www.intego.com Open in urlscan Pro
2606:4700::6812:16a Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Submission: On September 17 via api (September 17th 2024, 6:01:32 am UTC) from IN — Scanned from GB

Summary HTTP 118 Redirects Links 31 Behaviour Indicators

Summary

This website contacted 32 IPs in 6 countries across 26 domains to perform 118 HTTP transactions. The main IP is 2606:4700::6812:16a, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.intego.com.
TLS certificate: Issued by WE1 on July 22nd 2024. Valid for: 3 months.

This is the only time www.intego.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
53	2606:4700::68... 2606:4700::6812:16a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
4	192.0.77.2 192.0.77.2	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2a02:26f0:710... 2a02:26f0:7100::213:c6d3	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700::68... 2606:4700::6810:5049	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
1	2.19.225.248 2.19.225.248	16625 (AKAMAI-AS) (AKAMAI-AS)
3	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
4	2a00:1450:400... 2a00:1450:4001:81d::2008	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f08... 2a03:2880:f084:a:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
1	151.101.192.84 151.101.192.84	54113 (FASTLY) (FASTLY)
4	199.232.192.134 199.232.192.134	54113 (FASTLY) (FASTLY)
2	199.232.188.157 199.232.188.157	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:4001:831::200e	15169 (GOOGLE) (GOOGLE)
3	2620:1ec:33:1... 2620:1ec:33:1::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a03:2880:f08... 2a03:2880:f084:d:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1 2	2620:116:800d... 2620:116:800d:21:ef75:8280:f209:5ba1	16509 (AMAZON-02) (AMAZON-02)
1	183.79.219.124 183.79.219.124	24572 (YAHOO-JP-...) (YAHOO-JP-AS-AP Yahoo Japan)
2	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:81c::2002	15169 (GOOGLE) (GOOGLE)
2	151.101.128.134 151.101.128.134	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:400c:c1d::9c	15169 (GOOGLE) (GOOGLE)
1	2600:9000:223... 2600:9000:223c:fc00:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:80f::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f17... 2a03:2880:f177:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	91.228.74.200 91.228.74.200	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1288:80:... 2a00:1288:80:807::1	203220 (YAHOO-DEB) (YAHOO-DEB)
1	54.171.122.26 54.171.122.26	16509 (AMAZON-02) (AMAZON-02)
118	32

53 2606:4700::6812:16a (United States)

ASN13335 (CLOUDFLARENET, US)

www.intego.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

netdna.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i1.wp.com

i2.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:7100::213:c6d3 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

embed.podcasts.apple.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5049 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.19.225.248 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-19-225-248.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:81d::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f084:a:face:b00c:0:2 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.192.84 (San Francisco, United States)

ASN54113 (FASTLY, US)

widgets.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 199.232.192.134 (United States)

ASN54113 (FASTLY, US)

macsecurityblog.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
referrer.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 199.232.188.157 (Munich, Germany)

ASN54113 (FASTLY, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:33:1::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f084:d:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:ef75:8280:f209:5ba1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 183.79.219.124 (Japan)

ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP)

s.yimg.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81c::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.128.134 (San Francisco, United States)

ASN54113 (FASTLY, US)

disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c1d::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223c:fc00:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f177:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.228.74.200 (United Kingdom)

ASN16509 (AMAZON-02, US)

pixel-ssn.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1288:80:807::1 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.171.122.26 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-171-122-26.eu-west-1.compute.amazonaws.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
53	intego.com www.intego.com	547 KB
7	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 45 td.doubleclick.net — Cisco Umbrella Rank: 189 stats.g.doubleclick.net — Cisco Umbrella Rank: 130	5 KB
7	wp.com i2.wp.com — Cisco Umbrella Rank: 8096 i0.wp.com — Cisco Umbrella Rank: 4113 stats.wp.com — Cisco Umbrella Rank: 3358 pixel.wp.com — Cisco Umbrella Rank: 3300	8 KB
6	disqus.com macsecurityblog.disqus.com disqus.com — Cisco Umbrella Rank: 1275 referrer.disqus.com — Cisco Umbrella Rank: 9577	50 KB
6	facebook.com graph.facebook.com — Cisco Umbrella Rank: 177 www.facebook.com — Cisco Umbrella Rank: 106	5 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 43	380 KB
3	google.co.uk www.google.co.uk — Cisco Umbrella Rank: 4615	191 B
3	google.com www.google.com — Cisco Umbrella Rank: 3 region1.analytics.google.com — Cisco Umbrella Rank: 4054	128 B
3	quantserve.com 1 redirects secure.quantserve.com — Cisco Umbrella Rank: 1497 pixel.quantserve.com — Cisco Umbrella Rank: 1058 pixel-ssn.quantserve.com — Cisco Umbrella Rank: 50099	11 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 361	15 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 31	2 KB
2	yimg.com s.yimg.com — Cisco Umbrella Rank: 758	8 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 178	72 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 33	21 KB
2	twitter.com platform.twitter.com — Cisco Umbrella Rank: 1491	27 KB
2	gstatic.com fonts.gstatic.com	44 KB
2	bootstrapcdn.com netdna.bootstrapcdn.com — Cisco Umbrella Rank: 3593	40 KB
1	yahoo.com sp.analytics.yahoo.com — Cisco Umbrella Rank: 1617	508 B
1	quantcount.com rules.quantcount.com — Cisco Umbrella Rank: 1541	1 KB
1	yimg.jp s.yimg.jp — Cisco Umbrella Rank: 7350	2 KB
1	pinterest.com widgets.pinterest.com — Cisco Umbrella Rank: 23941	415 B
1	addthis.com s7.addthis.com — Cisco Umbrella Rank: 4609	361 B
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 670	7 KB
1	apple.com embed.podcasts.apple.com — Cisco Umbrella Rank: 60704
0	yahoo.co.jp Failed b91.yahoo.co.jp Failed
0	linkedin.com Failed www.linkedin.com Failed
118	26

	Domain	Requested by
53	www.intego.com	www.intego.com static.cloudflareinsights.com
4	www.facebook.com
4	www.googletagmanager.com	www.intego.com www.googletagmanager.com www.google-analytics.com
3	www.google.co.uk
3	td.doubleclick.net	www.googletagmanager.com
3	bat.bing.com	www.intego.com bat.bing.com
3	macsecurityblog.disqus.com	www.intego.com macsecurityblog.disqus.com
3	i2.wp.com	www.intego.com
3	fonts.googleapis.com	www.intego.com
2	s.yimg.com	www.intego.com s.yimg.com
2	www.google.com
2	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
2	disqus.com	macsecurityblog.disqus.com
2	googleads.g.doubleclick.net	www.googletagmanager.com
2	connect.facebook.net	www.intego.com connect.facebook.net
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	pixel.wp.com
2	platform.twitter.com	www.intego.com platform.twitter.com
2	graph.facebook.com	www.intego.com
2	fonts.gstatic.com	fonts.googleapis.com
2	netdna.bootstrapcdn.com	www.intego.com netdna.bootstrapcdn.com
1	referrer.disqus.com
1	sp.analytics.yahoo.com
1	pixel-ssn.quantserve.com
1	pixel.quantserve.com	1 redirects
1	region1.analytics.google.com	www.googletagmanager.com
1	rules.quantcount.com	secure.quantserve.com
1	s.yimg.jp	www.googletagmanager.com
1	secure.quantserve.com	www.intego.com
1	widgets.pinterest.com	www.intego.com
1	stats.wp.com	www.intego.com
1	s7.addthis.com	www.intego.com
1	static.cloudflareinsights.com	www.intego.com
1	embed.podcasts.apple.com	www.intego.com
1	i0.wp.com	www.intego.com
0	b91.yahoo.co.jp Failed	s.yimg.jp
0	www.linkedin.com Failed	www.intego.com
118	37

This site contains links to these domains. Also see Links.

Domain
support.intego.com
account.intego.com
www.facebook.com
twitter.com
www.linkedin.com
pinterest.com
en.wikipedia.org
offer.intego.com
securelist.com
podcast.intego.com
podcasts.apple.com
x.com
www.youtube.com
www.pinterest.com
www.instagram.com
security.thejoshmeister.com
infosec.exchange
www.studentappcentre.com
facebook.com
linkedin.com
youtube.com

Subject Issuer	Validity	Valid
intego.com WE1	`2024-07-22` - `2024-10-20`	3 months	crt.sh
bootstrapcdn.com WE1	`2024-07-23` - `2024-10-21`	3 months	crt.sh
upload.video.google.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2023-11-28` - `2024-12-28`	a year	crt.sh
beta.music.apple.com Apple Public Server RSA CA 11 - G1	`2024-08-11` - `2024-11-09`	3 months	crt.sh
cloudflareinsights.com WE1	`2024-09-03` - `2024-12-02`	3 months	crt.sh
*.gstatic.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
odc-addthis-prod-01.oracle.com DigiCert TLS RSA SHA256 2020 CA1	`2023-12-09` - `2024-12-11`	a year	crt.sh
*.google-analytics.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-06-26` - `2024-09-24`	3 months	crt.sh
*.pinterest.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-08-05` - `2025-08-07`	a year	crt.sh
*.disqus.com Sectigo RSA Domain Validation Secure Server CA	`2024-04-16` - `2025-04-16`	a year	crt.sh
*.twimg.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-06-24` - `2025-07-25`	a year	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
quantserve.com R11	`2024-08-23` - `2024-11-21`	3 months	crt.sh
edge01.yahoo.co.jp Cybertrust Japan SureServer CA G4	`2024-07-02` - `2025-08-01`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.doubleclick.net WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.google.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.google.co.uk WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2024-08-26` - `2024-10-16`	2 months	crt.sh
*.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2024-07-30` - `2025-01-22`	6 months	crt.sh

This page contains 8 frames:

Primary Page: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Frame ID: B884B4B9D22D374B0CCFFADA70111699
Requests: 117 HTTP requests in this frame

Frame: https://embed.podcasts.apple.com/us/podcast/intego-mac-podcast/id1293834627?itsct=podcast_box&itscg=30200
Frame ID: BCCD7F64DFCDB8C249F57419FFF936A3
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.intego.com
Frame ID: 2C27883EF67BF18FD5321F2499025B04
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/1060047950?random=1726552885662&cv=11&fst=1726552885662&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4990z8564007za201zb564007&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&label=6cqzCOKomwIQzpi8-QM&hn=www.googleadservices.com&frm=0&tiba=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Security%20Blog&npa=0&pscdl=noapi&auid=288340183.1726552886&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1
Frame ID: 37993C62F5F981D880A767D5D535D6B0
Requests: 1 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=macsecurityblog&t_i=101625%20https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2F%3Fp%3D101625&t_u=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&t_e=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs&t_d=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs&t_t=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs&s_o=default
Frame ID: EE3D993D1C115243E4FCE8A9C8B603C7
Requests: 1 HTTP requests in this frame

Frame: https://disqus.com/recommendations/?base=default&f=macsecurityblog&t_i=101625%20https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2F%3Fp%3D101625&t_u=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&t_e=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs&t_d=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs&t_t=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs
Frame ID: 26A6389D6F9E0DC1055401BC07479254
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-QWFMBN7P7H&gacid=770738162.1726552886&gtm=45je4990v9117895345za200&dma=0&gcd=13l3l3l3l2l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=1136016349
Frame ID: 13F20379169FEE8623ADDC4C445B3857
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/1060047950?random=1726552886844&cv=11&fst=1726552886844&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4990za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&hn=www.googleadservices.com&frm=0&tiba=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Security%20Blog&npa=0&pscdl=noapi&auid=288340183.1726552886&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config
Frame ID: 21FD2081A012F841FF4C1C3A3B7AD462
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

New macOS malware HZ RAT gives attackers backdoor access to Macs - The Mac Security Blog

Detected technologies

Drupal (CMS) Expand

Overall confidence: 100%
Detected patterns

<(?:link|style)[^>]+"/sites/(?:default|all)/(?:themes|modules)/

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/
wp-embed\.min\.js\?ver=([\d.]+)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AddThis (Widgets) Expand

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

118
Requests

97 %
HTTPS

68 %
IPv6

26
Domains

37
Subdomains

32
IPs

6
Countries

1253 kB
Transfer

3544 kB
Size

19
Cookies

31 Outgoing links

These are links going to different origins than the main page.

