api/embed-QBgAucLna4Y07yLf.js

Request Chain 50

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=68780&url=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&time=1603333986734 HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D68780%26url%3Dhttps%253A%252F%252Fwww.scmagazine.com%252Fhome%252Fsecurity-news%252Fmalware%252Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%252F%26time%3D1603333986734%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=68780&url=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&time=1603333986734&liSync=true

Request Chain 64

• https://ib.adnxs.com/getuid?https://a.dpmsrv.com/dpmpxl/index.php?id=$UID&q%3DxImp%26v%3D1.x%26cl%3D1122%26pixelIndex%3D0%26r%3D633801%26tzOffset%3D-120%26url%3Dhttps%253A%252F%252Fwww.scmagazine.com%252Fhome%252Fsecurity-news%252Fmalware%252Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%252F&_=1603333986895 HTTP 307
• https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fa.dpmsrv.com%2Fdpmpxl%2Findex.php%3Fid%3D%24UID%26q%253DxImp%2526v%253D1.x%2526cl%253D1122%2526pixelIndex%253D0%2526r%253D633801%2526tzOffset%253D-120%2526url%253Dhttps%25253A%25252F%25252Fwww.scmagazine.com%25252Fhome%25252Fsecurity-news%25252Fmalware%25252Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%25252F%26_%3D1603333986895 HTTP 302
• https://a.dpmsrv.com/dpmpxl/index.php?id=6920249049286326430&q=xImp&v=1.x&cl=1122&pixelIndex=0&r=633801&tzOffset=-120&url=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&_=1603333986895

Request Chain 70

• https://match.adsrvr.org/track/cmf/generic?ttd_pid=6fgi4r1&ttd_tpi=1&ttd_puid=5f90ef62f44f730008f37407&gdpr=0 HTTP 302
• https://match.adsrvr.org/track/cmb/generic?ttd_pid=6fgi4r1&ttd_tpi=1&ttd_puid=5f90ef62f44f730008f37407&gdpr=0 HTTP 302
• https://polo-v1.feathr.co/v1/analytics/match?f_id=5f90ef62f44f730008f37407&ttd_id=be0a3a54-a8db-427e-93c9-16162239fc9a

Request Chain 72

• https://cm.g.doubleclick.net/pixel?google_nid=datapoint_dmp&google_cm&ap_id=6920249049286326430&pixelIndex=0&_=1603333986896 HTTP 302
• https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=6920249049286326430&pixelIndex=0&_=1603333986896&google_gid=CAESEPhcyb-rWYsc9HteyBxTrNE&google_cver=1

Request Chain 88

• https://api-34-220-64-140.b2c.com/api/x?QBgAucLna4Y07yLf$dXJsJDAkaHR0cHM6Ly93d3cuc2NtYWdhemluZS5jb20vaG9tZS9zZWN1cml0eS1uZXdzL21hbHdhcmUvZXhjbHVzaXZlLXRyb2phbi1hcHBhcmVudGx5LWluZmVjdHMtbmNyLXBvc2luZy1wb3NzaWJsZS1zdXBwbHktY2hhaW4tcmlzay8iLCJyZWZlcnJlciQwJCIsImFuY2VzdG9yT3JpZ2lucyQwJCIsInZpZGVvJDAkMTYwMHgxMjAweDI0IiwiZnJhbWUkMCQwIiwiaGlkZGVuJDAkMCIsInZpc2liaWxpdHlTdGF0ZSQwJHZpc2libGUiLCJoYXNGb2N1cyQwJDEiLCJ3aW5kb3ckMCQxNjAweDEyMDAiLCJpbm5lciQwJDE2MDB4MTIwMCIsIm91dGVyJDAkMTYwMHgxMjAwIiwibG9jYWxTdG9yYWdlJDAkMSIsInNlc3Npb25TdG9yYWdlJDEkMSIsImFwcENvZGVOYW1lJDEkTW96aWxsYSIsImFwcE5hbWUkMSROZXRzY2FwZSIsImFwcFZlcnNpb24kMSQ1LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzgzLjAuNDEwMy42MSBTYWZhcmkvNTM3LjM2IiwiY29va2llRW5hYmxlZCQxJHRydWUiLCJkb05vdFRyYWNrJDEkIiwiaGFyZHdhcmVDb25jdXJyZW5jeSQxJDEyIiwibGFuZ3VhZ2UkMSRlbi1VUyIsInBsYXRmb3JtJDEkTGludXggeDg2XzY0IiwicHJvZHVjdCQxJEdlY2tvIiwicHJvZHVjdFN1YiQxJDIwMDMwMTA3Iiwic2VuZEJlYWNvbiQxJDEiLCJ1c2VyQWdlbnQkMSRNb3ppbGxhLzUuMCAoTWFjaW50b3NoOyBJbnRlbCBNYWMgT1MgWCAxMF8xNF81KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvODMuMC40MTAzLjYxIFNhZmFyaS81MzcuMzYiLCJ2ZW5kb3IkMSRHb29nbGUgSW5jLiIsInZlbmRvclN1YiQxJCIsImZvbnRyZW5kZXIkOSQxIiwid2ViZ2wkMTEkbi9hIiwidGltZSQxMSQxNjAzMzMzOTg3ODQwIiwidGltZXpvbmUkMTEkLTEyMCIsInBsdWdpbnMkMTEkTm9uZSIsIm1lbS10b3RhbEpTSGVhcFNpemUkMTEkMTguNDUxOTI5IiwibWVtLXVzZWRKU0hlYXBTaXplJDExJDE1LjY2Mzc2NSIsIm1lbS1qc0hlYXBTaXplTGltaXQkMTEkNDI5NC43MDUxNTIiLCJ0aW1lLWRvbWFpbkxvb2t1cEVuZCQxMSQxIiwidGltZS1jb25uZWN0U3RhcnQkMTEkMSIsInRpbWUtY29ubmVjdEVuZCQxMSQxNyIsInRpbWUtc2VjdXJlQ29ubmVjdGlvblN0YXJ0JDExJDciLCJ0aW1lLXJlcXVlc3RTdGFydCQxMSQxNyIsInRpbWUtcmVzcG9uc2VTdGFydCQxMSQ3MzkiLCJ0aW1lLXJlc3BvbnNlRW5kJDExJDc0MCIsInRpbWUtZG9tTG9hZGluZyQxMSQ3NDIiLCJ0aW1lLWRvbUludGVyYWN0aXZlJDExJDE3ODAiLCJ0aW1lLWRvbUNvbnRlbnRMb2FkZWRFdmVudFN0YXJ0JDExJDI1MzEiLCJ0aW1lLWRvbUNvbnRlbnRMb2FkZWRFdmVudEVuZCQxMSQyNTQ5IiwibmF2aWdhdGlvbi1yZWRpcmVjdENvdW50JDExJDAiLCJuYXZpZ2F0aW9uLXR5cGUkMTEkbmF2aWdhdGUiLCJnbG9iYWxzLXRpbWUkMTkkMC41NTUiLCJnbG9iYWxzJDIwJDNkYjIzMDg0IiwiZG9jdW1lbnQtdGltZSQyNiQyLjE3IiwiZG9jdW1lbnQkMjckYjQyZTYxZTMiLCJjb25uZWN0aW9uJDI3JCIsImRvd25saW5rTWF4JDI3JCIsImdldFVzZXJNZWRpYSQyNyQyIiwiY2xvY2skMzMkMzM5NyIsInBlcm1pc3Npb24tZ2VvbG9jYXRpb24kNDQkcHJvbXB0IiwiYmF0dGVyeSQ0NCQxIDEgMCBJbmZpbml0eSIsImF1ZGlvY29udGV4dCQ0NCRmN2U3MTJkOSIsImludGVyc2VjdGlvbi1zaXplJDQ0JDE2MDB4MTIwMCIsImludGVyc2VjdGlvbiQ0NCQ0NSIsInBlcm1pc3Npb24tbm90aWZpY2F0aW9ucyQ0NSRwcm9tcHQiLCJwZXJtaXNzaW9uLWNhbWVyYSQ0NSRwcm9tcHQiLCJwZXJtaXNzaW9uLW1pY3JvcGhvbmUkNDUkcHJvbXB0IiwicGVybWlzc2lvbi1wZXJzaXN0ZW50LXN0b3JhZ2UkNDUkcHJvbXB0Iiwic29ydCQ3MiQxNy42MiIsImZyYW1lcmF0ZSQxNDEkODAiLCJhZGJsb2NrJDIwNSQw HTTP 302
• https://api-34-220-64-140.b2c.com:444/api/4?QBgAucLna4Y07yLf

122 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/	81 KB 18 KB	739ms 722ms	Document text/html	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / WP Engine Resource Hash 486fe2154972a55c173cb0d41ae87a78ab3ca509c7af63efab12edf7581cb19d Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers :method GET :authority www.scmagazine.com :scheme https :path /home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Thu, 22 Oct 2020 02:33:05 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=da2e3a4a0579a7f3ace37d3e04397a3eb1603333984; expires=Sat, 21-Nov-20 02:33:04 GMT; path=/; domain=.scmagazine.com; HttpOnly; SameSite=Lax; Secure PHPSESSID=3c62a40893888251348c9a8599e8f7d7; path=/ x-frame-options SAMEORIGIN vary X-WPENGINE-SEGMENT,Accept-Encoding link <https://www.scmagazine.com/wp-json/>; rel="https://api.w.org/" <https://www.scmagazine.com/?p=106972>; rel=shortlink expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache x-powered-by WP Engine x-pass-why custom-path cf-cache-status DYNAMIC cf-request-id 05efc02a9e00002c429f398000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333986"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15552000 x-content-type-options nosniff server cloudflare cf-ray 5e5fcfbdcdb72c42-FRA content-encoding br
GET H2	200	style.min.css www.scmagazine.com/wp-includes/css/dist/block-library/	52 KB 7 KB	21ms 17ms	Stylesheet text/css	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/wp-includes/css/dist/block-library/style.min.css?ver=5.4.2 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 3705617 status 200 vary Accept-Encoding, Accept-Encoding, Accept-Encoding cf-request-id 05efc02d7b00002c4293ac3000000001 last-modified Fri, 24 Apr 2020 15:32:14 GMT server cloudflare etag W/"5ea3067e-d159" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333986"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5e5fcfc25bdf2c42-FRA
GET H2	200	shared-style.min.css www.scmagazine.com/wp-content/themes/haymarket/dist/css/	47 KB 6 KB	18ms 15ms	Stylesheet text/css	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/wp-content/themes/haymarket/dist/css/shared-style.min.css?ver=1596173836 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a716b26ff515ccfb6f33b4b06b82c9587674938c5994d81e261ef41907d57529 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 6138146 status 200 vary Accept-Encoding, Accept-Encoding, Accept-Encoding cf-request-id 05efc02d7c00002c429f3c4000000001 last-modified Fri, 31 Jul 2020 05:37:16 GMT server cloudflare etag W/"5f23ae0c-bdba" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333986"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5e5fcfc25be02c42-FRA
GET H/1.1	200	olytics.css olytics.omeda.com/olytics/css/v3/p/	28 KB 3 KB	685ms 109ms	Stylesheet text/css	204.180.130.159 QTS-AS
General Check archive.org Show headers Download Go to Full URL https://olytics.omeda.com/olytics/css/v3/p/olytics.css?ver=1.0 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 204.180.130.159 Chicago, United States, ASN53866 (QTS-AS, US), Reverse DNS my.omedastaging.com Software Apache / Resource Hash c9729d6e62c9df65567bbcd5b1b8353617b67d36c4c3d6d7a97e0a092a2872e5 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 22 Oct 2020 02:33:05 GMT Content-Encoding gzip X-Content-Type-Options nosniff Last-Modified Fri, 24 Jul 2020 16:03:22 GMT Server Apache ETag W/"28537-1595606602000" X-Frame-Options SAMEORIGIN Content-Type text/css Access-Control-Allow-Origin * Cache-Control max-age=21600 Transfer-Encoding chunked Accept-Ranges bytes vary accept-encoding X-XSS-Protection 1; mode=block Expires Thu, 22 Oct 2020 08:33:06 GMT
GET H2	200	style.min.css www.scmagazine.com/wp-content/themes/haymarket/dist/css/	264 KB 31 KB	26ms 22ms	Stylesheet text/css	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/wp-content/themes/haymarket/dist/css/style.min.css?ver=1602013507 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d3a7d131bb98327dc9255a54a2983011752a9237f8b703ab4f0a9292c6f09370 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 1320196 status 200 vary Accept-Encoding, Accept-Encoding, Accept-Encoding cf-request-id 05efc02d7c00002c4288119000000001 last-modified Tue, 06 Oct 2020 19:45:07 GMT server cloudflare etag W/"5f7cc943-421b4" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333986"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5e5fcfc25be12c42-FRA
GET H2	200	css fonts.googleapis.com/	3 KB 627 B	23ms 20ms	Stylesheet text/css	2a00:1450:4001:802::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Lato:400,400i,700,700i Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 5c14a94a28817f61a07c64ad2431d29662763ae0237fb0317d4aeede78e5d24b Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Thu, 22 Oct 2020 02:33:05 GMT server ESF date Thu, 22 Oct 2020 02:33:05 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 22 Oct 2020 02:33:05 GMT
GET H2	200	lytics.min.css www.scmagazine.com/wp-content/themes/haymarket/dist/css/	37 KB 3 KB	19ms 16ms	Stylesheet text/css	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/wp-content/themes/haymarket/dist/css/lytics.min.css?ver=1576575436 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ece5f25bbc643556099a200aa2df5c428d74048e55db71c1880afd1adcb425a9 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 3705617 status 200 vary Accept-Encoding, Accept-Encoding, Accept-Encoding cf-request-id 05efc02d7c00002c42932b0000000001 last-modified Tue, 17 Dec 2019 09:37:16 GMT server cloudflare etag W/"5df8a1cc-95f6" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333986"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5e5fcfc25be42c42-FRA
GET H2	200	css fonts.googleapis.com/	827 B 468 B	26ms 22ms	Stylesheet text/css	2a00:1450:4001:802::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Bree+Serif&ver=0.1.1 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash ab7385bc83ced10d8f10ccbc3c714a0e3e44fad6aca40c8c007b5f84af5f9120 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Thu, 22 Oct 2020 01:39:44 GMT server ESF date Thu, 22 Oct 2020 02:33:05 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 22 Oct 2020 02:33:05 GMT
GET H2	200	jquery.js Show response www.scmagazine.com/wp-includes/js/jquery/	95 KB 32 KB	30ms 27ms	Script application/javascript	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 12886029 status 200 vary Accept-Encoding, Accept-Encoding, Accept-Encoding cf-request-id 05efc02d7c00002c4267029000000001 last-modified Fri, 17 May 2019 04:25:54 GMT server cloudflare etag W/"5cde37d2-17a69" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333986"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5e5fcfc25be52c42-FRA
GET H2	200	jquery-migrate.min.js Show response www.scmagazine.com/wp-includes/js/jquery/	10 KB 4 KB	21ms 18ms	Script application/javascript	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 16821453 status 200 vary Accept-Encoding, Accept-Encoding, Accept-Encoding cf-request-id 05efc02d7e00002c42c5afd000000001 last-modified Fri, 20 May 2016 06:11:28 GMT server cloudflare etag W/"573eaa90-2748" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333986"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5e5fcfc25be62c42-FRA
GET H2	200	cookie.min.js Show response www.scmagazine.com/wp-content/mu-plugins/cookie-controller/js/	2 KB 1 KB	16ms 13ms	Script application/javascript	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/wp-content/mu-plugins/cookie-controller/js/cookie.min.js?ver=1.2 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e828282e92509efc0f7bc57888382c5816bd403e0abbb685eda5c4372cc7daa5 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 16821453 status 200 vary Accept-Encoding, Accept-Encoding, Accept-Encoding cf-request-id 05efc02d7c00002c4277111000000001 last-modified Tue, 17 Dec 2019 09:37:13 GMT server cloudflare etag W/"5df8a1c9-834" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333986"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5e5fcfc25be72c42-FRA
GET H2	200	hm-olytics-beacon.js Show response www.scmagazine.com/wp-content/plugins/hm-olytics-beacon/js/	1 KB 579 B	18ms 15ms	Script application/javascript	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/wp-content/plugins/hm-olytics-beacon/js/hm-olytics-beacon.js?ver=1.0 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 90a260084cfdf97ada7a8e0650eb310a4206d79f1b3a53225d2b9053cc9e4c13 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 16821453 status 200 vary Accept-Encoding, Accept-Encoding, Accept-Encoding cf-request-id 05efc02d7d00002c42c832b000000001 last-modified Tue, 17 Dec 2019 09:37:14 GMT server cloudflare etag W/"5df8a1ca-421" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333986"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5e5fcfc25be92c42-FRA