URL: https://support.intego.com/home
Title: Knowledge Base

Search URL Search Domain Scan URL

URL: https://support.intego.com/hc/requests/new
Title: Contact Support

Search URL Search Domain Scan URL

URL: https://support.intego.com/access/unauthenticated?return_to=http%3A%2F%2Fsupport.intego.com%2Frequests
Title: Check Your Requests

Search URL Search Domain Scan URL

URL: https://account.intego.com/
Title: My Account

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Title: Shares

Search URL Search Domain Scan URL

URL: https://twitter.com/share?url=https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Title: Tweets

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Title: Shares

Search URL Search Domain Scan URL

URL: https://pinterest.com/pin/create/button/?url=https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Title: Pins

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Watering_hole_attack
Title: watering-hole style attacks

Search URL Search Domain Scan URL

URL: https://offer.intego.com/BlogMACAV_lbmxlkchf
Title: Intego’s Mac Premium Bundle X9

Search URL Search Domain Scan URL

URL: https://support.intego.com/hc/en-us/articles/207114798-VirusBarrier-X9-How-to-Scan-iPhone-iPad-and-iPod-Touch
Title: scan for malicious files on an iPhone, iPad, or iPod touch

Search URL Search Domain Scan URL

URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Title: report

Search URL Search Domain Scan URL

URL: https://podcast.intego.com/

Search URL Search Domain Scan URL

URL: https://podcasts.apple.com/us/podcast/intego-mac-podcast/id1293834627
Title: follow the podcast

Search URL Search Domain Scan URL

URL: https://x.com/IntegoSecurity

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Intego

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/IntegoVideo?sub_confirmation=1

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/intego/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/intego

Search URL Search Domain Scan URL

URL: https://www.instagram.com/intego_security/

Search URL Search Domain Scan URL

URL: https://twitter.com/theJoshMeister
Title: @theJoshMeister

Search URL Search Domain Scan URL

URL: https://security.thejoshmeister.com/
Title: security.thejoshmeister.com

Search URL Search Domain Scan URL

URL: https://x.com/theJoshMeister
Title: X/Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/in/theJoshMeister
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://infosec.exchange/@theJoshMeister
Title: Mastodon

Search URL Search Domain Scan URL

URL: https://twitter.com/IntegoSecurity

Search URL Search Domain Scan URL

URL: https://www.studentappcentre.com/App/Internet_X9
Title: Student Discount

Search URL Search Domain Scan URL

URL: https://facebook.com/Intego
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/integosecurity
Title: Twitter

Search URL Search Domain Scan URL

URL: http://linkedin.com/company/intego
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://youtube.com/user/IntegoVideo
Title: YouTube

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 113

https://pixel.quantserve.com/pixel;r=1429414979;labels=_fp.event.Default;rf=0;a=p-NVNd7-g373ynZ;url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F;uht=2;fpan=1;fpa=P0-1879706432-1726552885987;pbc=;ns=0;ce=1;qjs=1;qv=15f23c9a-20240703164903;cm=;gdpr=0;ref=;d=intego.com;dst=1;et=1726552886465;tzo=-60;ogl=locale.en_US%2Ctype.article%2Ctitle.New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Secur%2Cdescription.HZ%20RAT%20is%20brand-new%20macOS%20malware%20that%20gives%20remote%20attackers%20complete%20control%20o%2Curl.https%3A%2F%2Fwww%252Eintego%252Ecom%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attacker%2Csite_name.The%20Mac%20Security%20Blog%2Cimage.https%3A%2F%2Fwww%252Eintego%252Ecom%2Fmac-security-blog%2Fwp-content%2Fuploads%2F2024%2F09%2Fevil-rat-mac%2Cimage%3Awidth.400%2Cimage%3Aheight.260;ses=7c0a5488-94fc-4799-8860-83858682b20a;mdl= HTTP 302
https://pixel-ssn.quantserve.com/pixel;r=1429414979;labels=_fp.event.Default;rf=0;a=p-NVNd7-g373ynZ;url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F;uht=2;fpan=1;fpa=P0-1879706432-1726552885987;pbc=;ns=0;ce=1;qjs=1;qv=15f23c9a-20240703164903;cm=;gdpr=0;ref=;d=intego.com;dst=1;et=1726552886465;tzo=-60;ogl=locale.en_US%2Ctype.article%2Ctitle.New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Secur%2Cdescription.HZ%20RAT%20is%20brand-new%20macOS%20malware%20that%20gives%20remote%20attackers%20complete%20control%20o%2Curl.https%3A%2F%2Fwww%252Eintego%252Ecom%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attacker%2Csite_name.The%20Mac%20Security%20Blog%2Cimage.https%3A%2F%2Fwww%252Eintego%252Ecom%2Fmac-security-blog%2Fwp-content%2Fuploads%2F2024%2F09%2Fevil-rat-mac%2Cimage%3Awidth.400%2Cimage%3Aheight.260;ses=7c0a5488-94fc-4799-8860-83858682b20a;mdl=;dip=76870452-b2a6-4843-b040-b785704562b3

118 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request / Show response
www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/ 87 KB
22 KB 821ms
704ms Document
text/html 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

262acb3ed20ff4aabfd582e2a85508a13f81d5b19689d061c5a9a6465613bdf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: EXPIRED
cf-edge-cache: cache,platform=wordpress
cf-ray: 8c46e1a3da39406b-LHR
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 17 Sep 2024 06:01:24 GMT
last-modified: Tue, 17 Sep 2024 06:01:24 GMT
link: <https://www.intego.com/mac-security-blog/wp-json/>; rel="https://api.w.org/" <https://www.intego.com/mac-security-blog/wp-json/wp/v2/posts/101625>; rel="alternate"; type="application/json" <https://wp.me/p4VAYd-qr7>; rel=shortlink
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H3 200 style.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/ 135 B
309 B 58ms
56ms Stylesheet
text/css 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9eeea020cc6ec6c8b66b20c48a9b69a5f14b8097bdb91c5420998eb842bcbae0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
cf-polished: origSize=512
etag: W/"200-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a84c28406b-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 05:38:19 GMT

GET
H3 200 font-awesome.css
netdna.bootstrapcdn.com/font-awesome/3.1.1/css/ 23 KB
6 KB 150ms
37ms Stylesheet
text/css 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://netdna.bootstrapcdn.com/font-awesome/3.1.1/css/font-awesome.css

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2d30057d0a8007fb75fb8a6e4f82f59d3858d29ea176db9c73f665209e86123

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 947
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 15774698
cdn-cachedat: 10/31/2023 20:35:35
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:50 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: W/"bbd098fc6d8263878a58191b4b45e7a6"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 86169579c8b79330329d3f4676b13baf
timing-allow-origin: *
cdn-requestcountrycode: FR
cdn-status: 200
cf-ray: 8c46e1a8f89d9577-LHR
cdn-requestpullsuccess: True

GET
H2 200 css
fonts.googleapis.com/ 14 KB
1 KB 231ms
78ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:200,400,700,200italic,400italic,700italic

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

83212a7016848fb3c92281449aeb751aaaac914aa50a90f1b35998c8f2b19cdd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 17 Sep 2024 06:01:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 17 Sep 2024 06:01:24 GMT

GET
H3 200 style.min.css
www.intego.com/mac-security-blog/wp-includes/css/dist/block-library/ 79 KB
10 KB 69ms
67ms Stylesheet
text/css 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-includes/css/dist/block-library/style.min.css?ver=5.8.10

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "13abe-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a84c2a406b-LHR
alt-svc: h3=":443"; ma=86400
content-length: 10523
expires: Tue, 01 Oct 2024 05:47:16 GMT

GET
H3 200 mediaelementplayer-legacy.min.css
www.intego.com/mac-security-blog/wp-includes/js/mediaelement/ 11 KB
3 KB 69ms
66ms Stylesheet
text/css 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.16

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "2bf8-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a84c2b406b-LHR
alt-svc: h3=":443"; ma=86400
content-length: 2592
expires: Tue, 01 Oct 2024 05:46:40 GMT

GET
H3 200 wp-mediaelement.min.css
www.intego.com/mac-security-blog/wp-includes/js/mediaelement/ 4 KB
1 KB 94ms
92ms Stylesheet
text/css 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=5.8.10

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "105a-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a84c2c406b-LHR
alt-svc: h3=":443"; ma=86400
content-length: 1156
expires: Tue, 01 Oct 2024 05:47:16 GMT

GET
H3 200 light_style.css
www.intego.com/mac-security-blog/wp-content/plugins/jquery-collapse-o-matic/ 884 B
596 B 69ms
67ms Stylesheet
text/css 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/plugins/jquery-collapse-o-matic/light_style.css?ver=1.6

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d077683ec63c7d44f473554e688628da6cfdf84c0f223b6be00f2476600433a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:23 GMT
server: cloudflare
cf-polished: origSize=1043
etag: W/"413-61ce448fe23c0-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a84c2d406b-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 05:38:19 GMT

GET
H3 200 bootstrap.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 99 KB
17 KB 101ms
100ms Stylesheet
text/css 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/bootstrap.css?ver=1.0

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3fb4cab423b2441335fc682b79687d8eb806aceb384c937c9b28534580593fd4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
cf-polished: origSize=121622
etag: W/"1db16-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a84c2e406b-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 05:38:19 GMT

GET
H3 200 bootstrap-responsive.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 16 KB
4 KB 102ms
100ms Stylesheet
text/css 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/bootstrap-responsive.css?ver=1.0

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d2dcaca89ae344f9ba12d903385c7c7096fe869e8f12605e81d9b88078bef18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
cf-polished: origSize=21801
etag: W/"5529-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a84c30406b-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 05:46:40 GMT

GET
H3 200 layout-responsive.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 2 KB
923 B 68ms
67ms Stylesheet
text/css 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout-responsive.css?ver=1.0

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

94562cfaffaf86145e9e271e11e2044a951dcf791bdf5769c3d58ba9acc44fdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
cf-polished: origSize=3429
etag: W/"d65-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a84c33406b-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 05:38:19 GMT

GET
H3 200 social-logos.min.css
www.intego.com/mac-security-blog/wp-content/plugins/jetpack/_inc/social-logos/ 12 KB
8 KB 69ms
68ms Stylesheet
text/css 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/plugins/jetpack/_inc/social-logos/social-logos.min.css?ver=10.2.1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b958e0f47861dde13a175cc69494bdb54f08e2b5e78cecf6abd16470d2085257

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 10 Jul 2024 13:04:22 GMT
server: cloudflare
etag: "2f4a-61ce448eee180-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a84c36406b-LHR
alt-svc: h3=":443"; ma=86400
content-length: 7898
expires: Tue, 01 Oct 2024 05:46:40 GMT

GET
H3 200 jetpack.css
www.intego.com/mac-security-blog/wp-content/plugins/jetpack/css/ 85 KB
17 KB 101ms
100ms Stylesheet
text/css 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/plugins/jetpack/css/jetpack.css?ver=10.2.1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a4f9c1995de9f92f05f1a5cd0c4987e359e1aa41613bb6a33f9c82837b29e6d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:22 GMT
server: cloudflare
cf-polished: origSize=87188
etag: W/"15494-61ce448eee180-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a84c3a406b-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 05:46:40 GMT

GET
H3 200 advanced-recent-posts-widget.css
www.intego.com/mac-security-blog/wp-content/plugins/advanced-recent-posts-widget/css/ 582 B
441 B 129ms
128ms Stylesheet
text/css 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/plugins/advanced-recent-posts-widget/css/advanced-recent-posts-widget.css?ver=5.8.10

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f538d5803d00836b5f946264abb64976a6416ab4cc16f8f83455a025a08ad014

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:22 GMT
server: cloudflare
cf-polished: origSize=744
etag: W/"2e8-61ce448eee180-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a84c3e406b-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 05:47:16 GMT

GET
H3 200 rocket-loader.min.js Show response
www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 51ms
51ms Script
application/javascript 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 10 Sep 2024 18:11:43 GMT
server: cloudflare
etag: W/"66e08bdf-302c"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 8c46e1a87c78406b-LHR
expires: Thu, 19 Sep 2024 06:01:24 GMT

GET
H3 200 btn_search.png
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/ 1 KB
1 KB 129ms
128ms Image
image/webp 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/btn_search.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

85c1eb2c2a173feceba14abe8344fe9c7cb12aa1353f083f28a62f1a366763b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=2462
content-disposition: inline; filename="btn_search.webp"
alt-svc: h3=":443"; ma=86400
content-length: 1104
cf-bgj: imgq:85,h2pri
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "99e-61ce4490d6600"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a84c45406b-LHR
expires: Tue, 01 Oct 2024 05:40:55 GMT

GET
H3 200 intego-podcast-artwork-400.jpg
www.intego.com/mac-security-blog/wp-content/uploads/2021/04/ 7 KB
8 KB 110ms
110ms Image
image/webp 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2021/04/intego-podcast-artwork-400.jpg

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

903adc82f54bd61a22c1672000865fc19334735ba0ad395b361f67ccc2bdfd33

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 3299
cf-polished: qual=85, origFmt=jpeg, origSize=18660
content-disposition: inline; filename="intego-podcast-artwork-400.webp"
alt-svc: h3=":443"; ma=86400
content-length: 7550
cf-bgj: imgq:85,h2pri
last-modified: Mon, 05 Apr 2021 14:37:57 GMT
server: cloudflare
etag: "48e4-5bf3aa4c61bdf"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a87c79406b-LHR
expires: Tue, 01 Oct 2024 04:44:36 GMT

GET
H3 200 X-Twitter-logo-icon-225.gif
www.intego.com/mac-security-blog/wp-content/uploads/2024/03/ 1 KB
2 KB 109ms
106ms Image
image/webp 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2024/03/X-Twitter-logo-icon-225.gif

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3b302bf527209ab634a379dc27b9a22838e88001e24df759794f13f2810725e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cf-polished: origFmt=gif, origSize=2235
content-disposition: inline; filename="X-Twitter-logo-icon-225.webp"
alt-svc: h3=":443"; ma=86400
content-length: 1338
cf-bgj: imgq:85,h2pri
last-modified: Sat, 23 Mar 2024 04:04:57 GMT
server: cloudflare
etag: "8bb-6144c0b25a6d8"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a87c7a406b-LHR
expires: Tue, 01 Oct 2024 05:40:55 GMT

GET
H3 200 Facebook-logo-icon-225.gif
www.intego.com/mac-security-blog/wp-content/uploads/2024/03/ 1 KB
2 KB 109ms
106ms Image
image/webp 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2024/03/Facebook-logo-icon-225.gif

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dd71e7bfa741c12ffde65deffbc1108ee85dfd3dfd200fb99c684c877fb364c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cf-polished: origFmt=gif, origSize=3000
content-disposition: inline; filename="Facebook-logo-icon-225.webp"
alt-svc: h3=":443"; ma=86400
content-length: 1510
cf-bgj: imgq:85,h2pri
last-modified: Sat, 23 Mar 2024 04:31:47 GMT
server: cloudflare
etag: "bb8-6144c6b242fb9"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a87c7b406b-LHR
expires: Tue, 01 Oct 2024 05:24:45 GMT

GET
H3 200 YouTube-logo-icon-225.png
www.intego.com/mac-security-blog/wp-content/uploads/2024/03/ 8 KB
9 KB 110ms
106ms Image
image/webp 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2024/03/YouTube-logo-icon-225.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f453faccde456fd8b4f8abdda945eaea20b7fdebbff4fdb3ae03e7f75622972

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=10479
content-disposition: inline; filename="YouTube-logo-icon-225.webp"
alt-svc: h3=":443"; ma=86400
content-length: 8526
cf-bgj: imgq:85,h2pri
last-modified: Sat, 23 Mar 2024 04:04:57 GMT
server: cloudflare
etag: "28ef-6144c0b2d8678"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a87c7c406b-LHR
expires: Tue, 01 Oct 2024 05:40:55 GMT

GET
H3 200 Pinterest-logo-icon-225.png
www.intego.com/mac-security-blog/wp-content/uploads/2024/03/ 10 KB
10 KB 110ms
106ms Image
image/webp 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2024/03/Pinterest-logo-icon-225.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4d3c6be580921c6b730a51242bbcedd60998424bb68a659b82a94b8839e63b92

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=12807
content-disposition: inline; filename="Pinterest-logo-icon-225.webp"
alt-svc: h3=":443"; ma=86400
content-length: 9932
cf-bgj: imgq:85,h2pri
last-modified: Sat, 23 Mar 2024 04:04:56 GMT
server: cloudflare
etag: "3207-6144c0b1d7918"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a87c7d406b-LHR
expires: Tue, 01 Oct 2024 05:40:55 GMT

GET
H3 200 LinkedIn-logo-icon-225.gif
www.intego.com/mac-security-blog/wp-content/uploads/2024/03/ 2 KB
2 KB 110ms
107ms Image
image/webp 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2024/03/LinkedIn-logo-icon-225.gif

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

29c6beffd42fb25d6fe9ba5dd7c5a0262c9fab9e113de7c624e62fd3ed8ed41e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cf-polished: origFmt=gif, origSize=4358
content-disposition: inline; filename="LinkedIn-logo-icon-225.webp"
alt-svc: h3=":443"; ma=86400
content-length: 2042
cf-bgj: imgq:85,h2pri
last-modified: Sat, 23 Mar 2024 04:04:55 GMT
server: cloudflare
etag: "1106-6144c0b10c718"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a87c7e406b-LHR
expires: Tue, 01 Oct 2024 05:24:45 GMT

GET
H3 200 Instagram-logo-icon-225.gif
www.intego.com/mac-security-blog/wp-content/uploads/2024/03/ 8 KB
8 KB 117ms
113ms Image
image/webp 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2024/03/Instagram-logo-icon-225.gif

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f9b05fa232d19f1752ceaea7eec0110daa8d4401caa7d415fb4e08a3db60df3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cf-polished: origFmt=gif, origSize=14606
content-disposition: inline; filename="Instagram-logo-icon-225.webp"
alt-svc: h3=":443"; ma=86400
content-length: 8380
cf-bgj: imgq:85,h2pri
last-modified: Sat, 23 Mar 2024 04:31:48 GMT
server: cloudflare
etag: "390e-6144c6b2e517a"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a87c7f406b-LHR
expires: Tue, 01 Oct 2024 05:40:55 GMT

GET
H3 200 ios9-podcasts-app-tile.png
www.intego.com/mac-security-blog/wp-content/uploads/2017/10/ 38 KB
38 KB 134ms
131ms Image
image/webp 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2017/10/ios9-podcasts-app-tile.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8b0e8742416cb22d33029e1b4799431b847420b75c58f9eff600a2b15faa6e4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=49061
content-disposition: inline; filename="ios9-podcasts-app-tile.webp"
alt-svc: h3=":443"; ma=86400
content-length: 38692
cf-bgj: imgq:85,h2pri
last-modified: Tue, 31 Oct 2017 12:56:45 GMT
server: cloudflare
etag: "bfa5-55cd749891d40"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a87c81406b-LHR
expires: Tue, 01 Oct 2024 05:40:55 GMT

GET
H2 200 woman-with-worried-concerned-upset-face-looking-at-her-iPhone-400x260-1.jpg
i2.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2024/05/ 710 B
1 KB 152ms
28ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2024/05/woman-with-worried-concerned-upset-face-looking-at-her-iPhone-400x260-1.jpg?resize=40%2C40&ssl=1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

7963f87cb07f8a42a168d9cdcf2ed0cd45583291c011849a322a29002d38957f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
content-length: 710
x-nc: HIT lhr 1
last-modified: Mon, 29 Jul 2024 07:01:53 GMT
server: nginx
etag: "f6e4ecf7c4a842d6"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://www.intego.com/mac-security-blog/wp-content/uploads/2024/05/woman-with-worried-concerned-upset-face-looking-at-her-iPhone-400x260-1.jpg>; rel="canonical"
expires: Wed, 29 Jul 2026 19:01:53 GMT

GET
H2 200 apple-watch-bands-hero-400.jpg
i2.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2024/09/ 622 B
1 KB 152ms
28ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2024/09/apple-watch-bands-hero-400.jpg?resize=40%2C40&ssl=1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

f1193951467f0698533ba8fd3e78c9cc9e8852b1f5e2ea2a54f05b46ddc8b275

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
content-length: 622
x-nc: HIT lhr 3
last-modified: Tue, 10 Sep 2024 15:04:03 GMT
server: nginx
etag: "dc382806b5af7611"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://www.intego.com/mac-security-blog/wp-content/uploads/2024/09/apple-watch-bands-hero-400.jpg>; rel="canonical"
expires: Fri, 11 Sep 2026 03:04:03 GMT

GET
H2 200 macOS-Sequoia-on-old-white-MacBook-2009-400x260-1.jpg
i2.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2024/08/ 514 B
946 B 155ms
31ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2024/08/macOS-Sequoia-on-old-white-MacBook-2009-400x260-1.jpg?resize=40%2C40&ssl=1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

42b34f0823b708cc37e194c980748a6cf9de5964e659c4c44d861dd02877fa50

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
content-length: 514
x-nc: HIT lhr 4
last-modified: Mon, 26 Aug 2024 07:07:33 GMT
server: nginx
etag: "5ad9c8208d37ff12"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://www.intego.com/mac-security-blog/wp-content/uploads/2024/08/macOS-Sequoia-on-old-white-MacBook-2009-400x260-1.jpg>; rel="canonical"
expires: Wed, 26 Aug 2026 19:07:33 GMT

GET
H2 200 sequoia-installer-400.png
i0.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2024/09/ 2 KB
2 KB 156ms
29ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2024/09/sequoia-installer-400.png?resize=40%2C40&ssl=1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

d8acb590859de744b30290b81039414fcc1f0ceb539cf8d29f8f8a0438cc935c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
content-length: 1750
x-nc: HIT lhr 4
last-modified: Mon, 16 Sep 2024 23:02:21 GMT
server: nginx
etag: "3bfb156df81db54b"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://www.intego.com/mac-security-blog/wp-content/uploads/2024/09/sequoia-installer-400.png>; rel="canonical"
expires: Thu, 17 Sep 2026 11:02:21 GMT

GET
H2 200 id1293834627
embed.podcasts.apple.com/us/podcast/intego-mac-podcast/ Frame BCCD 0
0 264ms
64ms Document
text/html 2a02:26f0:7100::213:c6d3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.podcasts.apple.com/us/podcast/intego-mac-podcast/id1293834627?itsct=podcast_box&itscg=30200

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:7100::213:c6d3 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

daiquiri/5 /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' 'unsafe-inline' blob: podcasts: com.apple.podcasts: itmss: itms-podcast: https://.apple.com; img-src 'self' data: https://.apple.com https://.mzstatic.com; media-src
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

apple-originating-system: UnknownOriginatingSystem
apple-seq: 0.0
apple-tk: false
cache-control: no-transform, max-age=45
content-encoding: gzip
content-length: 948
content-security-policy: default-src 'self' 'unsafe-eval' 'unsafe-inline' blob: podcasts: com.apple.podcasts: itmss: itms-podcast: https://*.apple.com; img-src 'self' data: https://*.apple.com https://*.mzstatic.com; media-src *
content-type: text/html
date: Tue, 17 Sep 2024 06:01:24 GMT
etag: "a181fb584d88698738b21347f0e95c68"
expect-ct: max-age=86400, enforce
last-modified: Mon, 17 Jun 2024 22:57:16 GMT
server: daiquiri/5
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-apple-jingle-correlation-key: RJGA2OQEUBC6ZONGRYISQV2FQ4
x-apple-request-uuid: 8a4c0d3a-04a0-45ec-b9a6-8e1128574587
x-apple-version-number: 2424.1.0
x-content-type-options: nosniff
x-daiquiri-instance: daiquiri:45887001:st44p00it-hyhk15124201:7987:24RELEASE186:daiquiri-amp-all-shared-int-001-st daiquiri:48493002:st44p00it-hyhk16134201:7987:24RELEASE186:daiquiri-amp-all-shared-ext-001-st daiquiri:42282004:st53p00it-qujn12050502:7987:24RELEASE186:daiquiri-amp-store-l7shared-ext-001-st
x-responding-instance: silverbullet-external:2032:st47p00it-qujn14040302:8301:24K1
x-xss-protection: 1; mode=block

GET
H3 200 related.css
www.intego.com/mac-security-blog/wp-content/plugins/yet-another-related-posts-plugin/style/ 495 B
455 B 134ms
134ms Stylesheet
text/css 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/plugins/yet-another-related-posts-plugin/style/related.css?ver=5.27.6

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a48e3091c3e26309f1329bb7ee2812cf158deb93cd80fe6439e53e8d57e58d3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: W/"1ef-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a87c83406b-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 05:40:55 GMT

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ 19 KB
7 KB 180ms
61ms Script
text/javascript 2606:4700::6810:5049
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Origin: https://www.intego.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
server: cloudflare
etag: W/"2024.6.1"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 8c46e1a93ff776b9-LHR

GET
H3 200 reset.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 773 B
653 B 173ms
173ms Stylesheet
text/css 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/reset.css

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

82f1278f66b192a223e306d884f8db595ef3b6d829cc1544807b9bf40019403e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
cf-polished: origSize=1184
etag: W/"4a0-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a8acd1406b-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 05:46:40 GMT

GET
H3 200 layout.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 24 KB
6 KB 105ms
105ms Stylesheet
text/css 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5f5f25721168edeb2b63229c2ab58e5d7f987ee5e8aced298e7445111badf09

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
cf-polished: origSize=30980
etag: W/"7904-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a8acd7406b-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 05:38:19 GMT

GET
H3 200 wrapper.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 256 KB
25 KB 106ms
105ms Stylesheet
text/css 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/wrapper.css

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50a82e0e3e97292e27f203cea4c71f3acaff073c1cfb1dc8cd63999efc9de72e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
cf-polished: origSize=291157
etag: W/"47155-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a8acda406b-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 05:46:40 GMT

GET
H3 200 referrer-overrides.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 125 B
326 B 106ms
105ms Stylesheet
text/css 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/referrer-overrides.css

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aaffceab986a8d791cfef18d2d1e28fe2dcaf40a8bdfaf4fd393b1a91c6f072b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
cf-polished: origSize=141
etag: W/"8d-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a8acdd406b-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 05:38:19 GMT

GET
H3 200 print.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 2 KB
555 B 119ms
118ms Stylesheet
text/css 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/print.css

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

884a2330198f498e36d9e77bb5c7f4971b3d70c4411cf306a3afca8bb50bb94d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
cf-polished: origSize=3073
etag: W/"c01-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a8ace0406b-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 05:38:19 GMT

GET
H2 200 css2
fonts.googleapis.com/ 3 KB
504 B 72ms
71ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Red+Hat+Display:wght@400;600;700;900&display=swap

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/wrapper.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

266fc6c7a849c593382767fc93937cd9fecf56a5c7abac6b938153f001a2359a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/wrapper.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 17 Sep 2024 06:01:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 17 Sep 2024 06:01:24 GMT

GET
H2 200 css2
fonts.googleapis.com/ 4 KB
517 B 86ms
85ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Red+Hat+Display:wght@300;400;500;600;700&display=swap

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/wrapper.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c3362186a709ce7cffcc17f7cbd317bddb60bd6409cc7b3d8c9f364f03152f6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/wrapper.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 17 Sep 2024 06:01:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 17 Sep 2024 06:01:24 GMT

GET
H3 200 logo2.png
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/ 3 KB
3 KB 64ms
63ms Image
image/webp 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/logo2.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/wrapper.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e3faa302181b852e63034b619d928577e5e641d8502b630dd654cc6f0aa18ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/wrapper.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=3741
content-disposition: inline; filename="logo2.webp"
alt-svc: h3=":443"; ma=86400
content-length: 2892
cf-bgj: imgq:85,h2pri
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "e9d-61ce4490d6600"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a9fdbc406b-LHR
expires: Tue, 01 Oct 2024 05:40:55 GMT

GET
H3 200 blog_header_bg.gif
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/ 3 KB
3 KB 65ms
65ms Image
image/webp 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/blog_header_bg.gif

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

17aebab8504111847bb14d190557397752564704ba02e65f98c5fde9995fc834

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cf-polished: origFmt=gif, origSize=5992
content-disposition: inline; filename="blog_header_bg.webp"
alt-svc: h3=":443"; ma=86400
content-length: 3064
cf-bgj: imgq:85,h2pri
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "1768-61ce4490d6600"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a9fdbd406b-LHR
expires: Tue, 01 Oct 2024 05:24:44 GMT