GET H2	200	UtilityMove-custom.min.js Show response www.scmagazine.com/wp-content/themes/haymarket/assets/vendor/	2 KB 847 B	20ms 18ms	Script application/javascript	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/wp-content/themes/haymarket/assets/vendor/UtilityMove-custom.min.js?ver=1576744511 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cffef365e4b53f1a6e9d33a7d42c0d1542b573360f774069589240f75f0e84f1 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 16821453 status 200 vary Accept-Encoding, Accept-Encoding, Accept-Encoding cf-request-id 05efc02d7d00002c42d4acc000000001 last-modified Thu, 19 Dec 2019 08:35:11 GMT server cloudflare etag W/"5dfb363f-751" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333986"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5e5fcfc25bea2c42-FRA
GET H2	200	polyfill.min.js Show response www.scmagazine.com/wp-content/themes/haymarket/assets/js/frontend/	102 KB 33 KB	26ms 24ms	Script application/javascript	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/wp-content/themes/haymarket/assets/js/frontend/polyfill.min.js?ver=1576575436 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 59173f786dd1f3802f7ab26fd339aac4099dc10c6cb54a6a92213e6af277592a Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 16821453 status 200 vary Accept-Encoding, Accept-Encoding, Accept-Encoding cf-request-id 05efc02d7d00002c42b5a53000000001 last-modified Tue, 17 Dec 2019 09:37:16 GMT server cloudflare etag W/"5df8a1cc-19873" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333986"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5e5fcfc25beb2c42-FRA
GET H2	200	gpt.js Show response www.googletagservices.com/tag/js/	52 KB 18 KB	36ms 15ms	Script text/javascript	2a00:1450:4001:808::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/tag/js/gpt.js Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c3ee9cd614b8fa2a95a9f5f3c9179696f03d6dd37fec53704e3b65c7b660afab Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:05 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "670 / 582 of 1000 / last-modified: 1603318332" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 17688 x-xss-protection 0 expires Thu, 22 Oct 2020 02:33:05 GMT
GET H2	200	head.min.js Show response www.scmagazine.com/wp-content/themes/haymarket/dist/js/	43 KB 12 KB	21ms 19ms	Script application/javascript	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/wp-content/themes/haymarket/dist/js/head.min.js?ver=1602013507 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1a9bcb1cc2cb1d0cf031ef290b4df3594eb3e4486db13dfcf1f74c3e2a3e7460 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 1320196 status 200 vary Accept-Encoding, Accept-Encoding, Accept-Encoding cf-request-id 05efc02d7d00002c42940f5000000001 last-modified Tue, 06 Oct 2020 19:45:07 GMT server cloudflare etag W/"5f7cc943-ac71" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333986"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5e5fcfc25bec2c42-FRA
GET H2	200	SC-MEDIACYBERSOURCEnotag.jpg www.scmagazine.com/wp-content/uploads/sites/2/2020/01/	138 KB 138 KB	11ms 11ms	Image image/jpeg	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.scmagazine.com/wp-content/uploads/sites/2/2020/01/SC-MEDIACYBERSOURCEnotag.jpg Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ad6110f575081c4de945f980ccf2e045737f164ad2a3d294daffd192f7a5c914 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:05 GMT x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 15632079 status 200 vary Accept-Encoding content-length 141243 cf-request-id 05efc02e1100002c428f8c4000000001 last-modified Tue, 21 Jan 2020 20:09:10 GMT server cloudflare etag "5e275a66-227bb" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333986"}],"group":"cf-nel","max_age":604800} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 5e5fcfc34d322c42-FRA cf-bgj h2pri
GET H2	200	/ secure.gravatar.com/avatar/	1 KB 2 KB	21ms 6ms	Image image/jpeg	2a04:fa87:fffe::c000:4902 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://secure.gravatar.com/avatar/?s=96&d=mm&r=g Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 148b35f5e5d3dd37d6fc44caa577d6b478b0a62bb1200439d1f77e21f9c88c64 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-nc HIT fra 4 date Thu, 22 Oct 2020 02:33:05 GMT last-modified Wed, 11 Jan 1984 08:00:00 GMT server nginx status 200 content-type image/jpeg access-control-allow-origin * cache-control max-age=300 content-disposition inline; filename="none.png" accept-ranges bytes link <http://www.gravatar.com/avatar/?s=96&d=mm&r=g>; rel="canonical" content-length 1528 expires Thu, 22 Oct 2020 02:38:05 GMT
GET H2	200	GettyImages-630047974-1024x683.jpg www.scmagazine.com/wp-content/uploads/sites/2/2020/08/	106 KB 106 KB	483ms 483ms	Image image/jpeg	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.scmagazine.com/wp-content/uploads/sites/2/2020/08/GettyImages-630047974-1024x683.jpg Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dcc6f3e870333d7408f543f7085b40b8aa8a1ea7ef0aa36f39724bcd8bdaf390 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:06 GMT x-content-type-options nosniff cf-cache-status MISS nel {"report_to":"cf-nel","max_age":604800} status 200 vary Accept-Encoding content-length 108268 cf-request-id 05efc02e3400002c429f3ce000000001 last-modified Thu, 27 Aug 2020 17:45:18 GMT server cloudflare etag "5f47f12e-1a6ec" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333986"}],"group":"cf-nel","max_age":604800} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 5e5fcfc38d792c42-FRA
GET H2	200	spinner.svg www.scmagazine.com/wp-content/themes/haymarket/assets/svg/src/	694 B 499 B	12ms 12ms	Image image/svg+xml	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.scmagazine.com/wp-content/themes/haymarket/assets/svg/src/spinner.svg Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash abb1dd7905b3797711e15609800d43cabead4c0358dc0030a1932a20e82a37d7 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:06 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 16824320 status 200 vary Accept-Encoding, Accept-Encoding, Accept-Encoding cf-request-id 05efc0307400002c4298ba0000000001 last-modified Tue, 17 Dec 2019 09:37:16 GMT server cloudflare etag W/"5df8a1cc-2b6" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333986"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5e5fcfc71ad32c42-FRA cf-bgj h2pri
GET H2	200	gtm.js Show response www.googletagmanager.com/	149 KB 49 KB	47ms 27ms	Script application/javascript	2a00:1450:4001:806::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-MHZ6C39 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash bc2f72829e40b3da3decb81df13f94a3bf99def2409a026cdade9eb718ea3f9e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:06 GMT content-encoding br vary Accept-Encoding status 200 cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 49343 x-xss-protection 0 last-modified Thu, 22 Oct 2020 00:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 22 Oct 2020 02:33:06 GMT
GET H2	200	email-decode.min.js Show response www.scmagazine.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/	1 KB 1 KB	11ms 10ms	Script application/javascript	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:05 GMT content-encoding gzip x-content-type-options nosniff nel {"report_to":"cf-nel","max_age":604800} status 200 vary Accept-Encoding cf-request-id 05efc02da400002c4279b5f000000001 last-modified Wed, 14 Oct 2020 13:38:00 GMT server cloudflare x-frame-options SAMEORIGIN etag W/"5f86ff38-4d7" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333986"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=172800, public cf-ray 5e5fcfc29c2b2c42-FRA expires Sat, 24 Oct 2020 02:33:05 GMT
GET H2	200	Kaspersky_getty-scaled-e1598303018659-150x150.jpg www.scmagazine.com/wp-content/uploads/sites/2/2020/08/	10 KB 10 KB	305ms 305ms	Image image/jpeg	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.scmagazine.com/wp-content/uploads/sites/2/2020/08/Kaspersky_getty-scaled-e1598303018659-150x150.jpg Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7977b4e4f640b8099f1f05d09b568d190977386a69173baef976892ea52eadd9 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:06 GMT x-content-type-options nosniff cf-cache-status MISS nel {"report_to":"cf-nel","max_age":604800} status 200 vary Accept-Encoding content-length 9890 cf-request-id 05efc030aa00002c4279b8b000000001 last-modified Mon, 24 Aug 2020 21:03:38 GMT server cloudflare etag "5f442b2a-26a2" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333987"}],"group":"cf-nel","max_age":604800} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 5e5fcfc77b572c42-FRA
GET H2	200	2b6d39d680de90da3cea5ebacea7f74c744475a9-v3.js Show response content.maropost.com/uploads/1325/websites/1/	3 KB 3 KB	58ms 8ms	Script text/plain	2600:9000:2057:6600:a:1779:3180:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://content.maropost.com/uploads/1325/websites/1/2b6d39d680de90da3cea5ebacea7f74c744475a9-v3.js?ver=1.1 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:6600:a:1779:3180:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 0c7e4012cb73f8c0836fa8aee34bb0da2250b5af84d0c4a1959d60764597f05a Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 21 Oct 2020 04:11:30 GMT via 1.1 71b147cd3102755b55ba8b6fd34e3f4a.cloudfront.net (CloudFront) last-modified Thu, 13 Dec 2018 20:46:06 GMT server AmazonS3 age 80497 etag "33bca5680760348835deea8e5dcbdb62" x-cache Hit from cloudfront status 200 x-amz-cf-pop FRA6-C1 accept-ranges bytes content-length 2565 x-amz-cf-id oThNPm8dzpazQvQr1IJk3l395kkhW4bd705EkMTJy02hr8ab5l5I9Q==
GET H2	200	blocks.min.js Show response www.scmagazine.com/wp-content/themes/haymarket/dist/js/	7 KB 3 KB	10ms 10ms	Script application/javascript	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/wp-content/themes/haymarket/dist/js/blocks.min.js?ver=1602013507 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b421ab18e7ddb3cce7b3aab8d1e0eee05e60d080aef800c2cfd3b8e1d0a32971 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 1320196 status 200 vary Accept-Encoding, Accept-Encoding, Accept-Encoding cf-request-id 05efc02db000002c42940f8000000001 last-modified Tue, 06 Oct 2020 19:45:07 GMT server cloudflare etag W/"5f7cc943-1b54" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333986"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5e5fcfc2bc482c42-FRA
GET H2	200	feather-tool.js Show response www.scmagazine.com/wp-content/plugins/hm-feathr-tool/js/	548 B 557 B	14ms 12ms	Script application/javascript	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/wp-content/plugins/hm-feathr-tool/js/feather-tool.js?ver=1.2 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 579a9beff0c400b8b0e87f99d32c3ec8b2b3232232d6ac63438434a0a0d7a8b7 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:06 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 16821454 status 200 vary Accept-Encoding, Accept-Encoding, Accept-Encoding cf-request-id 05efc030d400002c42932e2000000001 last-modified Tue, 17 Dec 2019 09:37:14 GMT server cloudflare etag W/"5df8a1ca-224" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333987"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5e5fcfc7bbc82c42-FRA
GET H2	200	hm-olytics-page-tag.js Show response www.scmagazine.com/wp-content/plugins/hm-olytics-beacon/js/	103 B 181 B	15ms 13ms	Script application/javascript	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/wp-content/plugins/hm-olytics-beacon/js/hm-olytics-page-tag.js?ver=1.0 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1b79426177f0c17d98c2ffe3aee5403f1f2a50b85d7177080cd06cfc37e2a300 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:06 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 3705617 status 200 vary Accept-Encoding, Accept-Encoding cf-request-id 05efc030d400002c4288152000000001 last-modified Tue, 17 Dec 2019 09:37:14 GMT server cloudflare etag W/"5df8a1ca-67" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333987"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5e5fcfc7bbca2c42-FRA
GET H/1.1	200 OK	hmi-registration-ui.manifest.js Show response s3.amazonaws.com/haymarket-reg-js/develop/production/	870 B 1 KB	405ms 127ms	Script application/javascript	52.217.69.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3.amazonaws.com/haymarket-reg-js/develop/production/hmi-registration-ui.manifest.js?ver=0.1.1 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.217.69.94 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash 5e8095cad5b71456e02e88835892814dba44009f6403b5a84416db008e5d357f Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 22 Oct 2020 02:33:07 GMT Last-Modified Tue, 11 Aug 2020 02:56:01 GMT Server AmazonS3 x-amz-request-id 49A2EC07ADB66117 ETag "da9d29c4843b0bac5dd6ef34da93b22e" Content-Type application/javascript x-amz-version-id lBVwAglHDmp6fLxZy4fz12pXZDZUxHyZ Accept-Ranges bytes Content-Length 870 x-amz-id-2 dv/Bq2BvI9WhisXaHByU7Hs1YsToAWNa8+eTVLUKRVR5L8xE5TBEomPX1YFagoj6+U9ivDiAA2g=
GET H/1.1	200 OK	hmi-registration-ui.vendor.js Show response s3.amazonaws.com/haymarket-reg-js/develop/production/	357 KB 357 KB	392ms 112ms	Script application/javascript	52.217.69.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3.amazonaws.com/haymarket-reg-js/develop/production/hmi-registration-ui.vendor.js?ver=0.1.1 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.217.69.94 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash 8e1c678764d16a66f783dfd8bee93916cf2b055635cef0362bc0640b610df5b5 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 22 Oct 2020 02:33:07 GMT Last-Modified Tue, 11 Aug 2020 02:56:01 GMT Server AmazonS3 x-amz-request-id 8YAJCVDV8H1K7R2G ETag "3d50e45eac853d7ff5898c6e8355f1cb" Content-Type application/javascript x-amz-version-id wulLLPFCPRcEdDRYL1_1QW.A2D.Je67N Accept-Ranges bytes Content-Length 365126 x-amz-id-2 Q5FzgoWB/lXO7apMptHKQKKa7byXTN+v9GYCYK6JDLxc1bgBOtG46HBhCeNqWvciqh40Q1ETThQ=