GET
H3 200 share_divider.png
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/ 166 B
459 B 43ms
42ms Image
image/webp 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/share_divider.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ffa8b5c0d78def1b71617c0ae00e01b295bc29e2e227ba0dc84469a9ba39259c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2301
cf-polished: origFmt=png, origSize=1219
content-disposition: inline; filename="share_divider.webp"
alt-svc: h3=":443"; ma=86400
content-length: 166
cf-bgj: imgq:85,h2pri
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "4c3-61ce4490d6600"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a9fdbe406b-LHR
expires: Tue, 01 Oct 2024 05:23:03 GMT

GET
H3 200 sidebar_divider.jpg
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/ 154 B
451 B 59ms
59ms Image
image/webp 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/sidebar_divider.jpg

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

25b786ec50525130cddd67183bc696608e1fc88651fe5d1d953667e9f4643c4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cf-polished: qual=85, origFmt=jpeg, origSize=1779
content-disposition: inline; filename="sidebar_divider.webp"
alt-svc: h3=":443"; ma=86400
content-length: 154
cf-bgj: imgq:85,h2pri
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "6f3-61ce4490d6600"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a9fdc2406b-LHR
expires: Tue, 01 Oct 2024 05:40:55 GMT

GET
DATA 200
OK truncated
/ 529 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8ecf7fe958f132008eb2eaeda1a079451a62372838a6c18d9e1353f64e48172a

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 558 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 93b94b74b73c37bcb3e6d8cada57b5ce45d7bd3fe5e3b2b6194a702d1353e1a0

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 978 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 62d2cc93ab8f52afb7379b9fabdc6f383f7700367cda04191ad1a8158c449c23

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 746 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 114773206c8b1ef17f1865f1fd0acb5ee36aa4f666718144698063fd295a0f65

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 124d5d7d1a1e13e129ad8ffbba218f6fd857f706d9af89d05d2686a0627ce127

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 8vIQ7wUr0m80wwYf0QCXZzYzUoTg_T6h.woff2
fonts.gstatic.com/s/redhatdisplay/v19/ 28 KB
29 KB 198ms
57ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/redhatdisplay/v19/8vIQ7wUr0m80wwYf0QCXZzYzUoTg_T6h.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Red+Hat+Display:wght@400;600;700;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25ea6c91f8fbcbd412919dbb47da3e432622997eb37a3139fad5d21d59135962

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.intego.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 14 Sep 2024 01:21:23 GMT
x-content-type-options: nosniff
age: 276002
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29072
x-xss-protection: 0
last-modified: Thu, 24 Aug 2023 21:14:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 14 Sep 2025 01:21:23 GMT

GET
H3 200 DagnyWebPro.woff
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/ 39 KB
39 KB 47ms
45ms Font
font/woff 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/DagnyWebPro.woff

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

364c1179390530ea06c6636e2f314aa1091d460c4c6e369c6689a0fe31672054

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
Origin: https://www.intego.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1977
alt-svc: h3=":443"; ma=86400
content-length: 40116
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "9cb4-61ce4490d6600"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1aa4df1406b-LHR
expires: Tue, 01 Oct 2024 04:44:11 GMT

GET
H3 200 fontawesome-webfont.woff
netdna.bootstrapcdn.com/font-awesome/3.1.1/font/ 34 KB
34 KB 140ms
43ms Font
font/woff 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://netdna.bootstrapcdn.com/font-awesome/3.1.1/font/fontawesome-webfont.woff?v=3.1.0

Requested by

Host: netdna.bootstrapcdn.com
URL: https://netdna.bootstrapcdn.com/font-awesome/3.1.1/css/font-awesome.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4e58b78b5844a988d67532b4683a6e8b3235b3d56d319727e65f460805bbdec4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://netdna.bootstrapcdn.com/font-awesome/3.1.1/css/font-awesome.css
Origin: https://www.intego.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 1187
age: 15473402
cdn-cachedat: 02/05/2024 16:20:42
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 34420
last-modified: Mon, 25 Jan 2021 22:04:51 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: "9434b081ed2d237abfe96e832592ef15"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 77c57bcfedb6b4789c11bd0f016ce6b9
accept-ranges: bytes
timing-allow-origin: *
cdn-requestcountrycode: FR
cdn-status: 200
cf-ray: 8c46e1aaeadd407d-LHR
cdn-requestpullsuccess: True

GET
H3 200 DagnyWebPro-Bold.woff
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/ 40 KB
40 KB 48ms
48ms Font
font/woff 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/DagnyWebPro-Bold.woff

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

142bb04454d6124c28f12d43249615ae8903c9742ea86c024ef0602f4dd1446e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
Origin: https://www.intego.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1977
alt-svc: h3=":443"; ma=86400
content-length: 40940
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "9fec-61ce4490d6600"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1aa4df2406b-LHR
expires: Tue, 01 Oct 2024 04:44:11 GMT

GET
DATA 200
OK truncated
/ 7 KB
7 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5e7d52bf5f53348ca036d8381f04bb01c93b3110ccac87ca3cb75fd1ce0a92c6

Request headers

Referer
Origin: https://www.intego.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ 15 KB
15 KB 192ms
52ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:200,400,700,200italic,400italic,700italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.intego.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 10 Sep 2024 11:42:04 GMT
x-content-type-options: nosniff
age: 584361
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Sep 2025 11:42:04 GMT

GET
H3 200 evil-rat-macos-malware-emerging-jumping-from-apple-macbook-pro-600x400-1.jpg
www.intego.com/mac-security-blog/wp-content/uploads/2024/09/ 39 KB
40 KB 400ms
399ms Image
image/jpeg 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2024/09/evil-rat-macos-malware-emerging-jumping-from-apple-macbook-pro-600x400-1.jpg

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

86a9de4e1dd6d002b1f6adb84200766b15f0fac31f6b5b49907b6f71af061c11

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:25 GMT
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
cf-polished: degrade=85, origSize=101605, status=webp_bigger
alt-svc: h3=":443"; ma=86400
content-length: 40381
cf-bgj: imgq:85,h2pri
last-modified: Thu, 05 Sep 2024 15:48:49 GMT
server: cloudflare
etag: "18ce5-621613a05bef2"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1aa4dee406b-LHR
expires: Tue, 01 Oct 2024 06:01:25 GMT

GET
H3 200 X9-Mac-Antivirus-Launch-300x150.png
www.intego.com/mac-security-blog/wp-content/uploads/2016/06/ 27 KB
28 KB 399ms
399ms Image
image/webp 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2016/06/X9-Mac-Antivirus-Launch-300x150.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

25aa0b7b8ad904efa464dc2b11da0975d77ef2ba0eb747b06b72c738b95e581d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:25 GMT
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
cf-polished: origFmt=png, origSize=47876
content-disposition: inline; filename="X9-Mac-Antivirus-Launch-300x150.webp"
alt-svc: h3=":443"; ma=86400
content-length: 27938
cf-bgj: imgq:85,h2pri
last-modified: Mon, 20 Jun 2016 03:34:07 GMT
server: cloudflare
etag: "bb04-535ad606e29c0"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1aa4def406b-LHR
expires: Tue, 01 Oct 2024 06:01:25 GMT

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 56 B
361 B 261ms
100ms Script
text/javascript 2.19.225.248
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.19.225.248 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-19-225-248.deploy.static.akamaitechnologies.com

Software

Oracle API Gateway /

Resource Hash

f475c34186022ba531ebc8bba97fc10df7e4c3ea854f314a18ab0644c851620d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 17 Sep 2024 06:01:25 GMT
server: Oracle API Gateway
opc-request-id: /34C0B3DE5142B6D920B43AC39F80798B/3AE6B785CB6FA5B3A1C4D1E0E251CE25
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: text/javascript
x-distribution: 99
x-host: s7.addthis.com
content-length: 76
x-xss-protection: 1; mode=block

GET
H2 200 e-202438.js Show response
stats.wp.com/ 7 KB
3 KB 142ms
32ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202438.js
Requested by: Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 5badd609a51ede5bab5b89534fc3011a4dd1ab487cc7081d7cf38479bcbab855

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-minify-cache: hit
x-nc: HIT lhr
date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
server: nginx
x-minify: t
etag: W/14421-1717166113344.7605
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
alt-svc: h3=":443"; ma=86400
expires: Mon, 15 Sep 2025 09:42:56 GMT

GET
H3 200 sharing.min.js Show response
www.intego.com/mac-security-blog/wp-content/plugins/jetpack/_inc/build/sharedaddy/ 12 KB
4 KB 63ms
62ms Script
application/javascript 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/plugins/jetpack/_inc/build/sharedaddy/sharing.min.js?ver=10.2.1

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

80ee2d8ce5d2a3f78fc3b8eaa67bc266645c58b96d8a804556f1e6cb8737d0cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 10 Jul 2024 13:04:22 GMT
server: cloudflare
etag: "2f6d-61ce448eee180-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1aa4df3406b-LHR
alt-svc: h3=":443"; ma=86400
content-length: 3807
expires: Tue, 01 Oct 2024 05:40:55 GMT

GET
H3 200 wp-embed.min.js Show response
www.intego.com/mac-security-blog/wp-includes/js/ 1 KB
978 B 58ms
56ms Script
application/javascript 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-includes/js/wp-embed.min.js?ver=5.8.10

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "592-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1aa4df4406b-LHR
alt-svc: h3=":443"; ma=86400
content-length: 765
expires: Tue, 01 Oct 2024 05:47:23 GMT

GET
H3 200 collapse.js Show response
www.intego.com/mac-security-blog/wp-content/plugins/jquery-collapse-o-matic/js/ 15 KB
3 KB 71ms
70ms Script
application/javascript 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/plugins/jquery-collapse-o-matic/js/collapse.js?ver=1.6.23

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1711944c7b1540085ff5f7ee6cfa0e2fb504383825d4739ec799b4fd0dd69e7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:23 GMT
server: cloudflare
cf-polished: origSize=21298
etag: W/"5332-61ce448fe23c0-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
cf-ray: 8c46e1aa4df6406b-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 05:38:19 GMT

GET
H3 200 comment_embed.js Show response
www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/ 878 B
585 B 413ms
411ms Script
application/javascript 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.22

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

60631ed8f1dfa6713ff9e30fec41786aadc477c0cac5a75dca66b5a49f76b901

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:25 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: EXPIRED
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:22 GMT
server: cloudflare
cf-polished: origSize=1232
etag: W/"4d0-61ce448eee180-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
cf-ray: 8c46e1aa4df7406b-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 06:01:25 GMT

GET
H3 200 comment_count.js Show response
www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/ 708 B
586 B 71ms
68ms Script
application/javascript 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.22

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b385fd0614f2927f0e7fdc03ccdb2428e3a93de0c7fe467149b34213cc32c0f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:22 GMT
server: cloudflare
cf-polished: origSize=889
etag: W/"379-61ce448eee180-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
cf-ray: 8c46e1aa4df8406b-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 05:38:19 GMT

GET
H3 200 comment-reply.min.js Show response
www.intego.com/mac-security-blog/wp-includes/js/ 3 KB
2 KB 71ms
69ms Script
application/javascript 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-includes/js/comment-reply.min.js?ver=5.8.10

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "ba8-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1aa4df9406b-LHR
alt-svc: h3=":443"; ma=86400
content-length: 1346
expires: Tue, 01 Oct 2024 05:47:23 GMT

GET
H3 200 tracking.js Show response
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/ 3 KB
1 KB 71ms
69ms Script
application/javascript 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/tracking.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ad480458e8c9c476d4bed65c1df11a68284c9244342d977064bf4a0efd9e3ff5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
cf-polished: origSize=4191
etag: W/"105f-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
cf-ray: 8c46e1aa4dfa406b-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 05:24:44 GMT

GET
H3 200 scripts.js Show response
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/ 11 KB
4 KB 71ms
69ms Script
application/javascript 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/scripts.js?ver=5.8.10

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

39511dff8f9d64434df213852f4f6a8964847c8e086da423e336b10ae422b678

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
cf-polished: origSize=19243
etag: W/"4b2b-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
cf-ray: 8c46e1aa4dfb406b-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 05:47:23 GMT

GET
H3 200 modernizr-1.6.min.js Show response
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/ 9 KB
4 KB 71ms
69ms Script
application/javascript 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/modernizr-1.6.min.js?ver=5.8.10

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0140ed5069f22e4aa8bb1a1fc615c39fc55d7d64e94be541615f1c5a30ae479b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "255b-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1aa4dfc406b-LHR
alt-svc: h3=":443"; ma=86400
content-length: 3717
expires: Tue, 01 Oct 2024 05:47:24 GMT

GET
H3 200 html5shiv.js Show response
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/ 2 KB
1 KB 72ms
71ms Script
application/javascript 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/html5shiv.js?ver=5.8.10

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b859cc611126401cdc38d803ac7c5967ee5da1a626e00318700ea88df55da1b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
cf-polished: origSize=2376
etag: W/"948-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
cf-ray: 8c46e1aa4dfd406b-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 05:47:24 GMT

GET
H3 200 bootstrap.min.js Show response
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/ 25 KB
7 KB 72ms
71ms Script
application/javascript 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/bootstrap.min.js?ver=5.8.10

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7587369160233b751c90ccc2043b7fdfd7eb1f0d9aa610371b43f4b3419fa83f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "648f-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1aa4dfe406b-LHR
alt-svc: h3=":443"; ma=86400
content-length: 6816
expires: Tue, 01 Oct 2024 05:47:24 GMT

GET
H3 200 jquery-migrate.min.js Show response
www.intego.com/mac-security-blog/wp-includes/js/jquery/ 11 KB
4 KB 71ms
70ms Script
application/javascript 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "2bd8-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1aa4dff406b-LHR
alt-svc: h3=":443"; ma=86400
content-length: 4169
expires: Tue, 01 Oct 2024 05:38:19 GMT