GET H/1.1	200 OK	hmi-registration-ui.bundle.js Show response s3.amazonaws.com/haymarket-reg-js/develop/production/	1 MB 1 MB	392ms 112ms	Script application/javascript	52.217.69.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3.amazonaws.com/haymarket-reg-js/develop/production/hmi-registration-ui.bundle.js?ver=0.1.1 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.217.69.94 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1.amazonaws.com Software AmazonS3 / Resource Hash f8c3bc6b4612e018296f32dec014b0e8d4c8ef0c7ff449f26a28b641d3497da1 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 22 Oct 2020 02:33:07 GMT Last-Modified Tue, 11 Aug 2020 02:56:01 GMT Server AmazonS3 x-amz-request-id 7415ED3076F01B27 ETag "7f48d5418252c54a9baf9ce1a74980be" Content-Type application/javascript x-amz-version-id P5VRJucwn2qmvNWevdaMGPbAlXCLHFuw Accept-Ranges bytes Content-Length 1322506 x-amz-id-2 mM6T6gYl88rUp8o55bJnnsluPiuureF1IdNhVTGh5WCenBzRUB+Efvopzm5qZ21jTH6sHdsOOCc=
GET H2	200	frontend.min.js Show response www.scmagazine.com/wp-content/themes/haymarket/dist/js/	139 KB 34 KB	15ms 15ms	Script application/javascript	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/wp-content/themes/haymarket/dist/js/frontend.min.js?ver=1602013507 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d92ccaf2a33b612e982428c2367bbb80f08656fe342b004583b39a6dc74191fa Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 1320195 status 200 vary Accept-Encoding, Accept-Encoding, Accept-Encoding cf-request-id 05efc02dbb00002c4293ac7000000001 last-modified Tue, 06 Oct 2020 19:45:07 GMT server cloudflare etag W/"5f7cc943-22b01" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333986"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5e5fcfc2cc672c42-FRA
GET H2	200	iab.min.js Show response www.scmagazine.com/wp-content/themes/haymarket/dist/js/	8 KB 2 KB	10ms 10ms	Script application/javascript	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/wp-content/themes/haymarket/dist/js/iab.min.js?ver=1602013507 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f1d0b1a9de0c9552e3fa4072ae4007a3a98a1855fc2736dd46dacaf121441eed Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 1320195 status 200 vary Accept-Encoding, Accept-Encoding, Accept-Encoding cf-request-id 05efc02dd000002c428811e000000001 last-modified Tue, 06 Oct 2020 19:45:07 GMT server cloudflare etag W/"5f7cc943-1ecd" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333986"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5e5fcfc2ec982c42-FRA
GET H2	200	wp-embed.min.js Show response www.scmagazine.com/wp-includes/js/	1 KB 803 B	12ms 11ms	Script application/javascript	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/wp-includes/js/wp-embed.min.js?ver=5.4.2 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 11048212 status 200 vary Accept-Encoding, Accept-Encoding, Accept-Encoding cf-request-id 05efc02ddb00002c4298b76000000001 last-modified Sat, 26 Oct 2019 00:17:07 GMT server cloudflare etag W/"5db39083-59a" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333986"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5e5fcfc2fcb22c42-FRA
GET H/1.1	200	olytics.min.js Show response olytics.omeda.com/olytics/js/v3/p/	278 KB 76 KB	114ms 113ms	Script application/javascript	204.180.130.159 QTS-AS
General Check archive.org Show headers Download Go to Full URL https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/wp-content/plugins/hm-olytics-beacon/js/hm-olytics-beacon.js?ver=1.0 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 204.180.130.159 Chicago, United States, ASN53866 (QTS-AS, US), Reverse DNS my.omedastaging.com Software Apache / Resource Hash a8afaefe255b45755c5041cbbd717295b2ba949b7ab6fa43d4e7300e7adff9a2 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 22 Oct 2020 02:33:05 GMT Content-Encoding gzip X-Content-Type-Options nosniff Last-Modified Thu, 27 Aug 2020 15:49:06 GMT Server Apache ETag W/"284296-1598543346000" X-Frame-Options SAMEORIGIN Content-Type application/javascript Access-Control-Allow-Origin * Cache-Control max-age=21600 Transfer-Encoding chunked Accept-Ranges bytes vary accept-encoding X-XSS-Protection 1; mode=block Expires Thu, 22 Oct 2020 08:33:06 GMT
GET H2	200	src.svg www.scmagazine.com/wp-content/themes/haymarket/assets/svg/	33 KB 9 KB	16ms 15ms	Other image/svg+xml	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/wp-content/themes/haymarket/assets/svg/src.svg?ver=1576575436 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 866e74600600f8647c979414828f3538d646101dc8504de84c2ed00e30460811 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:06 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 3705617 status 200 vary Accept-Encoding, Accept-Encoding, Accept-Encoding cf-request-id 05efc030d400002c42d9053000000001 last-modified Tue, 17 Dec 2019 09:37:16 GMT server cloudflare etag W/"5df8a1cc-8317" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333987"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 5e5fcfc7bbcc2c42-FRA
GET H2	200	S6uyw4BMUTPHjx4wXiWtFCc.woff2 fonts.gstatic.com/s/lato/v17/	14 KB 14 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:808::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjx4wXiWtFCc.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato:400,400i,700,700i Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://www.scmagazine.com Referer https://fonts.googleapis.com/css?family=Lato:400,400i,700,700i User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 21 Oct 2020 11:20:36 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:12:59 GMT server sffe age 54750 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14044 x-xss-protection 0 expires Thu, 21 Oct 2021 11:20:36 GMT
GET H2	200	pubads_impl_2020101501.js Show response securepubads.g.doubleclick.net/gpt/	272 KB 96 KB	115ms 59ms	Script text/javascript	216.58.208.34 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/tag/js/gpt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.208.34 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra15s12-in-f34.1e100.net Software sffe / Resource Hash 81769ec6be856e69d17c22fdbf79b9e05b7c0ece06edc79db4114a8567298643 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:06 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 15 Oct 2020 08:42:23 GMT server sffe vary Accept-Encoding content-type text/javascript status 200 cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 97658 x-xss-protection 0 expires Thu, 22 Oct 2020 02:33:06 GMT
GET H3-Q050	200	S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2 fonts.gstatic.com/s/lato/v17/	14 KB 14 KB	27ms 13ms	Font font/woff2	2a00:1450:4001:808::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato:400,400i,700,700i Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://www.scmagazine.com Referer https://fonts.googleapis.com/css?family=Lato:400,400i,700,700i User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 21 Oct 2020 11:20:44 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:12:25 GMT server sffe age 54742 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14176 x-xss-protection 0 expires Thu, 21 Oct 2021 11:20:44 GMT
GET H3-Q050	200	S6u8w4BMUTPHjxsAXC-qNiXg7Q.woff2 fonts.gstatic.com/s/lato/v17/	15 KB 15 KB	26ms 13ms	Font font/woff2	2a00:1450:4001:808::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v17/S6u8w4BMUTPHjxsAXC-qNiXg7Q.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato:400,400i,700,700i Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash fe4bbdad1d6dff75cde79f8afc07f29502bd4708cb0ce5f552083c3d81ba8382 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://www.scmagazine.com Referer https://fonts.googleapis.com/css?family=Lato:400,400i,700,700i User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 19 Oct 2020 14:56:36 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:12:59 GMT server sffe age 214590 status 200 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14864 x-xss-protection 0 expires Tue, 19 Oct 2021 14:56:36 GMT
GET H2	200	list-red-circle.png www.scmagazine.com/wp-content/themes/haymarket/assets/images/src/	172 B 311 B	17ms 17ms	Image image/png	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.scmagazine.com/wp-content/themes/haymarket/assets/images/src/list-red-circle.png Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/wp-content/themes/haymarket/dist/css/style.min.css?ver=1602013507 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0be7154007bc03ccee72d7901b8591d4fd26ba6a7ec0c3db435b0089506cc867 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/wp-content/themes/haymarket/dist/css/style.min.css?ver=1602013507 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:06 GMT x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 1319808 status 200 vary Accept-Encoding content-length 172 cf-request-id 05efc0312700002c4296190000000001 last-modified Tue, 06 Oct 2020 19:45:07 GMT server cloudflare etag "5f7cc943-ac" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333987"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 5e5fcfc83c772c42-FRA
GET H2	200	lio.js Show response c.lytics.io/api/tag//	40 B 582 B	33ms 11ms	Script application/javascript	2606:4700:20::681a:316 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://c.lytics.io/api/tag//lio.js Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/wp-content/themes/haymarket/dist/js/frontend.min.js?ver=1602013507 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:316 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6557812bb342a14c23635e24733f11e5752f9807a85053be80b6fbd955a34ed9 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:06 GMT via 1.1 google cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 4690 status 200 content-encoding br cf-request-id 05efc031900000d6d5fa297000000001 server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333987"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=7200 cf-ray 5e5fcfc8ed0cd6d5-FRA
GET H2	200	most-widget Show response www.scmagazine.com/wp-json/haymarket/v1/	5 KB 1 KB	761ms 760ms	XHR application/json	2606:4700:20::681a:2d7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.scmagazine.com/wp-json/haymarket/v1/most-widget?id=most-5 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/wp-content/themes/haymarket/dist/js/frontend.min.js?ver=1602013507 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:2d7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / WP Engine Resource Hash 7c0a26729b5c2f093e46e324a1947395572d1a3540775c7f993531f402a34404 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:07 GMT content-encoding br x-content-type-options nosniff cf-cache-status DYNAMIC nel {"report_to":"cf-nel","max_age":604800} x-powered-by WP Engine status 200 vary Accept-Encoding, Accept-Encoding, Origin cf-request-id 05efc0317d00002c429b918000000001 access-control-allow-headers Authorization, Content-Type allow GET server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15552000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333987"}],"group":"cf-nel","max_age":604800} content-type application/json; charset=UTF-8 access-control-expose-headers X-WP-Total, X-WP-TotalPages x-robots-tag noindex cf-ray 5e5fcfc8cd5e2c42-FRA link <https://www.scmagazine.com/wp-json/>; rel="https://api.w.org/" x-pass-why custom-path
GET H2	200	analytics.js Show response www.google-analytics.com/	45 KB 19 KB	25ms 6ms	Script text/javascript	2a00:1450:4001:824::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MHZ6C39 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Wed, 09 Sep 2020 01:50:37 GMT server Golfe2 age 4638 date Thu, 22 Oct 2020 01:15:48 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18650 expires Thu, 22 Oct 2020 03:15:48 GMT
GET H2	410	7341.js script.crazyegg.com/pages/scripts/0034/	0 0	28ms 13ms	Script application/javascript	2606:4700::6813:9308 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/scripts/0034/7341.js?445371 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MHZ6C39 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:06 GMT cf-cache-status HIT last-modified Wed, 21 Oct 2020 18:28:59 GMT server cloudflare age 29046 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 410 cache-control public, max-age=86400, s-maxage=86400 cf-ray 5e5fcfc8f88c2bdd-FRA content-length 0 cf-request-id 05efc0319700002bdd0406b000000001
GET H/1.1	200 OK	up_loader.1.1.0.js Show response js.adsrvr.org/	4 KB 2 KB	84ms 26ms	Script application/x-javascript	143.204.97.161 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.adsrvr.org/up_loader.1.1.0.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MHZ6C39 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 143.204.97.161 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-97-161.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 21 Oct 2020 09:53:47 GMT Content-Encoding gzip Last-Modified Thu, 24 Sep 2020 15:15:34 GMT Server AmazonS3 Age 59960 ETag "98d98b3499058b76d58073cf8ede2f10" Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type application/x-javascript Via 1.1 32c8da10203574baccb74b8f771a7ffb.cloudfront.net (CloudFront) Connection keep-alive Transfer-Encoding chunked X-Amz-Cf-Pop FRA50-C1 X-Amz-Cf-Id _UuwS5c5pxPLIKQNp0tWyvbJCykQ3BU4TNmHVuEsv-viA1DNpUUHpQ==
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	965 B 761 B	22ms 7ms	Script application/x-javascript	2a02:26f0:6c00:296::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:296::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 22 Oct 2020 02:33:06 GMT Content-Encoding gzip Last-Modified Tue, 22 Sep 2020 22:01:48 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=25823 Connection keep-alive Accept-Ranges bytes Content-Length 448
GET H/1.1	200 OK	embed-QBgAucLna4Y07yLf.js Show response api-34-220-64-140.b2c.com/api/ Redirect Chain https://api.b2c.com/api/init-131xlxqjsfx7lh82dpc.js https://api-34-220-64-140.b2c.com/api/embed-QBgAucLna4Y07yLf.js	12 KB 5 KB	514ms 171ms	Script text/javascript	2600:1f14:e96:5802:5267:3824:69b2:3922 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api-34-220-64-140.b2c.com/api/embed-QBgAucLna4Y07yLf.js Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:1f14:e96:5802:5267:3824:69b2:3922 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software openresty / Resource Hash 857634852cd8b30d4ce53a36eaa5c133ead262258344feed9ab25f7c1c432a6f Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Thu, 22 Oct 2020 02:33:07 GMT Content-Encoding gzip Server openresty Transfer-Encoding chunked Content-Type text/javascript Cache-Control no-cache, no-store, must-revalidate Connection keep-alive Expires -1 Redirect headers pragma no-cache date Thu, 22 Oct 2020 02:33:07 GMT server openresty status 307 content-type text/html; charset=utf-8 location //api-34-220-64-140.b2c.com/api/embed-QBgAucLna4Y07yLf.js cache-control no-cache, no-store, must-revalidate content-length 168 expires -1
GET H/1.1	200 OK	dpm_00fd4b4549a1094aae926ef62e9dbd3cdcc2e456.min.js Show response s.dpmsrv.com/	108 KB 38 KB	148ms 47ms	Script application/x-javascript	99.86.2.75 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.dpmsrv.com/dpm_00fd4b4549a1094aae926ef62e9dbd3cdcc2e456.min.js Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 99.86.2.75 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-2-75.fra6.r.cloudfront.net Software AmazonS3 / Resource Hash c0e1496a92d5756e5d4da2993d5bf9af1d22fdf9afef1a830b044f9bee4bbc0e Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 21 Oct 2020 14:48:01 GMT Content-Encoding gzip Last-Modified Tue, 20 Oct 2020 14:40:15 GMT Server AmazonS3 Age 42306 ETag "f646e62f3bcaac64b7fc46d6b66c0ed9" X-Cache Hit from cloudfront Content-Type application/x-javascript Via 1.1 c26b8e74df43cd99786e716221463d0c.cloudfront.net (CloudFront) Connection keep-alive X-Amz-Cf-Pop FRA6-C1 Accept-Ranges bytes Content-Length 38263 X-Amz-Cf-Id irTboTGazd0ueJwxjPse74k-h8zQNZ_KynRgBLMfaxnBJcfxRGoxig==
GET H2	200	boomerang.min.js Show response cdn.feathr.co/js/	114 KB 35 KB	41ms 18ms	Script application/javascript	2606:4700:3033::681c:60b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.feathr.co/js/boomerang.min.js Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/wp-content/plugins/hm-feathr-tool/js/feather-tool.js?ver=1.2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::681c:60b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 806c9975656fb05571e902f1154303c7b1553ae12444ca54da5b1a150007146c Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:06 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 2585 status 200 x-amz-request-id CB7C53CB3D25A612 x-amz-id-2 mZmoaZSmgoWEDE7rw2TnzKHiOwqZWlCMBB5w0bGe2gcbVYKxaTjRJBI/ZBW84RruGzH4VNKC3ZA= last-modified Wed, 06 May 2020 17:47:20 GMT server cloudflare etag W/"360b036656090b581ae5d1ecb2572847" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603333987"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-request-id 05efc031b700002bf6c788a000000001 cf-ray 5e5fcfc92bdf2bf6-FRA
GET H/1.1	200 OK	insight.old.min.js Show response snap.licdn.com/li.lms-analytics/	3 KB 2 KB	6ms 6ms	Script application/x-javascript	2a02:26f0:6c00:296::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.old.min.js Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:296::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 22 Oct 2020 02:33:06 GMT Content-Encoding gzip Last-Modified Thu, 03 Sep 2020 20:29:41 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=9428 Connection keep-alive Accept-Ranges bytes Content-Length 1576
GET H3-Q050	200	js Show response www.google-analytics.com/gtm/	82 KB 33 KB	39ms 25ms	Script application/javascript	2a00:1450:4001:824::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/gtm/js?id=GTM-TCMLVLP&t=gtm2&cid=1688487307.1603333987 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash b206b32b926b9db958833db524381f010191f692972de08ee617fc24ad87bea3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:06 GMT content-encoding br vary Accept-Encoding status 200 cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 32999 x-xss-protection 0 last-modified Thu, 22 Oct 2020 00:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 22 Oct 2020 02:33:06 GMT
GET H2	200	collect px.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=68780&url=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D68780%26url%3Dhttps%253A%252F%252Fwww.scmagazine.com%252Fhome%252Fsecurity-news%2... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=68780&url=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain...	0 82 B	152ms 151ms	Image application/javascript	2a05:f500:11:101::b93f:9005 LINKEDIN
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=68780&url=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&time=1603333986734&liSync=true Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US), Reverse DNS Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:07 GMT server Play linkedin-action 1 x-li-fabric prod-ltx1 status 200 x-li-proto http/2 x-li-pop prod-tln1 content-type application/javascript content-length 0 x-li-uuid mg+UN8QvQBYQ+XCNFysAAA== Redirect headers content-security-policy default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self' x-content-type-options nosniff linkedin-action 1 status 302 content-length 0 x-li-uuid Tn1UMcQvQBYANsSKISsAAA== pragma no-cache x-li-pop afd-prod-eda6 x-msedge-ref Ref A: DB845A2B38BA4279AA438435F61E2A52 Ref B: FRAEDGE0710 Ref C: 2020-10-22T02:33:06Z x-frame-options sameorigin date Thu, 22 Oct 2020 02:33:06 GMT expect-ct max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct" strict-transport-security max-age=2592000 x-li-fabric prod-ltx1 location https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=68780&url=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&time=1603333986734&liSync=true x-xss-protection 1; mode=block cache-control no-cache, no-store x-li-proto http/2 expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	integrator.js Show response adservice.google.de/adsid/	109 B 832 B	40ms 16ms	Script application/javascript	2a00:1450:4001:81b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.js?domain=www.scmagazine.com Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Thu, 22 Oct 2020 02:33:06 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." status 200 cache-control private, no-cache, no-store content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 104 x-xss-protection 0
GET H2	200	integrator.js Show response adservice.google.com/adsid/	109 B 890 B	39ms 15ms	Script application/javascript	2a00:1450:4001:808::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=www.scmagazine.com Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Thu, 22 Oct 2020 02:33:06 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." status 200 cache-control private, no-cache, no-store content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 104 x-xss-protection 0
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	423 B 948 B	100ms 65ms	XHR text/plain	216.58.208.34 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1656549171789661&correlator=2121429086647299&output=ldjh&impl=fif&eid=21067995%2C21068063%2C21067575%2C21067753%2C21065725&vrg=2020101501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201022&iu_parts=21883553441%2CSkin&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ists=1&prev_scp=pos%3D&eri=1&cust_params=pagetype%3Dpost%26author%3DBradley%2520Barth%26postID%3D106972%26env%3Dlive%26sid%3DCybercrime%252CFeatured%252CMalware%252CSecurity_News%26cat%3DCybercrime%252CMalware%26isnht%3Dfalse&cookie_enabled=1&bc=31&abxe=1&lmt=1603333986&dt=1603333986763&dlt=1603333985646&idt=1093&frm=20&biw=1600&bih=1200&oid=2&adxs=200&adys=0&adks=1385187290&ucis=1&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&dssz=58&icsg=1125822769333236&mso=67108864&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x2684&msz=1200x-1&ga_vid=1688487307.1603333987&ga_sid=1603333987&ga_hid=1493090389&fws=516&ohw=1600&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfV0. Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.208.34 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra15s12-in-f34.1e100.net Software cafe / Resource Hash bd93c5043d6c7e5e3dc68ed3677c91a4e35348af92ecf8669dd4ec43b1cd1feb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:06 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 231 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.scmagazine.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	container.html 866a951618a819029c0e8b343d8b5bf1.safeframe.googlesyndication.com/safeframe/1-0-37/html/	0 0	65ms 14ms	Other text/html	2a00:1450:4001:800::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://866a951618a819029c0e8b343d8b5bf1.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H2	200	container.html tpc.googlesyndication.com/safeframe/1-0-37/html/	0 0	30ms 6ms	Other text/html	2a00:1450:4001:816::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	423 B 257 B	101ms 68ms	XHR text/plain	216.58.208.34 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1656549171789661&correlator=2121429086647299&output=ldjh&impl=fif&eid=21067995%2C21068063%2C21067575%2C21067753%2C21065725&vrg=2020101501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201022&iu_parts=21883553441%2CPrestitial&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ists=1&prev_scp=pos%3D&eri=1&cust_params=pagetype%3Dpost%26author%3DBradley%2520Barth%26postID%3D106972%26env%3Dlive%26sid%3DCybercrime%252CFeatured%252CMalware%252CSecurity_News%26cat%3DCybercrime%252CMalware%26isnht%3Dfalse&cookie_enabled=1&bc=31&abxe=1&lmt=1603333986&dt=1603333986772&dlt=1603333985646&idt=1093&frm=20&biw=1600&bih=1200&oid=2&adxs=0&adys=2683&adks=1753008912&ucis=2&ifi=2&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&dssz=58&icsg=1125822769333236&mso=67108864&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x2684&msz=1600x1&ga_vid=1688487307.1603333987&ga_sid=1603333987&ga_hid=1493090389&fws=4&ohw=1600&btvi=1&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfV0. Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.208.34 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra15s12-in-f34.1e100.net Software cafe / Resource Hash 7e7f9bb2d409f27af6ec97a7c3917928fdc885b791980427b1c4c8616ae48288 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:06 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 224 x-xss-protection 0 google-lineitem-id -2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.scmagazine.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	integrations Show response polo.feathr.co/v1/accounts/5c2d2a2366bba411c7d26e37/	31 B 363 B	303ms 97ms	XHR application/json	34.231.179.184 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://polo.feathr.co/v1/accounts/5c2d2a2366bba411c7d26e37/integrations Requested by Host: cdn.feathr.co URL: https://cdn.feathr.co/js/boomerang.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.231.179.184 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-231-179-184.compute-1.amazonaws.com Software nginx/1.17.8 / Resource Hash 559382b44a7cb0b397c474fe76532f50b622824e15440784425d1f4a42a991de Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:07 GMT server nginx/1.17.8 status 200 strict-transport-security max-age=15724800; includeSubDomains access-control-allow-methods GET, POST, PUT, OPTIONS content-type application/json access-control-allow-origin * access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization content-length 31
GET H2	200	refresh marco.feathr.co/v1/	43 B 584 B	197ms 129ms	Image image/gif	13.225.73.5 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://marco.feathr.co/v1/refresh Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.73.5 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-73-5.fra2.r.cloudfront.net Software / Resource Hash 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:06 GMT via 1.1 882f747f39885162595630c95dd0012d.cloudfront.net (CloudFront) x-amz-cf-pop FRA2-C2 x-amzn-requestid 51c8582a-df77-4c2a-a9d0-8d9d3045a22b status 200 access-control-allow-methods * content-type image/gif access-control-allow-origin * x-amzn-trace-id Root=1-5f90ef62-781a8d3d36b0e1b36daf7ebb;Sampled=0 x-cache Miss from cloudfront x-amz-apigw-id UypXeGZOoAMFfbg= content-length 43 x-amz-cf-id 1dBbew7P_MOC87QoYWB-OMa1QSi0H3npOWxvvxDDFESjO56YfE0g1A== access-control-allow-headers Content-Type,X-Amz-Date,Authorization,X-Api-Key
POST H3-Q050	200	collect Show response www.google-analytics.com/j/	2 B 169 B	13ms 13ms	XHR text/plain	2a00:1450:4001:824::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j86&a=1493090389&t=pageview&_s=1&dl=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&ul=en-us&de=UTF-8&dt=Exclusive%3A%20Trojan%20apparently%20infects%20NCR%2C%20posing%20possible%20supply-chain%20risk&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAAAADQAAAAC~&jid=1018980413&gjid=953607289&cid=1688487307.1603333987&tid=UA-1290429-10&_gid=391113732.1603333987&_r=1&gtm=2wg9u1MHZ6C39&cd1=106972%3A0&cd2=cybercrime%2Cmalware&cd3=Bradley%20Barth&cd4=75&cd5=post&cd6=News&cd7=&cd9=2020-08-27&cd10=1052&cd12=&cd14=&cd15=&z=39867395 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 22 Oct 2020 02:33:06 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 status 200 content-type text/plain access-control-allow-origin https://www.scmagazine.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
HEAD H2	200	adsbygoogle.js pagead2.googlesyndication.com/pagead/js/	0 0	45ms 24ms	Fetch text/javascript	2a00:1450:4001:81b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Requested by Host: olytics.omeda.com URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Thu, 22 Oct 2020 02:33:06 GMT content-encoding gzip x-content-type-options nosniff server cafe etag 6075935504648170439 vary Accept-Encoding p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control private, max-age=3600 content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 expires Thu, 22 Oct 2020 02:33:06 GMT
OPTIONS H/1.1	200	olytics oqs.omeda.com/oqs/rest/ Frame	0 0	566ms 113ms	Other text/plain	204.180.130.165 QTS-AS