GET
H3 200 jquery.min.js Show response
www.intego.com/mac-security-blog/wp-includes/js/jquery/ 87 KB
30 KB 72ms
68ms Script
application/javascript 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "15db1-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1aa4e00406b-LHR
alt-svc: h3=":443"; ma=86400
content-length: 30908
expires: Tue, 01 Oct 2024 05:38:19 GMT

GET
H3 200 wp-emoji-release.min.js Show response
www.intego.com/mac-security-blog/wp-includes/js/ 18 KB
5 KB 61ms
61ms Script
application/javascript 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-includes/js/wp-emoji-release.min.js?ver=5.8.10

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "4705-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1accf09406b-LHR
alt-svc: h3=":443"; ma=86400
content-length: 4930
expires: Tue, 01 Oct 2024 05:47:19 GMT

GET
H3 200 favicon.ico
www.intego.com/sites/all/themes/intego_3/dist/favicons/ 401 KB
89 KB 52ms
52ms Other
image/vnd.microsoft.icon 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/sites/all/themes/intego_3/dist/favicons/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

04f5e859d2634d401e0b1e6f9a8d3abab7a5d10919e4a3aee96b7d5b90c25aec

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:25 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 10 Jul 2024 13:04:27 GMT
server: cloudflare
age: 2235
etag: W/"643e6-61ce4493b2cc0"
vary: Accept-Encoding
content-type: image/vnd.microsoft.icon
cache-control: max-age=1209600
cf-ray: 8c46e1acdf0d406b-LHR
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 04:44:37 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 345 KB
110 KB 230ms
81ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-9WJ8

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e578fb9d0c0b302d35e555500d77181721e76faff484586681b7d08aea225bd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 112097
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 17 Sep 2024 06:01:25 GMT

GET
H3 400 / Show response
graph.facebook.com/ 202 B
321 B 256ms
134ms XHR
application/json 2a03:2880:f084:a:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?id=https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:a:face:b00c:0:2 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e6dac340609ed8fff29c34106ccfd90516bd4258e9396a061cf143fdc3cab7db

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
date: Tue, 17 Sep 2024 06:01:25 GMT
www-authenticate: OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
x-fb-rev: 1016547595
alt-svc: h3=":443"; ma=86400
content-length: 202
proxy-status: http_request_error; e_proxy="AcLL7ikKLeuorleh5apZ88FA2x3IDMOaJkPDi6KErfsvLmaNjrFUIGc9shDY2iom7xAiDQWVLXUk9PW65Rig"; e_fb_binaryversion="AcIqNbaLO1zLVTCEMI7Ut5hBCwnxzm2KMigv5GsrKl35KWUxZ53DbdB5Dq-CviIaRL-86-yG_bKNAeM8Wdw4YUX0Ld_Vb4TSDYg"; e_fb_httpversion="AcLDL4vESJyM8SOKI1yh1iysvVPoInB77fB7u7sAgRC4Bz1rVgyyGrGsjhVE"; e_fb_responsebytes="AcIFIuoz1gvqQ5_TErhTrV6PF_oXK5u8UdDCosP6RxTuuHemxzTQmwxPWBE7"; e_fb_requesttime="AcLlChULyUnZ4vesNHEgGTTCuoIeuFDEJ8G51e7DncTOUbJVNzB6ku0tA1qbhu5Bfh2MQ2L82g"; e_fb_requesthandler="AcKRx8NowKmN1bvvuejZ3COqNotRTvt5AgbUz-7Sud2O__lRAXjad5kCUl3pCCGTCcvsN5f7FTY"; e_fb_hostheader="AcLPfWN5LVRbQ56Q3rqkbbxXBnuprvBb2fCNERB7STN2jy5eXtlSQz91l60sYlcxZIMvDooEmsQUqrFL"; e_fb_requestsequencenumber="AcIxKVDBfv4U1QK0hAAhaoxX_crQkujmX4yiSnWzQKB8RrCnKVIDigptNWNm"; e_upip="AcIFCs2MpbeIwvzcSXCA25vUhplZqr8g8Ly-_2q1jGpdG_jeP92ih7_PV6Myv4bxlhtT7p0lJ4k_rkmx6vfnfE0cqmMopmQgtw0yLuk"; e_fb_builduser="AcK_jSlHwJ8Wh_Ac455M2nhOJ1nTQpKrbEs-IY5t5jo6dx1J1BXFpkI0acuE9EFa888"; e_fb_vipport="AcJS7HAc42cKWe4Fxj5OIwKp3RuEMCbCfgXdazgqW-3YlQwP7DZQXk181PVV"; e_clientaddr="AcLPXY_mLveiGCqukNdTZFj82SZvDyNZZgZoiCDHVh1RIJBNBTmdkVNg6Rwyu8-ECNk1pT21Q81L858aqDpqjr1qYxXR5RM_qhXTTVEk1NosorOOrw"; e_fb_vipaddr="AcJqcl6yqHnQnpHCjblp6En2S34B5eK5NuWZF5xQziFARumEH4J3ZQLvfvoh9V_8xeWjPdY_CKWMIJFtE1u9gcOMFOIys8tchQ"; e_fb_configversion="AcKdwnQ8kj73xJBaqKtL7F5k91Fp_bTpltvaPKRB8M3au7H62UNNLyq0iF-Nxg", http_request_error; e_proxy="AcLvh9rqivtunP2lEeeeF_sOq4PDsSI6qckRRoDFM-4XmBwd0lqstZFcDZTEW9x8uJ0F5_fYo9b_Stg"; e_fb_binaryversion="AcIdtaVEiOHTHUdrEmin1WoSIsrvq8DBevV_RKdO9FcW9mr1-UbdyubWNisLpDR8JqNqGMIobkTtU0OyX_D9E9gC9VEk8w_SHiw"; e_fb_httpversion="AcJAi7fOZf4n_2iUSvqPlgHkv9YJJEkVNpW_jp2Whv4LM6hBRy-IITpBAZNj"; e_fb_responsebytes="AcJ18tBHQDXfkJ5DkR1K-M5KZinVs3iV5uYs56dKcMkw0oOzBIhErfNahSxF"; e_fb_requesttime="AcLSaFDMNv02fDaowJWm5uWR5oqshhrQWTD9DoF7CULnhxZCdMdQ8A809R_e4fs8HmKXdici2A"; e_fb_requesthandler="AcIWxuQ4DEMyiLy3Mo_BiQ_qQ0GzMIDyUDY6G8leFtKzvFEMmfGL2lQrYGmjc-fsTauDBndmUzw"; e_fb_hostheader="AcJdD2wc7oPjcVseR2b7k__9g--qaBFA9Uyu8yzcFS5jU4D6RsR79Buwd7vP5YSIGpZsxQ3dpM0bCa4F"; e_fb_requestsequencenumber="AcLu5HnyqUCsKlrSE3VKh0qtTqphGcP8ZfMGs63uVpIm0QcDcjQdNvZvWQ"; e_upip="AcJkMlmhsSInk9_sP5RxZS-XNtYjqRfBFxlz_b-XbkTDW7iwJEK_j9Wh7ZcnI5c5YYiAOPzhH2nsCsKMA2cj2Na3OqrMHNdmtA"; e_fb_builduser="AcJxrqGffHQYv4lzA0rhF7U2uwBT8-u1DBCX9t0J-ftE0PCKSM-fFXl9_5lYajm0RUs"; e_fb_vipport="AcLVisgBvfw6Z0COSNDFAAAHIA9KiagBV61Oq-KZZ0eoIEf5bAGUPkrFyX4t"; e_clientaddr="AcJfDmwWcYaRCsxkT0jyWc2sKPfMpQmBnJzEW_6oE-E9gHiN_EZIndFHDt5x7Z9F2CSraIT2Vo9GNXXPlx4NxqXb9Cm2ZII"; e_fb_vipaddr="AcKSzhLOaPNmMJ7BBk_v9Fu_xM61s7HJ_PktjZwO_lPtIoNmz4nz51T497xsmTH6tHm5vrXYwfjOa2dYUux1my3MiQuXNOi1"; e_fb_configversion="AcKnE5gkuEQYTQZIFyLbo5tb5_TU3TAV5qita8LAjMuOvzN8ktmBEERMLdHWHw"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=39, rtx=0, c=23, mss=1232, tbw=5676, tp=10, tpl=0, uplat=96, ullat=0
pragma: no-cache
x-fb-debug: LXZxUMa4gq7+UFoZDJ23TE3D+t+cLRraRuXEEWcjgSdvkinch+euHilT4hBCCDDYSH9E/1lYRx+c+Kg4UA0PMA==
x-fb-trace-id: C//o8MHd4B5
vary: Origin
content-type: application/json
access-control-allow-origin: *
x-fb-request-id: A0Y8_9HikjhUEzXw03qPn_Y
cache-control: no-store
facebook-api-version: v14.0
priority: u=1,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET share
www.linkedin.com/countserv/count/ 0
0

GET
H2 200 count.json Show response
widgets.pinterest.com/v1/urls/ 168 B
415 B 235ms
115ms Script
application/javascript 151.101.192.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://widgets.pinterest.com/v1/urls/count.json?source=6&url=https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/&callback=jQuery36003097451368257851_1726552885235&_=1726552885236

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.192.84 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e2bd3aa46a3827b06b65ff2175efd1536c4969671064c1d2eaccdd61fbe6be97

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:25 GMT
content-encoding: br
x-content-type-options: nosniff
x-pinterest-rid-128bit: e6504d53bf856b8acf6b6fb9eeb039a2
age: 0
vary: accept-encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: must-revalidate, max-age=887
x-envoy-upstream-service-time: 2
accept-ranges: none
x-pinterest-rid: 1494616263272328
expires: Tue, 17 Sep 2024 06:16:25 GMT

GET
H/1.1 200
OK count.js Show response
macsecurityblog.disqus.com/ 1 KB
2 KB 160ms
28ms Script
application/javascript 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://macsecurityblog.disqus.com/count.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.22

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Tue, 17 Sep 2024 06:01:25 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=300; includeSubdomains
X-Amz-Cf-Pop: SFO53-P1
Age: 294
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 871
X-XSS-Protection: 1; mode=block
Last-Modified: Thu, 12 Sep 2024 22:00:42 GMT
Server: nginx
ETag: "66e3648a-367"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=300
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
X-Amz-Cf-Id: cWLDBMdeexwwP4APPZBbjSirWQ8jbQmHI9rKbws6W1KQwD9VikbCUA==

GET
H/1.1 200
OK embed.js Show response
macsecurityblog.disqus.com/ 80 KB
26 KB 287ms
155ms Script
application/javascript 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://macsecurityblog.disqus.com/embed.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.22

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

2a523c3e012f726e55cb93db7f763d95fae08384314f4be26d88a1acd984669d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Tue, 17 Sep 2024 06:01:25 GMT
content-encoding: gzip
Strict-Transport-Security: max-age=300; includeSubdomains
server: openresty
Age: 0
Vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
Cache-Control: private, max-age=60
x-service: router
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 26332

GET
H2 200 widgets.js Show response
platform.twitter.com/ 91 KB
27 KB 199ms
45ms Script
application/javascript 199.232.188.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:25 GMT
content-encoding: gzip
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length: 27597
x-served-by: cache-iad-kjyo7100044-IAD, cache-muc13924-MUC
last-modified: Mon, 11 Dec 2023 17:20:28 GMT
etag: "824beb891744db98ccbd3a456e59e0f7+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=1800
accept-ranges: bytes
tw-cdn: FT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
177 B 32ms
26ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A10.2.1&blog=72832157&post=101625&tz=-7&srv=www.intego.com&host=www.intego.com&ref=&fcp=1190&rand=0.13990828887786355
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 17 Sep 2024 06:01:25 GMT
cache-control: no-cache
server: nginx
alt-svc: h3=":443"; ma=86400
content-length: 50
content-type: image/gif

GET
H3 200 / Show response
graph.facebook.com/ 244 B
360 B 247ms
136ms Script
text/javascript 2a03:2880:f084:a:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/plugins/jetpack/_inc/build/sharedaddy/sharing.min.js?ver=10.2.1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:a:face:b00c:0:2 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

526bd05291418d001da24372446d76211e123bcac9c55b891a6e1a247eb930e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
date: Tue, 17 Sep 2024 06:01:25 GMT
www-authenticate: OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
x-fb-rev: 1016547595
alt-svc: h3=":443"; ma=86400
content-length: 244
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=40, rtx=0, c=23, mss=1232, tbw=5678, tp=10, tpl=0, uplat=97, ullat=0
pragma: no-cache
x-fb-debug: 6y8SjeQcWO9LEavXQp3QzmtYwfz+5ZtVPiW6JRurOEXU8VF17iJZCs/5nhHlCuDTHjRWR12TyldrPG+ohiA0uQ==
x-fb-trace-id: Ep/m/ori6Vw
vary: Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: ANNaa2EO31BgWvLzBpsmOEF
cache-control: no-store
facebook-api-version: v14.0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 pici.png
www.intego.com/mac-security-blog/wp-content/uploads/2021/05/ 35 KB
35 KB 71ms
70ms Image
image/webp 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2021/05/pici.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0590a5e32234930923f899ff7d662b436300c40ff463dba142b7984ad16c987f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:25 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=58478
content-disposition: inline; filename="pici.webp"
alt-svc: h3=":443"; ma=86400
content-length: 35876
cf-bgj: imgq:85,h2pri
last-modified: Mon, 24 May 2021 09:25:34 GMT
server: cloudflare
etag: "e46e-5c30ffddbf057"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1ad0f2d406b-LHR
expires: Tue, 01 Oct 2024 05:47:31 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
177 B 85ms
83ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.3635684404858299
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 17 Sep 2024 06:01:25 GMT
cache-control: no-cache
server: nginx
alt-svc: h3=":443"; ma=86400
content-length: 50
content-type: image/gif