General Check archive.org Show headers Download Go to Full URL https://oqs.omeda.com/oqs/rest/olytics Protocol HTTP/1.1 Server 204.180.130.165 Chicago, United States, ASN53866 (QTS-AS, US), Reverse DNS Software Apache / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type Origin https://www.scmagazine.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Sec-Fetch-Mode cors Response headers X-Frame-Options SAMEORIGIN X-Content-Type-Options nosniff X-XSS-Protection 1; mode=block Access-Control-Max-Age 600 Access-Control-Allow-Origin * Access-Control-Allow-Headers Access-Control-Request-Headers, Content-Type, Origin, Accept, Accept-Encoding, Accept-Language, HOST, User-Agent, Access-Control-Request-Method, Access-Control-Max-Age Content-Type text/plain Content-Length 0 Date Thu, 22 Oct 2020 02:33:07 GMT Server Apache
POST H/1.1	200	olytics Show response oqs.omeda.com/oqs/rest/	15 B 307 B	126ms 126ms	XHR application/json	204.180.130.165 QTS-AS
General Check archive.org Show headers Download Go to Full URL https://oqs.omeda.com/oqs/rest/olytics Requested by Host: olytics.omeda.com URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 204.180.130.165 Chicago, United States, ASN53866 (QTS-AS, US), Reverse DNS Software Apache / Resource Hash 8f78cfd70561bfbb767311940126a4ccdfe36f1b955a5fd385df8617bca6417a Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/json Response headers Date Thu, 22 Oct 2020 02:33:06 GMT X-Content-Type-Options nosniff Server Apache X-Frame-Options SAMEORIGIN Content-Type application/json Access-Control-Allow-Origin * Cache-Control no-cache Transfer-Encoding chunked X-XSS-Protection 1; mode=block
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 469 B	41ms 14ms	XHR text/plain	2a00:1450:400c:c04::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-1290429-10&cid=1688487307.1603333987&jid=1018980413&gjid=953607289&_gid=391113732.1603333987&_u=aGDAAAACQAAAAC~&z=1474757286 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c04::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Thu, 22 Oct 2020 02:33:06 GMT status 200 content-type text/plain access-control-allow-origin https://www.scmagazine.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	index.php Show response a.dpmsrv.com/dpmpxl/ Redirect Chain https://ib.adnxs.com/getuid?https://a.dpmsrv.com/dpmpxl/index.php?id=$UID&q%3DxImp%26v%3D1.x%26cl%3D1122%26pixelIndex%3D0%26r%3D633801%26tzOffset%3D-120%26url%3Dhttps%253A%252F%252Fwww.scmagazine.c... https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fa.dpmsrv.com%2Fdpmpxl%2Findex.php%3Fid%3D%24UID%26q%253DxImp%2526v%253D1.x%2526cl%253D1122%2526pixelIndex%253D0%2526r%253D633801%2526tzOffset%2... https://a.dpmsrv.com/dpmpxl/index.php?id=6920249049286326430&q=xImp&v=1.x&cl=1122&pixelIndex=0&r=633801&tzOffset=-120&url=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusi...	250 B 999 B	597ms 93ms	Script text/javascript	34.192.142.95 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://a.dpmsrv.com/dpmpxl/index.php?id=6920249049286326430&q=xImp&v=1.x&cl=1122&pixelIndex=0&r=633801&tzOffset=-120&url=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&_=1603333986895 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.192.142.95 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-192-142-95.compute-1.amazonaws.com Software / Resource Hash 9d6374ce0ccd59acf4b413da77e4afaac0b4027d1b4aa82d6bd45705c5659193 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache content-encoding gzip Access-Control-Max-Age 10 Access-Control-Allow-Methods GET, POST, PUT, DELETE, OPTIONS P3P CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Access-Control-Allow-Origin * Cache-Control no-cache, no-store, must-revalidate Connection keep-alive Content-Type text/javascript Access-Control-Allow-Headers content-type, accept Content-Length 220 Expires 0 Redirect headers Pragma no-cache Date Thu, 22 Oct 2020 02:33:06 GMT X-Proxy-Origin 82.102.18.235; 82.102.18.235; 536.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.47:80 AN-X-Request-Uuid 19330eb8-4e63-4fea-801d-61c8ceb4f95f Server nginx/1.17.9 Access-Control-Allow-Origin * P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Location https://a.dpmsrv.com/dpmpxl/index.php?id=6920249049286326430&q=xImp&v=1.x&cl=1122&pixelIndex=0&r=633801&tzOffset=-120&url=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&_=1603333986895 Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type text/html; charset=utf-8 Content-Length 0 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
HEAD H3-Q050	200	gpt.js www.googletagservices.com/tag/js/	0 0	37ms 22ms	Fetch text/javascript	2a00:1450:4001:81b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/tag/js/gpt.js Requested by Host: olytics.omeda.com URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:06 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "670 / 390 of 1000 / last-modified: 1603318268" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 17688 x-xss-protection 0 expires Thu, 22 Oct 2020 02:33:06 GMT
GET H2	200	ga-audiences www.google.com/ads/	42 B 253 B	17ms 16ms	Image image/gif	2a00:1450:4001:818::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-1290429-10&cid=1688487307.1603333987&jid=1018980413&_u=aGDAAAACQAAAAC~&z=668086673 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Thu, 22 Oct 2020 02:33:06 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-type image/gif alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 513 B	38ms 18ms	Image image/gif	2a00:1450:4001:814::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-1290429-10&cid=1688487307.1603333987&jid=1018980413&_u=aGDAAAACQAAAAC~&z=668086673 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Thu, 22 Oct 2020 02:33:06 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-type image/gif alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	script.js Show response polo.feathr.co/v1/analytics/match/	290 B 566 B	289ms 98ms	Script text/javascript	34.231.179.184 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://polo.feathr.co/v1/analytics/match/script.js?pk=feathr Requested by Host: cdn.feathr.co URL: https://cdn.feathr.co/js/boomerang.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.231.179.184 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-231-179-184.compute-1.amazonaws.com Software nginx/1.17.8 / Resource Hash f39b80c8bca5bf208da293f7c4b1c2291a98317b235c581933d3ed71a31d845e Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:07 GMT content-encoding gzip server nginx/1.17.8 status 200 etag W/"5f90ef62f44f730008f37407" vary Accept-Encoding access-control-allow-methods GET, POST, PUT, OPTIONS content-type text/javascript access-control-allow-origin * cache-control no-cache, max-age=0 access-control-allow-credentials true strict-transport-security max-age=15724800; includeSubDomains access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
GET H2	200	pixel.js Show response polo.feathr.co/v1/accounts/5c2d2a2366bba411c7d26e37/	32 B 397 B	291ms 101ms	Script text/javascript	34.231.179.184 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://polo.feathr.co/v1/accounts/5c2d2a2366bba411c7d26e37/pixel.js?pk=feathr Requested by Host: cdn.feathr.co URL: https://cdn.feathr.co/js/boomerang.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.231.179.184 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-231-179-184.compute-1.amazonaws.com Software nginx/1.17.8 / Resource Hash eacfa4f711eaca1336ff82619c8a2d310dec11266d594fbc7e5a91259cebf848 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:07 GMT server nginx/1.17.8 status 200 strict-transport-security max-age=15724800; includeSubDomains access-control-allow-methods GET, POST, PUT, OPTIONS content-type text/javascript access-control-allow-origin * cache-control must-revalidate, max-age=14400 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization content-length 32
GET H2	200	match polo-v1.feathr.co/v1/analytics/ Redirect Chain https://match.adsrvr.org/track/cmf/generic?ttd_pid=6fgi4r1&ttd_tpi=1&ttd_puid=5f90ef62f44f730008f37407&gdpr=0 https://match.adsrvr.org/track/cmb/generic?ttd_pid=6fgi4r1&ttd_tpi=1&ttd_puid=5f90ef62f44f730008f37407&gdpr=0 https://polo-v1.feathr.co/v1/analytics/match?f_id=5f90ef62f44f730008f37407&ttd_id=be0a3a54-a8db-427e-93c9-16162239fc9a	43 B 402 B	110ms 100ms	Image image/gif	34.231.179.184 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://polo-v1.feathr.co/v1/analytics/match?f_id=5f90ef62f44f730008f37407&ttd_id=be0a3a54-a8db-427e-93c9-16162239fc9a Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.231.179.184 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-231-179-184.compute-1.amazonaws.com Software nginx/1.17.8 / Resource Hash 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:07 GMT server nginx/1.17.8 status 200 strict-transport-security max-age=15724800; includeSubDomains access-control-allow-methods GET, POST, PUT, OPTIONS content-type image/gif access-control-allow-origin * cache-control max-age=0,no-cache,no-store access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization content-length 43 Redirect headers pragma no-cache date Thu, 22 Oct 2020 02:33:07 GMT x-aspnet-version 4.0.30319 status 302 p3p CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV" location https://polo-v1.feathr.co/v1/analytics/match?f_id=5f90ef62f44f730008f37407&ttd_id=be0a3a54-a8db-427e-93c9-16162239fc9a cache-control private,no-cache, must-revalidate content-type text/html content-length 267
GET H2	200	crumb polo.feathr.co/v1/analytics/	43 B 402 B	148ms 148ms	Image image/gif	34.231.179.184 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://polo.feathr.co/v1/analytics/crumb?cb=1603333987461&a_id=5c2d2a2366bba411c7d26e37&f_id=5f90ef62f44f730008f37407&ses_id=5f90ef6246d4f04d3fccdc45&flvr=page_view&loc_url=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&s_w=1600&s_h=1200&b_w=1600&b_h=1200&cust_params=e30= Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.231.179.184 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-231-179-184.compute-1.amazonaws.com Software nginx/1.17.8 / Resource Hash 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:07 GMT server nginx/1.17.8 status 200 strict-transport-security max-age=15724800; includeSubDomains access-control-allow-methods GET, POST, PUT, OPTIONS content-type image/gif access-control-allow-origin * cache-control max-age=0,no-cache,no-store access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization content-length 43
GET H/1.1	200 OK	index.php Show response a.dpmsrv.com/dpmpxl/ Redirect Chain https://cm.g.doubleclick.net/pixel?google_nid=datapoint_dmp&google_cm&ap_id=6920249049286326430&pixelIndex=0&_=1603333986896 https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=6920249049286326430&pixelIndex=0&_=1603333986896&google_gid=CAESEPhcyb-rWYsc9HteyBxTrNE&google_cver=1	0 598 B	92ms 92ms	Script text/javascript	34.192.142.95 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=6920249049286326430&pixelIndex=0&_=1603333986896&google_gid=CAESEPhcyb-rWYsc9HteyBxTrNE&google_cver=1 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.192.142.95 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-192-142-95.compute-1.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Access-Control-Max-Age 10 Access-Control-Allow-Methods GET, POST, PUT, DELETE, OPTIONS P3P CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Access-Control-Allow-Origin * Cache-Control no-cache, no-store, must-revalidate Connection keep-alive Content-Type text/javascript Access-Control-Allow-Headers content-type, accept Content-Length 0 Expires 0 Redirect headers pragma no-cache date Thu, 22 Oct 2020 02:33:07 GMT server HTTP server (unknown) status 302 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=6920249049286326430&pixelIndex=0&_=1603333986896&google_gid=CAESEPhcyb-rWYsc9HteyBxTrNE&google_cver=1 cache-control no-cache, must-revalidate content-type text/html; charset=UTF-8 alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 368 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	451	423396.gif idsync.rlcdn.com/	0 66 B	79ms 31ms	Image text/plain	34.120.207.148 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://idsync.rlcdn.com/423396.gif?partner_uid=6920249049286326430 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.120.207.148 , United States, ASN15169 (GOOGLE, US), Reverse DNS 148.207.120.34.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 451 date Thu, 22 Oct 2020 02:33:07 GMT via 1.1 google alt-svc clear content-length 0
GET H/1.1	200 OK	ad.gif api-34-220-64-140.b2c.com/api/	43 B 233 B	170ms 170ms	Image image/gif	2600:1f14:e96:5802:5267:3824:69b2:3922 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://api-34-220-64-140.b2c.com/api/ad.gif Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:1f14:e96:5802:5267:3824:69b2:3922 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software openresty / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 22 Oct 2020 02:33:07 GMT Last-Modified Mon, 28 Sep 1970 06:00:00 GMT Server openresty Connection keep-alive Content-Length 43 Content-Type image/gif
OPTIONS H/1.1	200	p olytics.omeda.com/olytics/segments/ Frame	0 0	664ms 108ms	Other	204.180.130.159 QTS-AS
General Check archive.org Show headers Download Go to Full URL https://olytics.omeda.com/olytics/segments/p Protocol HTTP/1.1 Server 204.180.130.159 Chicago, United States, ASN53866 (QTS-AS, US), Reverse DNS my.omedastaging.com Software Apache / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type Origin https://www.scmagazine.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Sec-Fetch-Mode cors Response headers Access-Control-Allow-Origin * vary Access-Control-Request-Headers,Access-Control-Request-Headers,access-control-request-method Access-Control-Max-Age 1800 Access-Control-Allow-Methods HEAD,DELETE,POST,GET,OPTIONS,PUT Access-Control-Allow-Headers access-control-max-age,accept-language,origin,x-requested-with,access-control-request-headers,host,content-type,access-control-request-method,accept-encoding,accept,user-agent Content-Length 0 Date Thu, 22 Oct 2020 02:33:07 GMT Server Apache
OPTIONS H/1.1	200	/ olytics.omeda.com/olytics/segments/form/check/ Frame	0 0	665ms 109ms	Other	204.180.130.159 QTS-AS