POST
H3 204 rum Show response
www.intego.com/cdn-cgi/ 0
140 B 31ms
30ms XHR
text/plain 2606:4700::6812:16a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:16a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
content-type: application/json

Response headers

date: Tue, 17 Sep 2024 06:01:25 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://www.intego.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 8c46e1ad1f32406b-LHR

GET
H2 200 widget_iframe.2f70fb173b9000da126c79afe2098f02.html
platform.twitter.com/widgets/ Frame 2C27 0
0 416ms
257ms Document
text/html 199.232.188.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.intego.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: public, max-age=315360000
content-encoding: gzip
content-length: 105429
content-type: text/html; charset=utf-8
date: Tue, 17 Sep 2024 06:01:25 GMT
etag: "81267302efdfb3e4524a22631a8fc99e+gzip"
last-modified: Mon, 11 Dec 2023 17:19:49 GMT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
tw-cdn: FT
vary: Accept-Encoding
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
x-served-by: cache-iad-kjyo7100176-IAD, cache-muc13930-MUC

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 242 KB
86 KB 66ms
65ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-1060047950&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-9WJ8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

17019291a244bb9885ce48f802b76ae05911de2a5617eb001897647f01797cd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 87978
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 17 Sep 2024 06:01:25 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 360ms
215ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-9WJ8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 17 Sep 2024 04:02:04 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 7161
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Tue, 17 Sep 2024 06:02:04 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 49 KB
14 KB 353ms
210ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

60ed45fe20ede817f77c4e774e77fd9a9a4f4046c67456f1442eac2095918438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Tue, 17 Sep 2024 06:01:25 GMT
last-modified: Fri, 06 Sep 2024 21:17:16 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2F2221B325AC40748749C7796B4DC6F0 Ref B: LTSEDGE1919 Ref C: 2024-09-17T06:01:25Z
etag: "016326a20db1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 14305

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 225 KB
58 KB 150ms
41ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0055aa18da3581f4a468aaa7257d84f798e0fc070899c8008d9b321b76b98096

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 17 Sep 2024 06:01:25 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 58953
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=37, rtx=0, c=23, mss=1232, tbw=5676, tp=10, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: Penlvtu1MGmXLFywJiB0uwJbocSFnJJ80qWbV7Hmw4c/BcNM5VDTbUrf9d0AMkTHMEtR6clfsvblJxcJZ71dnw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 aquant.js Show response
secure.quantserve.com/ 23 KB
10 KB 417ms
57ms Script
application/javascript 2620:116:800d:21:ef75:8280:f209:5ba1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/aquant.js?a=p-NVNd7-g373ynZ
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:ef75:8280:f209:5ba1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 76c46df9a6ba94318fafe8023e3f52e28b1b9a1eaf16dcd4d7ce95ab6942859b

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:25 GMT
content-encoding: gzip
etag: "tIg8n6xaLBY4WwNLLw9OGA=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Tue, 24 Sep 2024 06:01:25 GMT

GET
H2 200 conversion.js Show response
s.yimg.jp/images/listing/tool/cv/ 6 KB
2 KB 1252ms
600ms Script
application/javascript 183.79.219.124
YAHOO-JP-AS-AP Ya...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.yimg.jp/images/listing/tool/cv/conversion.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-9WJ8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 183.79.219.124 , Japan, ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP),
Reverse DNS
Software: nghttpx /
Resource Hash: 9e3a9103c80346b1b39bea3de46f44a462b3f594fa45e7206252bc41d7e3e855

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Tue, 17 Sep 2024 05:59:31 GMT
content-encoding: gzip
last-modified: Tue, 25 Jan 2022 16:25:04 GMT
server: nghttpx
accept-ch: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch
age: 115
vary: Accept-Encoding
content-type: application/javascript
x-z-chihaya: r=1
x-ntap-sg-trace-id: a9ae1c4e6e92590e
cache-control: public, max-age=600
permissions-policy: ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform-version=*, ch-ua-arch=*
content-length: 2140

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 242 KB
86 KB 66ms
66ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1060047950

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-9WJ8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d5c4e7dbc256306cb15c74a72b7d0bdc1f6dcf6f3581f48454e2fdc230eb71f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 87968
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 17 Sep 2024 06:01:25 GMT

GET
H/1.1 200
OK recommendations.js Show response
macsecurityblog.disqus.com/ 64 KB
22 KB 123ms
122ms Script
application/javascript 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://macsecurityblog.disqus.com/recommendations.js

Requested by

Host: macsecurityblog.disqus.com
URL: https://macsecurityblog.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

7246cf722eaa684d8dee338a9c5115d859c2df4701b9e5318e4eab6c7ba1fb17

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Tue, 17 Sep 2024 06:01:25 GMT
content-encoding: gzip
Strict-Transport-Security: max-age=300; includeSubdomains
server: openresty
Age: 0
Vary: Accept-Encoding, Accept, Accept-Encoding, X-Forwarded-Proto, X-Disqus-Shortname, X-Disqus-Device, X-Disqus-Experiment, X-Disqus-Is-Private, X-Disqus-Development-Base
content-type: application/javascript; charset=utf-8
cache-control: stale-while-revalidate=60, public, stale-if-error=86400, max-age=60
x-service: router
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 21419

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1060047950/ 6 KB
2 KB 535ms
241ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1060047950/?random=1726552885662&cv=11&fst=1726552885662&bg=ffffff&guid=ON&async=1&gtm=45be4990z8564007za201zb564007&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&label=6cqzCOKomwIQzpi8-QM&hn=www.googleadservices.com&frm=0&tiba=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Security%20Blog&npa=0&pscdl=noapi&auid=288340183.1726552886&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-1060047950&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b5e80b20da0f474fa433cad30322d02fbcc03016d7bf3a403d1859c49054d80f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Sep 2024 06:01:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2436
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 1060047950
td.doubleclick.net/td/rul/ Frame 3799 0
0 514ms
273ms Document
text/html 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/1060047950?random=1726552885662&cv=11&fst=1726552885662&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4990z8564007za201zb564007&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&label=6cqzCOKomwIQzpi8-QM&hn=www.googleadservices.com&frm=0&tiba=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Security%20Blog&npa=0&pscdl=noapi&auid=288340183.1726552886&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-1060047950&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 17 Sep 2024 06:01:25 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK /
disqus.com/embed/comments/ Frame EE3D 0
0 584ms
294ms Document
text/html 151.101.128.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/embed/comments/?base=default&f=macsecurityblog&t_i=101625%20https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2F%3Fp%3D101625&t_u=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&t_e=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs&t_d=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs&t_t=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs&s_o=default

Requested by

Host: macsecurityblog.disqus.com
URL: https://macsecurityblog.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.128.134 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Age: 2
Cache-Control: stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 2971
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Content-Type: text/html; charset=utf-8
Cross-Origin-Resource-Policy: cross-origin
Date: Tue, 17 Sep 2024 06:01:26 GMT
ETag: W/"lounge:view:10310437447.5b26dd663183accb3ee3a883a3254b53.2"
Last-Modified: Thu, 05 Sep 2024 17:14:48 GMT
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Referrer-Policy: no-referrer-when-downgrade
Server: nginx
Strict-Transport-Security: max-age=300; includeSubdomains
Timing-Allow-Origin: *
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"

GET
H/1.1 200
OK /
disqus.com/recommendations/ Frame 26A6 0
0 476ms
119ms Document
text/html 151.101.128.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/recommendations/?base=default&f=macsecurityblog&t_i=101625%20https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2F%3Fp%3D101625&t_u=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&t_e=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs&t_d=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs&t_t=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs

Requested by

Host: macsecurityblog.disqus.com
URL: https://macsecurityblog.disqus.com/recommendations.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.128.134 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Age: 0
Cache-Control: stale-while-revalidate=30, no-cache, must-revalidate, stale-if-error=3600, public
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 2381
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Content-Type: text/html; charset=utf-8
Cross-Origin-Resource-Policy: cross-origin
Date: Tue, 17 Sep 2024 06:01:26 GMT
Last-Modified: Thu, 03 Nov 2022 16:35:53 GMT
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Server: nginx
Strict-Transport-Security: max-age=300; includeSubdomains
Timing-Allow-Origin: *
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"

GET
H2 200 4033358.js Show response
bat.bing.com/p/action/ 371 B
416 B 39ms
38ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/4033358.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

8a9c46f4371f29ded6f345238dd688515240c3da12b3a220f4f734e7066bb284

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
date: Tue, 17 Sep 2024 06:01:25 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0B756009B02A4806B2B3881129973068 Ref B: LTSEDGE1919 Ref C: 2024-09-17T06:01:25Z
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
cache-control: private,max-age=1800

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
220 B 54ms
53ms XHR
text/plain 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1728100666&t=pageview&_s=1&dl=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&ul=en-gb&de=UTF-8&dt=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Security%20Blog&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAiAABDAAAAC~&jid=490494309&gjid=410187270&cid=770738162.1726552886&tid=UA-1724183-7&_gid=1471402135.1726552886&_slc=1&gtm=45He4990n519WJ8v564007za200&cg3=&cd3=!!!!&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&z=1917705804

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

4ba8349bee5aa103d984f9ca66a1c4e268c7fba177b94909e3b5ba91895ead83

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 17 Sep 2024 06:01:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.intego.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
345 B 326ms
53ms XHR
text/plain 2a00:1450:400c:c1d::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-1724183-7&cid=770738162.1726552886&jid=490494309&gjid=410187270&_gid=1471402135.1726552886&_u=YGBAiAABDAAAAG~&z=1647790030

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c1d::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 17 Sep 2024 06:01:26 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.intego.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 731235797425639 Show response
connect.facebook.net/signals/config/ 72 KB
15 KB 243ms
243ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/731235797425639?v=2.9.167&r=stable&domain=www.intego.com&hme=da9a399065fb1c492026018b9e54864148adfb49d800f41752428fb7b59190f8&ex_m=69%2C118%2C104%2C108%2C60%2C4%2C97%2C68%2C16%2C94%2C86%2C50%2C53%2C168%2C171%2C183%2C179%2C180%2C182%2C29%2C98%2C52%2C75%2C181%2C163%2C166%2C176%2C177%2C184%2C127%2C40%2C34%2C139%2C15%2C49%2C190%2C189%2C129%2C18%2C39%2C1%2C42%2C64%2C65%2C66%2C70%2C90%2C17%2C14%2C93%2C89%2C88%2C105%2C51%2C107%2C38%2C106%2C30%2C91%2C26%2C164%2C167%2C136%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C56%2C61%2C63%2C73%2C99%2C27%2C74%2C9%2C8%2C78%2C47%2C21%2C101%2C100%2C102%2C95%2C10%2C20%2C3%2C19%2C83%2C55%2C81%2C33%2C72%2C0%2C92%2C32%2C80%2C85%2C46%2C45%2C84%2C37%2C5%2C87%2C79%2C43%2C35%2C82%2C2%2C36%2C62%2C41%2C103%2C44%2C77%2C67%2C109%2C59%2C58%2C31%2C96%2C57%2C54%2C48%2C76%2C71%2C24%2C110

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

45e46c34b4cea638b7563a944c2b94d90325bb0d6bced15a351c381bb0bef72e

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 17 Sep 2024 06:01:26 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=62, rtx=0, c=74, mss=1232, tbw=68332, tp=64, tpl=0, uplat=123, ullat=0
pragma: public
x-fb-debug: IB9nXANAXkGU3MdNnpNr+OoaHq10lW8R2cJI6G5D7hbtgbWpE0K995Z1x4m4KQWzpf6MpEfoEzffGmNgCUKoxw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 rules-p-NVNd7-g373ynZ.js Show response
rules.quantcount.com/ 1 KB
1 KB 471ms
95ms Script
application/javascript 2600:9000:223c:fc00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-NVNd7-g373ynZ.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/aquant.js?a=p-NVNd7-g373ynZ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:fc00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: dfc988a3bfd2d7c74069ed4414fb522a7f9b6536767f897ab15773772f517d17

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
via: 1.1 4a502b22092e94faddf9a5b056e273ae.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 967
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
last-modified: Thu, 13 Oct 2022 16:28:24 GMT
server: AmazonS3
etag: W/"4395cced20ab623d7e83cebf7caf109d"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
x-amz-cf-id: ewdLqoZkNRQNRqaV64e7WavL1C8gm91GLDpXGzzvBtoVtF8d468W9A==

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 296 KB
98 KB 247ms
246ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-QWFMBN7P7H&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

41dd6eb1b5151a26bb7472f72f4e8e76abc3db031d8505cb742c335d6f48d4ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:26 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 99922
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 17 Sep 2024 06:01:26 GMT

GET
H2 204 0
bat.bing.com/action/ 0
285 B 38ms
38ms Image
text/plain 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=4033358&Ver=2&mid=33466a92-a867-4845-a36c-bf41e0a92b4c&sid=463007e074ba11ef83ab8928d3809061&vid=4630334074ba11efa95c73018f61bc8e&vids=1&msclkid=N&pi=918639831&lg=en-GB&sw=1600&sh=1200&sc=24&tl=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Security%20Blog&p=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&r=&lt=1548&evt=pageLoad&sv=1&cdb=AQAQ&rn=374958

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 17 Sep 2024 06:01:25 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5D562B3940D14521BF9C9114A3411CDB Ref B: LTSEDGE1919 Ref C: 2024-09-17T06:01:26Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/1060047950/ 42 B
64 B 195ms
49ms Image
image/gif 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1060047950/?random=1726552885662&cv=11&fst=1726552800000&bg=ffffff&guid=ON&async=1&gtm=45be4990z8564007za201zb564007&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&label=6cqzCOKomwIQzpi8-QM&hn=www.googleadservices.com&frm=0&tiba=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Security%20Blog&npa=0&pscdl=noapi&auid=288340183.1726552886&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfA2zEplrrmMslJs3sChjnrUWroRfhNg&random=487979679&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Sep 2024 06:01:26 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.co.uk/pagead/1p-user-list/1060047950/ 42 B
64 B 171ms
57ms Image
image/gif 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.uk/pagead/1p-user-list/1060047950/?random=1726552885662&cv=11&fst=1726552800000&bg=ffffff&guid=ON&async=1&gtm=45be4990z8564007za201zb564007&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&label=6cqzCOKomwIQzpi8-QM&hn=www.googleadservices.com&frm=0&tiba=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Security%20Blog&npa=0&pscdl=noapi&auid=288340183.1726552886&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfA2zEplrrmMslJs3sChjnrUWroRfhNg&random=487979679&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Sep 2024 06:01:26 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
274 B 223ms
97ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=731235797425639&ev=ViewContent&dl=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&rl=&if=false&ts=1726552886237&sw=1600&sh=1200&v=2.9.167&r=stable&ec=1&o=4126&fbp=fb.1.1726552886234.331845414400486281&cs_est=true&est_source=757774251754991&ler=empty&cdl=API_unavailable&it=1726552885965&coo=false&es=automatic&tm=3&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=15, rtx=0, c=10, mss=1392, tbw=2800, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 17 Sep 2024 06:01:26 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
847 B 577ms
452ms Image
image/png 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=731235797425639&ev=ViewContent&dl=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&rl=&if=false&ts=1726552886237&sw=1600&sh=1200&v=2.9.167&r=stable&ec=1&o=4126&fbp=fb.1.1726552886234.331845414400486281&cs_est=true&est_source=757774251754991&ler=empty&cdl=API_unavailable&it=1726552885965&coo=false&es=automatic&tm=3&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-encoding: zstd
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
date: Tue, 17 Sep 2024 06:01:26 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7415488182093156460", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=21, rtx=0, c=10, mss=1392, tbw=6723, tp=-1, tpl=-1, uplat=230, ullat=1
pragma: no-cache
x-fb-debug: UKon71QqmipTvrEzTMfcZlp3AGuZnF6B1CdqTS8JXyfk5JmHCzzSANY9ipOacA0L4EIAQit+dmDrsCXKJDy9LQ==
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7415488182093156460"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/png
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: private, no-store, no-cache, must-revalidate
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
32 B 223ms
98ms Image
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=731235797425639&ev=PageView&dl=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&rl=&if=false&ts=1726552886238&sw=1600&sh=1200&v=2.9.167&r=stable&ec=0&o=4126&fbp=fb.1.1726552886234.331845414400486281&cs_est=true&ler=empty&cdl=API_unavailable&it=1726552885965&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=15, rtx=0, c=10, mss=1392, tbw=2800, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 17 Sep 2024 06:01:26 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 336ms
211ms Image
image/png 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=731235797425639&ev=PageView&dl=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&rl=&if=false&ts=1726552886238&sw=1600&sh=1200&v=2.9.167&r=stable&ec=0&o=4126&fbp=fb.1.1726552886234.331845414400486281&cs_est=true&ler=empty&cdl=API_unavailable&it=1726552885965&coo=false&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0x09080ad7e78acc20","source_keys":["1"]}],"aggregatable_values":{"1":10922},"filters":{"2":["24:3656702261062735","7830:3656702261062735","10853:3656702261062735","41:3656702261062735","8046:3656702261062735"]},"debug_reporting":true,"debug_key":"2070101690761036717"}
content-encoding: zstd
x-content-type-options: nosniff
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
strict-transport-security: max-age=15552000; preload
document-policy: force-load-at-top
date: Tue, 17 Sep 2024 06:01:26 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7415488181060397746", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=21, rtx=0, c=10, mss=1392, tbw=3150, tp=-1, tpl=-1, uplat=167, ullat=0
pragma: no-cache
x-fb-debug: 5NJqKNDma9VQJk+JsuK24rgA++GLPnzdQ6QqBaPr0S1ftJzC9eKcg6NtOM6bbedsjQTWQpnUbGWJkeqZoSFj1A==
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7415488181060397746"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/png
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: private, no-store, no-cache, must-revalidate
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 187ms
60ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-QWFMBN7P7H&gtm=45je4990v9117895345za200&_p=1726552885257&_gaz=1&gcd=13l3l3l3l2l1&npa=0&dma=0&tag_exp=0&ul=en-gb&sr=1600x1200&cid=770738162.1726552886&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=ABAI&_s=1&dl=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&dt=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Security%20Blog&sid=1726552886&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&ep.ua_dimension_3=!!!!&tfd=2707
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-QWFMBN7P7H&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Sep 2024 06:01:26 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.intego.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
56 B 39ms
38ms Ping
text/plain 2a00:1450:400c:c1d::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-QWFMBN7P7H&cid=770738162.1726552886&gtm=45je4990v9117895345za200&aip=1&dma=0&gcd=13l3l3l3l2l1&npa=0&frm=0&tag_exp=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-QWFMBN7P7H&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c1d::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Sep 2024 06:01:26 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.intego.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame 13F2 0
0 55ms
53ms Document
text/html 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-QWFMBN7P7H&gacid=770738162.1726552886&gtm=45je4990v9117895345za200&dma=0&gcd=13l3l3l3l2l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=0&z=1136016349

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-QWFMBN7P7H&cx=c&_slc=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 17 Sep 2024 06:01:26 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ga-audiences
www.google.co.uk/ads/ 42 B
63 B 51ms
51ms Image
image/gif 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.uk/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-QWFMBN7P7H&cid=770738162.1726552886&gtm=45je4990v9117895345za200&aip=1&dma=0&gcd=13l3l3l3l2l1&npa=0&frm=0&tag_exp=0&tag_exp=0&z=924502064

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Sep 2024 06:01:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel;r=1429414979;labels=_fp.event.Default;rf=0;a=p-NVNd7-g373ynZ;url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F;uht=2;f...
pixel-ssn.quantserve.com/
Redirect Chain

https://pixel.quantserve.com/pixel;r=1429414979;labels=_fp.event.Default;rf=0;a=p-NVNd7-g373ynZ;url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backd...
https://pixel-ssn.quantserve.com/pixel;r=1429414979;labels=_fp.event.Default;rf=0;a=p-NVNd7-g373ynZ;url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-b...

35 B
356 B

359ms
61ms

Image
image/gif

91.228.74.200
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel-ssn.quantserve.com/pixel;r=1429414979;labels=_fp.event.Default;rf=0;a=p-NVNd7-g373ynZ;url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F;uht=2;fpan=1;fpa=P0-1879706432-1726552885987;pbc=;ns=0;ce=1;qjs=1;qv=15f23c9a-20240703164903;cm=;gdpr=0;ref=;d=intego.com;dst=1;et=1726552886465;tzo=-60;ogl=locale.en_US%2Ctype.article%2Ctitle.New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Secur%2Cdescription.HZ%20RAT%20is%20brand-new%20macOS%20malware%20that%20gives%20remote%20attackers%20complete%20control%20o%2Curl.https%3A%2F%2Fwww%252Eintego%252Ecom%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attacker%2Csite_name.The%20Mac%20Security%20Blog%2Cimage.https%3A%2F%2Fwww%252Eintego%252Ecom%2Fmac-security-blog%2Fwp-content%2Fuploads%2F2024%2F09%2Fevil-rat-mac%2Cimage%3Awidth.400%2Cimage%3Aheight.260;ses=7c0a5488-94fc-4799-8860-83858682b20a;mdl=;dip=76870452-b2a6-4843-b040-b785704562b3

Protocol

Server

91.228.74.200 , United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Sep 2024 06:01:26 GMT
attribution-reporting-register-trigger: {"event_trigger_data":[{"filters":[{"label":["XIs9cXuHhiR3L4rY6hRZdQ=="],"pcode":["p-NVNd7-g373ynZ"]}],"trigger_data":"1"}]}
strict-transport-security: max-age=86400
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Sep 2024 06:01:26 GMT
attribution-reporting-register-trigger: {"event_trigger_data":[{"filters":[{"label":["XIs9cXuHhiR3L4rY6hRZdQ=="],"pcode":["p-NVNd7-g373ynZ"]}],"trigger_data":"1"}]}
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://pixel-ssn.quantserve.com/pixel;r=1429414979;labels=_fp.event.Default;rf=0;a=p-NVNd7-g373ynZ;url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F;uht=2;fpan=1;fpa=P0-1879706432-1726552885987;pbc=;ns=0;ce=1;qjs=1;qv=15f23c9a-20240703164903;cm=;gdpr=0;ref=;d=intego.com;dst=1;et=1726552886465;tzo=-60;ogl=locale.en_US%2Ctype.article%2Ctitle.New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Secur%2Cdescription.HZ%20RAT%20is%20brand-new%20macOS%20malware%20that%20gives%20remote%20attackers%20complete%20control%20o%2Curl.https%3A%2F%2Fwww%252Eintego%252Ecom%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attacker%2Csite_name.The%20Mac%20Security%20Blog%2Cimage.https%3A%2F%2Fwww%252Eintego%252Ecom%2Fmac-security-blog%2Fwp-content%2Fuploads%2F2024%2F09%2Fevil-rat-mac%2Cimage%3Awidth.400%2Cimage%3Aheight.260;ses=7c0a5488-94fc-4799-8860-83858682b20a;mdl=;dip=76870452-b2a6-4843-b040-b785704562b3
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET conversion_async.js
b91.yahoo.co.jp/pagead/ 0
0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1060047950/ 6 KB
2 KB 67ms
66ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1060047950/?random=1726552886844&cv=11&fst=1726552886844&bg=ffffff&guid=ON&async=1&gtm=45be4990za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&hn=www.googleadservices.com&frm=0&tiba=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Security%20Blog&npa=0&pscdl=noapi&auid=288340183.1726552886&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1060047950

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0f2e347c62e54a42a07f6e8d4817755beff3a59595de9d11a06a73c6312cb746

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Sep 2024 06:01:26 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2411
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 1060047950
td.doubleclick.net/td/rul/ Frame 21FD 0
0 70ms
69ms Document
text/html 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/1060047950?random=1726552886844&cv=11&fst=1726552886844&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4990za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&hn=www.googleadservices.com&frm=0&tiba=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Security%20Blog&npa=0&pscdl=noapi&auid=288340183.1726552886&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1060047950

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 17 Sep 2024 06:01:26 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 19 KB
7 KB 199ms
52ms Script
application/javascript 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

aebe8df81ee2ba5bc51e3abc322910ee5122a0ac06edfbcf7a04e1659d17dc9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

ats-carp-promotion: 1, 1
date: Tue, 17 Sep 2024 05:06:58 GMT
x-amz-version-id: JRuD6BVFDpXh1T7iUrCVWNpcX_ACBwVG
content-encoding: gzip
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-amz-request-id: WGX4E8A41J9XMSE8
age: 3270
x-amz-server-side-encryption: AES256
content-length: 6826
x-amz-id-2: 4R+nOkb+H6goPl3seenPlbjg+bAwNSnN48nT6vyQJra3pTEc9D58lDCZEK5GoKs2nEQmj16abJUmAoZ7HRHRt3aolzzi2DOE
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Fri, 03 Oct 2025 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Wed, 28 Aug 2024 12:33:10 GMT
server: ATS
etag: "bc033c3a83e1880e480086bf11ac0b0a-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=3600
accept-ranges: bytes

GET
H3 200 /
www.google.com/pagead/1p-user-list/1060047950/ 42 B
64 B 51ms
50ms Image
image/gif 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1060047950/?random=1726552886844&cv=11&fst=1726552800000&bg=ffffff&guid=ON&async=1&gtm=45be4990za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&hn=www.googleadservices.com&frm=0&tiba=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Security%20Blog&npa=0&pscdl=noapi&auid=288340183.1726552886&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnfGPgsNyeJ72JDifZ9EFZeMDN24VCJUim1XiaBNnCBpJ7tWmk8&random=3355701183&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Sep 2024 06:01:26 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.co.uk/pagead/1p-user-list/1060047950/ 42 B
64 B 50ms
49ms Image
image/gif 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.uk/pagead/1p-user-list/1060047950/?random=1726552886844&cv=11&fst=1726552800000&bg=ffffff&guid=ON&async=1&gtm=45be4990za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&hn=www.googleadservices.com&frm=0&tiba=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Security%20Blog&npa=0&pscdl=noapi&auid=288340183.1726552886&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnfGPgsNyeJ72JDifZ9EFZeMDN24VCJUim1XiaBNnCBpJ7tWmk8&random=3355701183&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Sep 2024 06:01:26 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 10013026.json Show response
s.yimg.com/wi/config/ 2 B
469 B 231ms
93ms XHR
application/json 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10013026.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Tue, 17 Sep 2024 05:50:33 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-amz-request-id: WJTVR6PBZRQD1NZ8
age: 654
content-length: 2
x-amz-id-2: WkGu3lmXSxiW0qrHZ5VCqLXHh4tMNedYz8FwLnIpgUJNvoZEXdyYokbhwUS0Wy+wVNhEZsXmQyM=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
cache-control: public,max-age=3600

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
508 B 244ms
91ms Image
image/gif 54.171.122.26
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Tue%2C%2017%20Sep%202024%2006%3A01%3A27%20GMT&n=-1d&b=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Security%20Blog&.yp=10013026&f=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&enc=UTF-8&yv=1.16.5&tagmgr=gtm

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.171.122.26 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-171-122-26.eu-west-1.compute.amazonaws.com

Software

ATS/9.1.10.134 /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Sep 2024 06:01:27 GMT
via: http/1.1 traffic_server (ApacheTrafficServer/9.1.10.134)
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS/9.1.10.134
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Tue, 17 Sep 2024 06:01:27 GMT

GET
H/1.1 200
OK stat.gif
referrer.disqus.com/juggler/ 43 B
339 B 201ms
104ms Image
image/gif 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://referrer.disqus.com/juggler/stat.gif?event=failed_recommendations.server.undefined

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Tue, 17 Sep 2024 06:01:27 GMT
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
content-type: image/gif
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 43
x-xss-protection: 1; mode=block

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.linkedin.com
URL: https://www.linkedin.com/countserv/count/share?url=https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/&callback=jQuery36003097451368257851_1726552885233&_=1726552885234

Domain: b91.yahoo.co.jp
URL: https://b91.yahoo.co.jp/pagead/conversion_async.js

Verdicts & Comments Add Verdict or Comment

92 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.intego.com/	1970-01-20 23:35:54	Name: __cf_bm Value: Uhio8cFFkkic.9xWQ2FD8PuLJiT0FFx8BHo.6nqsyo4-1726552884-1.0.1.1-DQ3A_tMUHEg8qXigzH3j7TYeCMB5j26KeVagqw_cpNPKxqJhDmxzXmQA4XXQc0J5kjOrrHkbIAu795QwjEMcNw
.linkedin.com/	1970-01-21 08:21:28	Name: bcookie Value: "v=2&0209dba5-674a-4f53-8a08-5e4500a9cae7"
.www.linkedin.com/	1970-01-21 08:21:28	Name: bscookie Value: "v=1&202409170601252f86adb3-7175-4838-8e4b-e0f0876333d4AQErHel2D-rcGj_Rze4pqqCtPZcXjBwf"
.linkedin.com/	1970-01-21 03:55:04	Name: li_gc Value: MTswOzE3MjY1NTI4ODU7MjswMjFk04fQ9ZpQ3G7O+ktSTS2OAEcDfOOtDPF0109tguNfxg==
.linkedin.com/	1970-01-20 23:37:19	Name: lidc Value: "b=VGST05:s=V:r=V:a=V:p=V:g=3193:u=1:x=1:i=1726552885:t=1726639285:v=2:sig=AQHiMSpCrdh89uApbIed0t1X4CeZABP9"
.intego.com/	1970-01-21 01:45:28	Name: _gcl_au Value: 1.1.288340183.1726552886
.intego.com/	1970-01-21 09:11:52	Name: _ga Value: GA1.2.770738162.1726552886
.intego.com/	1970-01-20 23:37:19	Name: _gid Value: GA1.2.1471402135.1726552886
.intego.com/	1970-01-20 23:35:52	Name: _dc_gtm_UA-1724183-7 Value: 1
.intego.com/	1970-01-20 23:37:19	Name: _uetsid Value: 463007e074ba11ef83ab8928d3809061
.intego.com/	1970-01-21 08:57:28	Name: _uetvid Value: 4630334074ba11efa95c73018f61bc8e
.intego.com/	1970-01-21 01:45:28	Name: _fbp Value: fb.1.1726552886234.331845414400486281
.bing.com/	1970-01-21 08:57:28	Name: MUID Value: 2C55915475EE604D219D85A974256164
.intego.com/	1970-01-21 09:11:52	Name: _ga_QWFMBN7P7H Value: GS1.2.1726552886.1.0.1726552886.60.0.0
.doubleclick.net/	1970-01-21 08:57:28	Name: IDE Value: AHWqTUkIVnGFcLDvCQrABdWdDNseRV-eTk8OWpTtJQqjHQQMrjOGleHyaIjRqGGw
.quantserve.com/	1970-01-21 09:06:07	Name: mc Value: 66e91b36-7b169-da923-0da2a
.intego.com/	1970-01-21 09:00:21	Name: __qca Value: P0-1879706432-1726552885987
disqus.com/	1970-01-20 23:35:54	Name: __jid Value: 61rhpknk1vaau
.disqus.com/	1970-01-21 08:21:28	Name: disqus_unique Value: 61rhq0g2jun6uk

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://graph.facebook.com/?id=https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/ Message: Failed to load resource: the server responded with a status of 400 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

b91.yahoo.co.jp
bat.bing.com
connect.facebook.net
disqus.com
embed.podcasts.apple.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
graph.facebook.com
i0.wp.com
i2.wp.com
macsecurityblog.disqus.com
netdna.bootstrapcdn.com
pixel-ssn.quantserve.com
pixel.quantserve.com
pixel.wp.com
platform.twitter.com
referrer.disqus.com
region1.analytics.google.com
rules.quantcount.com
s.yimg.com
s.yimg.jp
s7.addthis.com
secure.quantserve.com
sp.analytics.yahoo.com
static.cloudflareinsights.com
stats.g.doubleclick.net
stats.wp.com
td.doubleclick.net
widgets.pinterest.com
www.facebook.com
www.google-analytics.com
www.google.co.uk
www.google.com
www.googletagmanager.com
www.intego.com
www.linkedin.com
b91.yahoo.co.jp
www.linkedin.com
151.101.128.134
151.101.192.84
183.79.219.124
192.0.76.3
192.0.77.2
199.232.188.157
199.232.192.134
2.19.225.248
2001:4860:4802:34::36
2600:9000:223c:fc00:6:44e3:f8c0:93a1
2606:4700::6810:5049
2606:4700::6812:16a
2606:4700::6812:bcf
2620:116:800d:21:ef75:8280:f209:5ba1
2620:1ec:33:1::10
2a00:1288:80:807::1
2a00:1450:4001:80f::2004
2a00:1450:4001:811::2003
2a00:1450:4001:812::2002
2a00:1450:4001:81c::2002
2a00:1450:4001:81d::2008
2a00:1450:4001:82b::2003
2a00:1450:4001:830::200a
2a00:1450:4001:831::200e
2a00:1450:400c:c1d::9c
2a02:26f0:7100::213:c6d3
2a03:2880:f084:a:face:b00c:0:2
2a03:2880:f084:d:face:b00c:0:3
2a03:2880:f177:83:face:b00c:0:25de
54.171.122.26
91.228.74.200
0055aa18da3581f4a468aaa7257d84f798e0fc070899c8008d9b321b76b98096
0140ed5069f22e4aa8bb1a1fc615c39fc55d7d64e94be541615f1c5a30ae479b
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
04f5e859d2634d401e0b1e6f9a8d3abab7a5d10919e4a3aee96b7d5b90c25aec
0590a5e32234930923f899ff7d662b436300c40ff463dba142b7984ad16c987f
0e3faa302181b852e63034b619d928577e5e641d8502b630dd654cc6f0aa18ce
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
0f2e347c62e54a42a07f6e8d4817755beff3a59595de9d11a06a73c6312cb746
114773206c8b1ef17f1865f1fd0acb5ee36aa4f666718144698063fd295a0f65
124d5d7d1a1e13e129ad8ffbba218f6fd857f706d9af89d05d2686a0627ce127
142bb04454d6124c28f12d43249615ae8903c9742ea86c024ef0602f4dd1446e
143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103
17019291a244bb9885ce48f802b76ae05911de2a5617eb001897647f01797cd1
1711944c7b1540085ff5f7ee6cfa0e2fb504383825d4739ec799b4fd0dd69e7d
173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1
17aebab8504111847bb14d190557397752564704ba02e65f98c5fde9995fc834
25aa0b7b8ad904efa464dc2b11da0975d77ef2ba0eb747b06b72c738b95e581d
25b786ec50525130cddd67183bc696608e1fc88651fe5d1d953667e9f4643c4d
25ea6c91f8fbcbd412919dbb47da3e432622997eb37a3139fad5d21d59135962
262acb3ed20ff4aabfd582e2a85508a13f81d5b19689d061c5a9a6465613bdf9
266fc6c7a849c593382767fc93937cd9fecf56a5c7abac6b938153f001a2359a
29c6beffd42fb25d6fe9ba5dd7c5a0262c9fab9e113de7c624e62fd3ed8ed41e
2a523c3e012f726e55cb93db7f763d95fae08384314f4be26d88a1acd984669d
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
364c1179390530ea06c6636e2f314aa1091d460c4c6e369c6689a0fe31672054
39511dff8f9d64434df213852f4f6a8964847c8e086da423e336b10ae422b678
3b302bf527209ab634a379dc27b9a22838e88001e24df759794f13f2810725e6
3fb4cab423b2441335fc682b79687d8eb806aceb384c937c9b28534580593fd4
41dd6eb1b5151a26bb7472f72f4e8e76abc3db031d8505cb742c335d6f48d4ce
42b34f0823b708cc37e194c980748a6cf9de5964e659c4c44d861dd02877fa50
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
45e46c34b4cea638b7563a944c2b94d90325bb0d6bced15a351c381bb0bef72e
4ba8349bee5aa103d984f9ca66a1c4e268c7fba177b94909e3b5ba91895ead83
4d3c6be580921c6b730a51242bbcedd60998424bb68a659b82a94b8839e63b92
4e58b78b5844a988d67532b4683a6e8b3235b3d56d319727e65f460805bbdec4
50a82e0e3e97292e27f203cea4c71f3acaff073c1cfb1dc8cd63999efc9de72e
526bd05291418d001da24372446d76211e123bcac9c55b891a6e1a247eb930e6
5badd609a51ede5bab5b89534fc3011a4dd1ab487cc7081d7cf38479bcbab855
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5e7d52bf5f53348ca036d8381f04bb01c93b3110ccac87ca3cb75fd1ce0a92c6
60631ed8f1dfa6713ff9e30fec41786aadc477c0cac5a75dca66b5a49f76b901
60ed45fe20ede817f77c4e774e77fd9a9a4f4046c67456f1442eac2095918438
62d2cc93ab8f52afb7379b9fabdc6f383f7700367cda04191ad1a8158c449c23
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7246cf722eaa684d8dee338a9c5115d859c2df4701b9e5318e4eab6c7ba1fb17
7587369160233b751c90ccc2043b7fdfd7eb1f0d9aa610371b43f4b3419fa83f
76c46df9a6ba94318fafe8023e3f52e28b1b9a1eaf16dcd4d7ce95ab6942859b
7963f87cb07f8a42a168d9cdcf2ed0cd45583291c011849a322a29002d38957f
7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762
80ee2d8ce5d2a3f78fc3b8eaa67bc266645c58b96d8a804556f1e6cb8737d0cf
82f1278f66b192a223e306d884f8db595ef3b6d829cc1544807b9bf40019403e
83212a7016848fb3c92281449aeb751aaaac914aa50a90f1b35998c8f2b19cdd
85c1eb2c2a173feceba14abe8344fe9c7cb12aa1353f083f28a62f1a366763b9
86a9de4e1dd6d002b1f6adb84200766b15f0fac31f6b5b49907b6f71af061c11
884a2330198f498e36d9e77bb5c7f4971b3d70c4411cf306a3afca8bb50bb94d
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
8a9c46f4371f29ded6f345238dd688515240c3da12b3a220f4f734e7066bb284
8b0e8742416cb22d33029e1b4799431b847420b75c58f9eff600a2b15faa6e4a
8ecf7fe958f132008eb2eaeda1a079451a62372838a6c18d9e1353f64e48172a
903adc82f54bd61a22c1672000865fc19334735ba0ad395b361f67ccc2bdfd33
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
93b94b74b73c37bcb3e6d8cada57b5ce45d7bd3fe5e3b2b6194a702d1353e1a0
94562cfaffaf86145e9e271e11e2044a951dcf791bdf5769c3d58ba9acc44fdc
9e3a9103c80346b1b39bea3de46f44a462b3f594fa45e7206252bc41d7e3e855
9eeea020cc6ec6c8b66b20c48a9b69a5f14b8097bdb91c5420998eb842bcbae0
9f453faccde456fd8b4f8abdda945eaea20b7fdebbff4fdb3ae03e7f75622972
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a2d30057d0a8007fb75fb8a6e4f82f59d3858d29ea176db9c73f665209e86123
a48e3091c3e26309f1329bb7ee2812cf158deb93cd80fe6439e53e8d57e58d3d
a4f9c1995de9f92f05f1a5cd0c4987e359e1aa41613bb6a33f9c82837b29e6d8
a5f5f25721168edeb2b63229c2ab58e5d7f987ee5e8aced298e7445111badf09
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
aaffceab986a8d791cfef18d2d1e28fe2dcaf40a8bdfaf4fd393b1a91c6f072b
ad480458e8c9c476d4bed65c1df11a68284c9244342d977064bf4a0efd9e3ff5
aebe8df81ee2ba5bc51e3abc322910ee5122a0ac06edfbcf7a04e1659d17dc9c
b385fd0614f2927f0e7fdc03ccdb2428e3a93de0c7fe467149b34213cc32c0f6
b5e80b20da0f474fa433cad30322d02fbcc03016d7bf3a403d1859c49054d80f
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
b859cc611126401cdc38d803ac7c5967ee5da1a626e00318700ea88df55da1b9
b958e0f47861dde13a175cc69494bdb54f08e2b5e78cecf6abd16470d2085257
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c3362186a709ce7cffcc17f7cbd317bddb60bd6409cc7b3d8c9f364f03152f6f
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d077683ec63c7d44f473554e688628da6cfdf84c0f223b6be00f2476600433a5
d2dcaca89ae344f9ba12d903385c7c7096fe869e8f12605e81d9b88078bef18f
d5c4e7dbc256306cb15c74a72b7d0bdc1f6dcf6f3581f48454e2fdc230eb71f8
d8acb590859de744b30290b81039