General Check archive.org Show headers Download Go to Full URL https://olytics.omeda.com/olytics/segments/form/check/ Protocol HTTP/1.1 Server 204.180.130.159 Chicago, United States, ASN53866 (QTS-AS, US), Reverse DNS my.omedastaging.com Software Apache / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type Origin https://www.scmagazine.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Sec-Fetch-Mode cors Response headers Access-Control-Allow-Origin * vary Access-Control-Request-Headers,Access-Control-Request-Headers,access-control-request-method Access-Control-Max-Age 1800 Access-Control-Allow-Methods HEAD,DELETE,POST,GET,OPTIONS,PUT Access-Control-Allow-Headers access-control-max-age,accept-language,origin,x-requested-with,access-control-request-headers,host,content-type,access-control-request-method,accept-encoding,accept,user-agent Content-Length 0 Date Thu, 22 Oct 2020 02:33:08 GMT Server Apache
OPTIONS H/1.1	200	cswitch olytics.omeda.com/olytics/segments/ Frame	0 0	666ms 108ms	Other	204.180.130.159 QTS-AS
General Check archive.org Show headers Download Go to Full URL https://olytics.omeda.com/olytics/segments/cswitch Protocol HTTP/1.1 Server 204.180.130.159 Chicago, United States, ASN53866 (QTS-AS, US), Reverse DNS my.omedastaging.com Software Apache / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type Origin https://www.scmagazine.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Sec-Fetch-Mode cors Response headers Access-Control-Allow-Origin * vary Access-Control-Request-Headers,Access-Control-Request-Headers,access-control-request-method Access-Control-Max-Age 1800 Access-Control-Allow-Methods HEAD,DELETE,POST,GET,OPTIONS,PUT Access-Control-Allow-Headers access-control-max-age,accept-language,origin,x-requested-with,access-control-request-headers,host,content-type,access-control-request-method,accept-encoding,accept,user-agent Content-Length 0 Date Thu, 22 Oct 2020 02:33:07 GMT Server Apache
POST H/1.1	200	p Show response olytics.omeda.com/olytics/segments/	20 B 313 B	128ms 128ms	XHR application/json	204.180.130.159 QTS-AS
General Check archive.org Show headers Download Go to Full URL https://olytics.omeda.com/olytics/segments/p Requested by Host: olytics.omeda.com URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 204.180.130.159 Chicago, United States, ASN53866 (QTS-AS, US), Reverse DNS my.omedastaging.com Software Apache / Resource Hash dd0103b71a9f800bf8509fb3f34f29a1af4b26a10ceef71cea5bb29ae4ea106d Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/json Response headers Date Thu, 22 Oct 2020 02:33:08 GMT X-Content-Type-Options nosniff Server Apache X-Frame-Options SAMEORIGIN Content-Type application/json Access-Control-Allow-Origin * Cache-Control no-cache Transfer-Encoding chunked X-XSS-Protection 1; mode=block
POST H/1.1	200	/ Show response olytics.omeda.com/olytics/segments/form/check/	20 B 313 B	118ms 118ms	XHR application/json	204.180.130.159 QTS-AS
General Check archive.org Show headers Download Go to Full URL https://olytics.omeda.com/olytics/segments/form/check/ Requested by Host: olytics.omeda.com URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 204.180.130.159 Chicago, United States, ASN53866 (QTS-AS, US), Reverse DNS my.omedastaging.com Software Apache / Resource Hash dd0103b71a9f800bf8509fb3f34f29a1af4b26a10ceef71cea5bb29ae4ea106d Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/json Response headers Date Thu, 22 Oct 2020 02:33:08 GMT X-Content-Type-Options nosniff Server Apache X-Frame-Options SAMEORIGIN Content-Type application/json Access-Control-Allow-Origin * Cache-Control no-cache Transfer-Encoding chunked X-XSS-Protection 1; mode=block
POST H/1.1	200	cswitch Show response olytics.omeda.com/olytics/segments/	20 B 313 B	115ms 115ms	XHR application/json	204.180.130.159 QTS-AS
General Check archive.org Show headers Download Go to Full URL https://olytics.omeda.com/olytics/segments/cswitch Requested by Host: olytics.omeda.com URL: https://olytics.omeda.com/olytics/js/v3/p/olytics.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 204.180.130.159 Chicago, United States, ASN53866 (QTS-AS, US), Reverse DNS my.omedastaging.com Software Apache / Resource Hash a8e427db11a8744bebbcdfd050f7b9d0a84b5a1754d086f1787c40db21955264 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/json Response headers Date Thu, 22 Oct 2020 02:33:07 GMT X-Content-Type-Options nosniff Server Apache X-Frame-Options SAMEORIGIN Content-Type application/json Access-Control-Allow-Origin * Cache-Control no-cache Transfer-Encoding chunked X-XSS-Protection 1; mode=block
GET H/1.1	200 OK	index.php Show response a.dpmsrv.com/dpmpxl/	5 B 1 KB	93ms 92ms	Script text/javascript	34.192.142.95 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://a.dpmsrv.com/dpmpxl/index.php?q=xSeg&v=1.x&ep%5Bids%5D=20986004&cl=1122&pixelIndex=0&r=263860&tzOffset=-120&url=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&id=6920249049286326430&_=1603333986897 Requested by Host: s.dpmsrv.com URL: https://s.dpmsrv.com/dpm_00fd4b4549a1094aae926ef62e9dbd3cdcc2e456.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.192.142.95 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-192-142-95.compute-1.amazonaws.com Software / Resource Hash fbc45fe018830de401f0cf801177a57d0039bc72d922b8ff2c82af7af05dd32b Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache content-encoding gzip Access-Control-Max-Age 10 Access-Control-Allow-Methods GET, POST, PUT, DELETE, OPTIONS P3P CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Access-Control-Allow-Origin * Cache-Control no-cache, no-store, must-revalidate Connection keep-alive Content-Type text/javascript Access-Control-Allow-Headers content-type, accept Content-Length 31 Expires 0
GET H/1.1	200 OK	seg ib.adnxs.com/	43 B 1 KB	26ms 25ms	Image image/gif	37.252.173.22 ASN-APPNEX
General Check archive.org Show headers Download Go to Show image Full URL https://ib.adnxs.com/seg?member=%env(APPNEXUS_ID)&add=20986004 Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.173.22 , Ascension Island, ASN29990 (ASN-APPNEX, US), Reverse DNS 536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.17.9 / Resource Hash 4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Thu, 22 Oct 2020 02:33:07 GMT X-Proxy-Origin 82.102.18.235; 82.102.18.235; 536.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.89:80 AN-X-Request-Uuid 281292c6-c54b-4800-819f-8b0907813537 Server nginx/1.17.9 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin * Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type image/gif Content-Length 43 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H3-Q050	200	sodar Show response pagead2.googlesyndication.com/getconfig/	8 KB 7 KB	17ms 17ms	XHR application/json	2a00:1450:4001:81b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020101501&st=env Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 859cfe335fb3a441810837d6458ab7000a1157fba7af6b04cde87d8016d86555 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Thu, 22 Oct 2020 02:33:08 GMT content-encoding gzip x-content-type-options nosniff server cafe status 200 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 6500 x-xss-protection 0
GET H2	200	up insight.adsrvr.org/track/ Frame EF89	0 0	116ms 38ms	Document text/html	52.208.188.183 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://insight.adsrvr.org/track/up?adv=znpsh7f&ref=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&upid=e4qkh98&upv=1.1.0 Requested by Host: js.adsrvr.org URL: https://js.adsrvr.org/up_loader.1.1.0.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.208.188.183 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-208-188-183.eu-west-1.compute.amazonaws.com Software / Resource Hash Request headers :method GET :authority insight.adsrvr.org :scheme https :path /track/up?adv=znpsh7f&ref=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&upid=e4qkh98&upv=1.1.0 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ accept-encoding gzip, deflate, br accept-language en-US cookie TDID=be0a3a54-a8db-427e-93c9-16162239fc9a; TDCPM=CAEYBSABKAIyCwjur86qsY_7OBAFOAE. Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Response headers status 200 date Thu, 22 Oct 2020 02:33:08 GMT content-type text/html cache-control private,no-cache, must-revalidate pragma no-cache x-aspnet-version 4.0.30319 p3p CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
GET H3-Q050	200	collect www.google-analytics.com/	35 B 120 B	6ms 6ms	Image image/gif	2a00:1450:4001:824::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j86&a=1493090389&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&ul=en-us&de=UTF-8&dt=Exclusive%3A%20Trojan%20apparently%20infects%20NCR%2C%20posing%20possible%20supply-chain%20risk&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&el=25%25&ev=25&_u=aGDAAAADQAAAAC~&jid=&gjid=&cid=1688487307.1603333987&tid=UA-1290429-10&_gid=391113732.1603333987&gtm=2wg9u1MHZ6C39&z=1572868858 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Wed, 21 Oct 2020 09:05:28 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 62860 status 200 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	sodar2.js Show response tpc.googlesyndication.com/sodar/	17 KB 6 KB	35ms 21ms	Script text/javascript	2a00:1450:4001:816::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a32b89473df6ced5953684278e431ae4a01141364fab23812960a0d69c5ab3ee Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:08 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1601937181905197" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6302 x-xss-protection 0 expires Thu, 22 Oct 2020 02:33:08 GMT
GET H3-Q050	200	runner.html tpc.googlesyndication.com/sodar/sodar2/218/ Frame D713	0 0	6ms 6ms	Document text/html	2a00:1450:4001:816::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/218/runner.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/sodar2/218/runner.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Response headers status 200 accept-ranges bytes vary Accept-Encoding content-type text/html content-length 12318 date Thu, 22 Oct 2020 01:47:55 GMT expires Fri, 22 Oct 2021 01:47:55 GMT last-modified Fri, 25 Sep 2020 19:26:06 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 2713 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H/1.1	200 OK	4 Show response api-34-220-64-140.b2c.com/api/ Redirect Chain https://api-34-220-64-140.b2c.com/api/x?QBgAucLna4Y07yLf$dXJsJDAkaHR0cHM6Ly93d3cuc2NtYWdhemluZS5jb20vaG9tZS9zZWN1cml0eS1uZXdzL21hbHdhcmUvZXhjbHVzaXZlLXRyb2phbi1hcHBhcmVudGx5LWluZmVjdHMtbmNyLXBvc2lu... https://api-34-220-64-140.b2c.com:444/api/4?QBgAucLna4Y07yLf	43 B 441 B	691ms 175ms	XHR image/gif	34.220.64.140 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api-34-220-64-140.b2c.com:444/api/4?QBgAucLna4Y07yLf Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.220.64.140 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-220-64-140.us-west-2.compute.amazonaws.com Software openresty / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Thu, 22 Oct 2020 02:33:09 GMT Last-Modified Mon, 28 Sep 1970 06:00:00 GMT Server openresty Access-Control-Allow-Methods GET, POST, OPTIONS Content-Type image/gif Access-Control-Allow-Origin null Cache-Control no-cache, no-store, must-revalidate Access-Control-Allow-Credentials true Connection keep-alive Content-Length 43 Expires -1 Redirect headers Date Thu, 22 Oct 2020 02:33:08 GMT Server openresty Location https://api-34-220-64-140.b2c.com:444/api/4?QBgAucLna4Y07yLf Access-Control-Allow-Methods GET, POST, OPTIONS Content-Type text/html Access-Control-Allow-Origin https://www.scmagazine.com Access-Control-Allow-Credentials true Connection keep-alive Content-Length 142
GET H3-Q050	204	gen_204 pagead2.googlesyndication.com/pagead/	0 223 B	15ms 14ms	Image image/gif	2a00:1450:4001:81b::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=218&t=2&li=gpt_2020101501&jk=1656549171789661&bg=!GBulGzvNAAUZK2QAGVgITW8FQpIllQIAAABDUgAAAAsKAOma1PuPcgE2_PUANCEGTad4u_UIPzJ_5R5IT-jxQJwKmZWA9flqTxMkHEpXgjnihRdyoXK2IkD2c7E0mWhvL5ijlojUSd4KknlaIVV8SPG1v22B0G1OweaZh3hGVcUXVf6duKtcjckrhqnwaLJDvSsGNrcl7G_uD5pE-ggpeh9YBd0d0JWXEvjZb9YaqS3ZeHGUKI9CZnL722AMAargHbVDzAE9WqPYTWmFCHCG4WU-bOSzCbm6vjlVk8Gs8nQLLugM96g2_vrE2tPBEcPxriIiYuULEHTeAFuRwatAd-MukTDIyoUfCdhyr5kBq3E0aAfXaMJ85gZNrCIl8YzHJofFWj9ZTfStFepKloKiYAJbqyAV_FCf4U28QXUwZHODuY3Ja5IYN5Q9ppigOi8wxwA-Gv5Dw9TRCOhu-Tfq-vY2WLJQI9uoG-ex9GtSJqTz__ZCDgkZH7o99hdBbYmpXkp5P9o7pNUQ4CFBDver5tdPU-o_u-5CCZLlxGpBDsRyumn0yWRFDGJXWW6iNXV5u75qdLpmeAqgbOJBzvSNFevlNVf9KgyCIJUBGz46ZZuB9SkG7ROnN4A85IJ0nZ0I9BdLGrU5ElmR6Xs4demkn7DgPAsNUw5qtQyBBjR1xmgPYtPMwbjGz7_Fyfskp6imVhGlFk1EvMVOkU5wx5cxz1CPW9qm1YZz8WlBWi24gs3rDLVLjv-VYL6RNCSNPupiZkrmg7xT2SSel-pfb2O5vr_IYb5ZuWJIN6bDy3o8Pqt-IlT_vceFnA8hML40ic_cYhB2la3WP7IzXFzcWW_lGiO0YZ1FhpJei9PdlBbeUxNr2FW8mPakPl4web5V7p1FyTU4XF0vBGbKb48lnhKdCQreAcE7s1hp8Kg Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Thu, 22 Oct 2020 02:33:08 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 204 cache-control no-cache, must-revalidate content-type image/gif alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	15 KB 10 KB	72ms 72ms	XHR text/plain	216.58.208.34 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1656549171789661&correlator=2121429086647299&output=ldjh&impl=fif&adsid=NT&eid=21067995%2C21068063%2C21067575%2C21067753%2C44714449%2C21065725&vrg=2020101501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201022&iu_parts=21883553441%2CLeaderboard&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C970x250&prev_scp=pos%3Dleaderboard1&eri=1&cust_params=pagetype%3Dpost%26author%3DBradley%2520Barth%26postID%3D106972%26env%3Dlive%26sid%3DCybercrime%252CFeatured%252CMalware%252CSecurity_News%26cat%3DCybercrime%252CMalware%26isnht%3Dfalse&cookie=ID%3D619bf8c386209234-22f4380908b900ed%3AT%3D1603333986%3AS%3DALNI_MYpWN1uY6MVm5FDN-rDF2u8GT45HA&bc=31&abxe=1&lmt=1603333988&dt=1603333988591&dlt=1603333985646&idt=1093&frm=20&biw=1600&bih=1200&oid=2&adxs=216&adys=170&adks=490734277&ucis=3&ifi=3&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&dssz=61&icsg=4502365365273588&mso=67108864&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1200x106&msz=1168x90&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1688487307.1603333987&ga_sid=1603333987&ga_hid=1493090389&fws=4&ohw=1168&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfV0. Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.208.34 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra15s12-in-f34.1e100.net Software cafe / Resource Hash 7e18bd2f9db3835d79c99977985edaf14b23fb473a05475d0bc89448bcce86cc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:08 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 10387 x-xss-protection 0 google-lineitem-id 5498403788 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id 138327256485 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.scmagazine.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	view googleads4.g.doubleclick.net/pcs/ Frame AA52	0 0	89ms 33ms	Fetch image/gif	172.217.16.162 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstOLAVqy3ckrsS4xbU7gHkLiaLKJikZxeW3BWUeR3R1c4JHlNhVU9KH5BFmUpS_FlRt5nQ4PIE6NDahyrn0VUWbDKHDrgXN-V0uacqIz1eJgR9OCvKDcIBvqd02cfz9zSKwaN8bJ53yw6OH8YNPy6dGqlZNGTH42ymuyv1jIUs0ITbsssIgxvP9xR1Rh_Stv7viUJ78yPJR906Y7u3eYpKJWJEGw7zZYaw01S6EBD1W2DAk2OSQOwHpWT-jJJMkOhMF6P-WDO0HLLHAZa6hE0JB-dL8EplhtEAbl7WIKwjZT9SxpUpTYNxgam8x0M3Gh_Xnmbdg4KM0any1JXMh5456Ng&sig=Cg0ArKJSzI1b6488l7-DEAE&urlfix=1&adurl= Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.162 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra15s11-in-f162.1e100.net Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Thu, 22 Oct 2020 02:33:08 GMT x-content-type-options nosniff server cafe status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private content-type image/gif alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H3-Q050	200	UFYwWwmt.js Show response tpc.googlesyndication.com/sodar/ Frame AA52	41 KB 15 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:816::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/UFYwWwmt.js Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 21 Oct 2020 20:04:37 GMT content-encoding gzip x-content-type-options nosniff age 23311 status 200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15207 x-xss-protection 0 last-modified Tue, 03 Mar 2020 20:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 21 Oct 2021 20:04:37 GMT
GET H3-Q050	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame AA52	75 KB 28 KB	15ms 14ms	Script text/javascript	2a00:1450:4001:81b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash aef5db68e9c0d1d356b829a3b564e53b6af0119706fba4c7bb8c4091ae948b1e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:08 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1603280362352039" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 28907 x-xss-protection 0 expires Thu, 22 Oct 2020 02:33:08 GMT
GET H2	200	10192020-185506282-DISPLAY_AD_728_x_90.jpg s0.2mdn.net/8532760/ Frame AA52	44 KB 44 KB	27ms 5ms	Image image/jpeg	2a00:1450:4001:81a::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/8532760/10192020-185506282-DISPLAY_AD_728_x_90.jpg Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ffec3f51024a763674b6fb54867a7e5db1882bb5f4c15e98b4c28360d732eef4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 21 Oct 2020 03:03:14 GMT x-content-type-options nosniff last-modified Tue, 20 Oct 2020 01:55:06 GMT server sffe age 84594 status 200 content-type image/jpeg access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 45162 x-xss-protection 0 expires Thu, 22 Oct 2020 03:03:14 GMT
GET H3-Q050	200	osd.js Show response www.googletagservices.com/activeview/js/current/	72 KB 27 KB	15ms 14ms	Script text/javascript	2a00:1450:4001:81b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f6c6a084d20419521fdd0a581b80e41c5d73aeafd60a0224e7776a6826060625 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:08 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1603280362352039" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 27607 x-xss-protection 0 expires Thu, 22 Oct 2020 02:33:08 GMT
GET H3-Q050	200	Enqz_20U.html tpc.googlesyndication.com/sodar/ Frame 1A1C	0 0	6ms 6ms	Document text/html	2a00:1450:4001:816::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/Enqz_20U.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/Enqz_20U.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Response headers status 200 accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html timing-allow-origin * content-length 8395 date Wed, 21 Oct 2020 20:04:38 GMT expires Thu, 21 Oct 2021 20:04:38 GMT last-modified Tue, 03 Mar 2020 20:15:00 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 23310 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET DATA	200 OK	truncated / Frame AA52	217 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash df4589e8062fe7f810dffe8e2fc15dc26d87f0534539653e9da96c6a25590c3b Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame AA52	0 39 B	35ms 34ms	Image image/gif	216.58.208.34 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvlxIUyV5X3XrQJFFG05jsQYP3OLr85yoo5hM4OwapIGh9Wk8aAKnMEARi07Y5Gd2U2n84tRQvGKcDDTTY2ioJ1vCpmwT0edQp1iYePl-s_JU5ZSye2MM-6-hbRxEXBsmOEXuQPQryEechUT5ltK08kIcIOEtzRzuq_vFf7wkT3zOPlvJCRF27xh-Kl-KMce5npJB09GGvIPv_Vs74XvOy0GPiFai_72v9x4C3h2xyGwLKg_rtucWfSn2aOcDpKqG0g8BOZbUDsknsjap3I&sig=Cg0ArKJSzLpK5mQm16gVEAE&urlfix=1&adurl= Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.208.34 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra15s12-in-f34.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Thu, 22 Oct 2020 02:33:08 GMT x-content-type-options nosniff server cafe status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private content-type image/gif alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	15 KB 10 KB	73ms 72ms	XHR text/plain	216.58.208.34 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1656549171789661&correlator=2121429086647299&output=ldjh&impl=fif&adsid=NT&eid=21067995%2C21068063%2C21067575%2C21067753%2C44714449%2C21065725&vrg=2020101501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201022&iu_parts=21883553441%2CLeaderboard&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C970x250&prev_scp=pos%3Dleaderboard2%26lid%3D5498403788&eri=1&cust_params=pagetype%3Dpost%26author%3DBradley%2520Barth%26postID%3D106972%26env%3Dlive%26sid%3DCybercrime%252CFeatured%252CMalware%252CSecurity_News%26cat%3DCybercrime%252CMalware%26isnht%3Dfalse&cookie=ID%3D619bf8c386209234%3AT%3D1603333986%3AS%3DALNI_MbYiTq2MRJCzl9YQWH-n5oXwLSE8g&bc=31&abxe=1&lmt=1603333989&dt=1603333989688&dlt=1603333985646&idt=1093&frm=20&biw=1600&bih=1200&oid=2&adxs=436&adys=2249&adks=2588316086&ucis=4&ifi=4&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&dssz=61&icsg=4502365365273588&mso=67108864&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x2063&msz=1600x90&psts=AGkb-H_4Z8Apvc-LU2xlcFbeTgmnLu47bXEINoPUw2uyolEI79Vrgjp3EU1mERis-jj4bg_YwHcRoRDurXKWRAA%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1688487307.1603333987&ga_sid=1603333987&ga_hid=1493090389&fws=4&ohw=1600&btvi=2&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfV0. Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.208.34 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra15s12-in-f34.1e100.net Software cafe / Resource Hash 8728a24356dc5cf2ea74344762df85445951413819feee95b025c32ff3fbdf69 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:09 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 10247 x-xss-protection 0 google-lineitem-id 5498403788 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id 138327256692 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.scmagazine.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	view googleads4.g.doubleclick.net/pcs/ Frame 2DD0	0 0	17ms 17ms	Fetch image/gif	2a00:1450:4001:81b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuN5YHvAfxc7vk-IMMGSSjaHlLHXJAybySFZ8IQYV7NMbL1GplDfH9g4LfQ0Fs1TIV2CxBt1pcxcu2s31CXWJ340jN6ka6zUSWU0d9XWvAq_DrOoqMXgIARwQbrHUyZvVO4_Xh-IybEYzvVn5xH44KGYLwQBEBzQ-lZKozkO3n3BmoiYhtmJd078LSOCPuisBD47yO_ht-WQZzBnwv8zJXanX4Rs5BF2se-YEewL77u8DTN1Ltpu34hTnfJmAprbOhnsO7c0UZg-EnQGG4BYvDYNVnImSlO7ptylhAMdXjp_tnwR2veEyQvOSEhq8QwGWft3KO4x1zDUcX93f_cXNrKjg&sig=Cg0ArKJSzL6XHtsIop_6EAE&urlfix=1&adurl= Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Thu, 22 Oct 2020 02:33:09 GMT x-content-type-options nosniff server cafe status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private content-type image/gif alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H3-Q050	200	UFYwWwmt.js Show response tpc.googlesyndication.com/sodar/ Frame 2DD0	41 KB 15 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:816::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/UFYwWwmt.js Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 21 Oct 2020 20:04:37 GMT content-encoding gzip x-content-type-options nosniff age 23312 status 200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15207 x-xss-protection 0 last-modified Tue, 03 Mar 2020 20:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 21 Oct 2021 20:04:37 GMT
GET H3-Q050	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame 2DD0	75 KB 28 KB	15ms 14ms	Script text/javascript	2a00:1450:4001:81b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash aef5db68e9c0d1d356b829a3b564e53b6af0119706fba4c7bb8c4091ae948b1e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:09 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1603280362352039" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 28907 x-xss-protection 0 expires Thu, 22 Oct 2020 02:33:09 GMT
GET H3-Q050	200	10192020-185511625-DISPLAY_AD_728_x_902.jpg s0.2mdn.net/8532760/ Frame 2DD0	29 KB 30 KB	28ms 14ms	Image image/jpeg	2a00:1450:4001:81a::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/8532760/10192020-185511625-DISPLAY_AD_728_x_902.jpg Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6863b9b4b640d1d93c7f60ae53ceff0df94792fc577b003087d7aafe31d4f3e4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 21 Oct 2020 05:18:23 GMT x-content-type-options nosniff last-modified Tue, 20 Oct 2020 01:55:11 GMT server sffe age 76486 status 200 content-type image/jpeg access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 29940 x-xss-protection 0 expires Thu, 22 Oct 2020 05:18:23 GMT
GET H3-Q050	200	Enqz_20U.html tpc.googlesyndication.com/sodar/ Frame 5F9A	0 0	7ms 6ms	Document text/html	2a00:1450:4001:816::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/Enqz_20U.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/Enqz_20U.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Response headers status 200 accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html timing-allow-origin * content-length 8395 date Wed, 21 Oct 2020 20:04:38 GMT expires Thu, 21 Oct 2021 20:04:38 GMT last-modified Tue, 03 Mar 2020 20:15:00 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 23311 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET DATA	200 OK	truncated / Frame 2DD0	216 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f0ecee244b9211e73e3595c08b9bda83bdef45a1f6c3850f13e5612ad78ccaa2 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 2DD0	0 21 B	36ms 35ms	Image image/gif	216.58.208.34 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvVwpIgE63nRiziVIUqQxMKdpMgoTTBnYPL8nyPB8z7_ABXPSBy7kcgzfkKiG4as-IS02ZFQePsrGnX-XSAQQCtNmFjJGIiV2xZX8nJYrMmcqXaUEJvawsOJNTYN_VD4b-r3W2X9pN3hjtwPL-7iTQalSaphbLenXik-eZ3uQLTqhebzVKUMUbuCxgP3J9Ekrd6GU88OgABorTJQFAN32uk8J4499LvqnHbSukMyD_-ZR8rvVzOfvPaVWmx5Q9W3Thtm1iyy38DUpSK0Vcg&sig=Cg0ArKJSzKjCUvSK67mCEAE&urlfix=1&adurl= Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.208.34 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra15s12-in-f34.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Thu, 22 Oct 2020 02:33:09 GMT x-content-type-options nosniff server cafe status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private content-type image/gif alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H3-Q050	200	activeview pagead2.googlesyndication.com/pcs/ Frame AA52	42 B 68 B	14ms 14ms	Image image/gif	2a00:1450:4001:81b::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsugR96eA_ZQmgRurolcpKEYB-dtAMUG7acsxFDNIT_N4wCG0rM4MJ2E7LA7-rBLa5lgCWCnp3zRlPgfXCU5YHimktCmPDLLIl8ISto_z-GywDupt0sNoQUSd9GrFJLBaFBvO45TqFX3BprfBJHVVLEHQlF8uayf7jZZGpVqaDje&sig=Cg0ArKJSzK8uhBLEDc22EAE&adk=490734277&tt=-1&bs=1600%2C1200&mtos=0,1007,1007,1007,1007&tos=0,1007,0,0,0&p=170,436,260,1164&mcvt=1007&rs=0&ht=0&tfs=140&tls=1147&mc=0.99&lte=-1&bas=0&bac=0&met=ie&avms=nio&niot_obs=36&niot_cbk=41&md=2&btr=0&cpmav=0&lm=2&rst=1603333988682&dlt&rpt=97&isd=0&msd=0&xdi=0&postrxl=1&bmi=1&ps=1600%2C2895&scs=1600%2C1200&pt=-1&bin=4&deb=1-0-0-12-5-11-11-0-0-0&tvt=1144&is=728%2C90&iframe_loc=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&r=v&id=osdim&vs=4&uc=12&upc=2&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20201021 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Thu, 22 Oct 2020 02:33:09 GMT x-content-type-options nosniff server cafe timing-allow-origin * status 200 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate content-type image/gif alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	15 KB 10 KB	75ms 75ms	XHR text/plain	216.58.208.34 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1656549171789661&correlator=2121429086647299&output=ldjh&impl=fif&adsid=NT&eid=21067995%2C21068063%2C21067575%2C21067753%2C44714449%2C21065725&vrg=2020101501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201022&iu_parts=21883553441%2CBox&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C300x600%7C300x1050&prev_scp=pos%3Dbox1%26lid%3D5498403788&eri=1&cust_params=pagetype%3Dpost%26author%3DBradley%2520Barth%26postID%3D106972%26env%3Dlive%26sid%3DCybercrime%252CFeatured%252CMalware%252CSecurity_News%26cat%3DCybercrime%252CMalware%26isnht%3Dfalse&cookie=ID%3D619bf8c386209234%3AT%3D1603333986%3AS%3DALNI_MbYiTq2MRJCzl9YQWH-n5oXwLSE8g&bc=31&abxe=1&lmt=1603333990&dt=1603333990785&dlt=1603333985646&idt=1093&frm=20&biw=1600&bih=1200&oid=2&adxs=1084&adys=468&adks=607498164&ucis=5&ifi=5&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&dssz=60&icsg=4502365365273588&mso=67108864&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x283&msz=300x250&psts=AGkb-H_4Z8Apvc-LU2xlcFbeTgmnLu47bXEINoPUw2uyolEI79Vrgjp3EU1mERis-jj4bg_YwHcRoRDurXKWRAA%2CAGkb-H_PcUdeIlQ7drKk6wD7c7IH9APnxQrBYlNF2k8gbKbd0mBwtW_77tse7vNtB581aATGlIBoKJ5t2x-HZPA%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1688487307.1603333987&ga_sid=1603333987&ga_hid=1493090389&fws=4&ohw=1600&btvi=0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfV0. Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.208.34 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra15s12-in-f34.1e100.net Software cafe / Resource Hash e344150c7356fdcdfe0c848bca738df3dcae989407e861391c3ed269e72a7615 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:10 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 10371 x-xss-protection 0 google-lineitem-id 5498403788 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id 138327684544 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.scmagazine.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	view googleads4.g.doubleclick.net/pcs/ Frame 44BD	0 0	16ms 16ms	Fetch image/gif	2a00:1450:4001:81b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssVNpWueRvCRP3UQUeOdzXmIHC43v1XpkaEgaDjznJiQA_OBJytD0cMxySMdD2T1V3-BdPT1_ShOZlUSRXbMDuZ078dNjLxlA3uXq98FAIXJ3znfQ0s6XAxlnVnSs1OnvjHMKxE3xL8tXfobH10jXLFO5P2tEZHki2W6dRwSvjeYJApqeTjEMfgO4ZwCQ3xt2GzqCW59m2t5JlTnVV1UxQPgMLyUplHxRZxLRJd67ej74B6cwjH8NPh8V_C1f7u2DK1vbOQ2CtEiDt5y7dHFlpinAkyp-0r55htwcFvJIjmw61MHyFnUa9dxr_Yt04lp5S5Mt5LoFN570I1E64&sig=Cg0ArKJSzBaS4dPh0WMAEAE&urlfix=1&adurl= Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Thu, 22 Oct 2020 02:33:10 GMT x-content-type-options nosniff server cafe status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private content-type image/gif alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H3-Q050	200	UFYwWwmt.js Show response tpc.googlesyndication.com/sodar/ Frame 44BD	41 KB 15 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:816::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/UFYwWwmt.js Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 21 Oct 2020 20:04:37 GMT content-encoding gzip x-content-type-options nosniff age 23313 status 200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15207 x-xss-protection 0 last-modified Tue, 03 Mar 2020 20:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 21 Oct 2021 20:04:37 GMT
GET H3-Q050	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame 44BD	75 KB 28 KB	15ms 14ms	Script text/javascript	2a00:1450:4001:81b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash aef5db68e9c0d1d356b829a3b564e53b6af0119706fba4c7bb8c4091ae948b1e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:10 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1603280362352039" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 28907 x-xss-protection 0 expires Thu, 22 Oct 2020 02:33:10 GMT
GET H3-Q050	200	10192020-185455343-DISPLAY_AD_300_x_250.jpg s0.2mdn.net/8532760/ Frame 44BD	49 KB 49 KB	8ms 7ms	Image image/jpeg	2a00:1450:4001:81a::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/8532760/10192020-185455343-DISPLAY_AD_300_x_250.jpg Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3400df9b1e452eb70dafe513ebcc96493f7a19a6bead4ff319e5afe1a7752c5d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 21 Oct 2020 14:07:34 GMT x-content-type-options nosniff last-modified Tue, 20 Oct 2020 01:54:55 GMT server sffe age 44736 status 200 content-type image/jpeg access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 50582 x-xss-protection 0 expires Thu, 22 Oct 2020 14:07:34 GMT
GET H3-Q050	200	Enqz_20U.html tpc.googlesyndication.com/sodar/ Frame DD30	0 0	6ms 6ms	Document text/html	2a00:1450:4001:816::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/Enqz_20U.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/Enqz_20U.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Response headers status 200 accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html timing-allow-origin * content-length 8395 date Wed, 21 Oct 2020 20:04:38 GMT expires Thu, 21 Oct 2021 20:04:38 GMT last-modified Tue, 03 Mar 2020 20:15:00 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 23312 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 44BD	0 21 B	34ms 33ms	Image image/gif	216.58.208.34 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssFxZZAYdZliK9WNphvD24YNboVgosYwrGr3OU0a-Gl2tV4ad7z0tihzxzFcfTXs0Odq-SoCoB5aAMaCd1l2V9EeXkRwd3DqMrpu4Kr2Yp4Qv2Ym5j3c2AUOe2JM8YH3szw9O4YeYV0j6HqlNSGDcOHARWcIfpw5JW-e3_rRDA6uhFdtgGZylxI4nbXp23yPv-teePVxYU3RqAKUERwfWlqHBLm4oytDI32hJfkMGK9n1l1bWobhAES2e3ijkCHR71yXvBfFWUO8g&sig=Cg0ArKJSzFGwbyfNa_j7EAE&urlfix=1&adurl= Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.208.34 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra15s12-in-f34.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Thu, 22 Oct 2020 02:33:10 GMT x-content-type-options nosniff server cafe status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private content-type image/gif alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET DATA	200 OK	truncated / Frame 44BD	212 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e65679f4840e797b164d673d6666b79fdc3e540346f7d9a47d8082df860f97fb Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H3-Q050	200	ads Show response securepubads.g.doubleclick.net/gampad/	15 KB 10 KB	73ms 73ms	XHR text/plain	216.58.208.34 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1656549171789661&correlator=2121429086647299&output=ldjh&impl=fif&adsid=NT&eid=21067995%2C21068063%2C21067575%2C21067753%2C44714449%2C21065725&vrg=2020101501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201022&iu_parts=21883553441%2CBox&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C300x600&prev_scp=pos%3Dbox2%26lid%3D5498403788&eri=1&cust_params=pagetype%3Dpost%26author%3DBradley%2520Barth%26postID%3D106972%26env%3Dlive%26sid%3DCybercrime%252CFeatured%252CMalware%252CSecurity_News%26cat%3DCybercrime%252CMalware%26isnht%3Dfalse&cookie=ID%3D619bf8c386209234%3AT%3D1603333986%3AS%3DALNI_MbYiTq2MRJCzl9YQWH-n5oXwLSE8g&bc=31&abxe=1&lmt=1603333991&dt=1603333991881&dlt=1603333985646&idt=1093&frm=20&biw=1600&bih=1200&oid=2&adxs=1084&adys=1343&adks=1048971383&ucis=6&ifi=6&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&dssz=60&icsg=4502365365273588&mso=67108864&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x283&msz=300x250&psts=AGkb-H_4Z8Apvc-LU2xlcFbeTgmnLu47bXEINoPUw2uyolEI79Vrgjp3EU1mERis-jj4bg_YwHcRoRDurXKWRAA%2CAGkb-H_PcUdeIlQ7drKk6wD7c7IH9APnxQrBYlNF2k8gbKbd0mBwtW_77tse7vNtB581aATGlIBoKJ5t2x-HZPA%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H8pChLSBfp_V0w4gEozyCvTKoPpceJrqNXFFeKHPKvIf2Ve8LeLMDYTJyyRcSFaiQeYXk0PZmlGF_k0w0M&ga_vid=1688487307.1603333987&ga_sid=1603333987&ga_hid=1493090389&fws=4&ohw=1600&btvi=3&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfV0. Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.208.34 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra15s12-in-f34.1e100.net Software cafe / Resource Hash 594780e57047c1853a59df29f297fd331127078a2e6920aefe3aa24b7cae2b0b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:11 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 10160 x-xss-protection 0 google-lineitem-id 5498403788 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id 138327214442 content-type text/plain; charset=UTF-8 access-control-allow-origin https://www.scmagazine.com cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	view googleads4.g.doubleclick.net/pcs/ Frame 102F	0 0	17ms 16ms	Fetch image/gif	2a00:1450:4001:81b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssNvCEhKUk70YelZnZ7tlDizvBe6w0WEXkjEsSRt9wEfMQIJn4hCVBokOgmW2rIYcYSbQ_1I_GD36SNY59hf1GchpcDoU7u2P-33d_hIPCJI5Kxq-xi_XS3PJq2jNoABbHJZb_Ni9EsIs6q0IF-klynSkvus2lhrgKE5J-frm2BUgCpiJXuavT-wJj6Dx0yMQ1B5FWVqX8DzolYBY6rslLp7sxDQtHx9RTsVsp-tb072lIyB0l63kz2tkFC_7mnbYoBYi2_fExgJE2NcIFVND-HOOR2heHdUFOphdp10karRuFbNqUOFEJoyS1DIMJ6VEktxs-5i6dQXKaFER8&sig=Cg0ArKJSzHKv2t8n4O-cEAE&urlfix=1&adurl= Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Thu, 22 Oct 2020 02:33:11 GMT x-content-type-options nosniff server cafe status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private content-type image/gif alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H3-Q050	200	UFYwWwmt.js Show response tpc.googlesyndication.com/sodar/ Frame 102F	41 KB 15 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:816::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/UFYwWwmt.js Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 21 Oct 2020 20:04:37 GMT content-encoding gzip x-content-type-options nosniff age 23314 status 200 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15207 x-xss-protection 0 last-modified Tue, 03 Mar 2020 20:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Thu, 21 Oct 2021 20:04:37 GMT
GET H3-Q050	200	osd_listener.js Show response www.googletagservices.com/activeview/js/current/ Frame 102F	75 KB 28 KB	15ms 13ms	Script text/javascript	2a00:1450:4001:81b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash aef5db68e9c0d1d356b829a3b564e53b6af0119706fba4c7bb8c4091ae948b1e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 22 Oct 2020 02:33:11 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1603280362352039" vary Accept-Encoding content-type text/javascript status 200 cache-control private, max-age=3000 accept-ranges bytes alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 28907 x-xss-protection 0 expires Thu, 22 Oct 2020 02:33:11 GMT
GET H3-Q050	200	10192020-185500601-DISPLAY_AD_300_x_2502.jpg s0.2mdn.net/8532760/ Frame 102F	31 KB 31 KB	8ms 7ms	Image image/jpeg	2a00:1450:4001:81a::2006 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://s0.2mdn.net/8532760/10192020-185500601-DISPLAY_AD_300_x_2502.jpg Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101501.js?21068063 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 266b4f8b5e839001707659a0c96173f7e6140c0a394ac6509c4b6c2ddbf92a56 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 21 Oct 2020 14:07:33 GMT x-content-type-options nosniff last-modified Tue, 20 Oct 2020 01:55:00 GMT server sffe age 44738 status 200 content-type image/jpeg access-control-allow-origin * cache-control public, max-age=86400 accept-ranges bytes alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31446 x-xss-protection 0 expires Thu, 22 Oct 2020 14:07:33 GMT
GET H3-Q050	200	Enqz_20U.html tpc.googlesyndication.com/sodar/ Frame 512D	0 0	6ms 6ms	Document text/html	2a00:1450:4001:816::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/Enqz_20U.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/Enqz_20U.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Response headers status 200 accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html timing-allow-origin * content-length 8395 date Wed, 21 Oct 2020 20:04:38 GMT expires Thu, 21 Oct 2021 20:04:38 GMT last-modified Tue, 03 Mar 2020 20:15:00 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 23313 alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3-Q050	200	view securepubads.g.doubleclick.net/pcs/ Frame 102F	0 44 B	36ms 34ms	Image image/gif	216.58.208.34 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss931T2nMvobbWEcP9UV6Hjj6i6NUBdAQq7PPpoPwjmRsJT6QaEQwOnuxQmTbTJYmJ9hIF7Y_G_Ea98upUCYHHNVVx-Emtk98z2BhNG4zcfKQvv_PbWdgnGflbL3nqdljvACvZ5hV3y1np3xwBi2lhf1qfFy5uMz0AwqvlxdhayFYgX4vuF9OqlIvfyXVXTe9bszrxuhFX3HseQuZ3wkBSiTX0_QbLrhO_6u7i2FMI_YwGEtw_T6F4taLPuTUolGZU64Waip8llYQ&sig=Cg0ArKJSzHlA74sV2NtsEAE&urlfix=1&adurl= Requested by Host: www.scmagazine.com URL: https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 216.58.208.34 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra15s12-in-f34.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers timing-allow-origin * date Thu, 22 Oct 2020 02:33:12 GMT x-content-type-options nosniff server cafe status 200 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private content-type image/gif alt-svc h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET DATA	200 OK	truncated / Frame 102F	214 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d2f9b673cd1a4704a4563b71718940b4f435ccb79862d35474e8ce8ba997ad1e Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H3-Q050	200	activeview pagead2.googlesyndication.com/pcs/ Frame 44BD	42 B 88 B	15ms 14ms	Image image/gif	2a00:1450:4001:81b::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvq2g21ifJXJzfnTzHCeWGKVY-axn0T8-cAtiutue76H_YJZ_jc9sO5wvs7welvz0kQJC6OsNQwMUve-5sJuFpNYC5xcsypY4acuASwzay11TeS8bhton84bhSX8Ljz-LH0F3n2z2JCRk19Cf0ZuOaRYeppxVWws1jCKIcN5cnN&sig=Cg0ArKJSzKlaIUgGUXivEAE&adk=607498164&tt=-1&bs=1600%2C1200&mtos=1008,1008,1008,1008,1008&tos=1008,0,0,0,0&p=468,1084,718,1384&mcvt=1008&rs=0&ht=0&tfs=104&tls=1113&mc=1&lte=-1&bas=0&bac=0&met=ie&avms=nio&niot_obs=3&niot_cbk=10&md=2&btr=0&cpmav=0&lm=2&rst=1603333990876&dlt&rpt=24&isd=0&msd=0&xdi=0&postrxl=1&bmi=1&ps=1600%2C2895&scs=1600%2C1200&pt=-1&bin=4&deb=1-0-0-12-3-11-11-0-0-0&tvt=1112&is=300%2C250&iframe_loc=https%3A%2F%2Fwww.scmagazine.com%2Fhome%2Fsecurity-news%2Fmalware%2Fexclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk%2F&r=v&id=osdim&vs=4&uc=12&upc=2&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20201021 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:81b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.scmagazine.com/home/security-news/malware/exclusive-trojan-apparently-infects-ncr-posing-possible-supply-chain-risk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Thu, 22 Oct 2020 02:33:12 GMT x-content-type-options nosniff server cafe timing-allow-origin * status 200 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate content-type image/gif alt-svc h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT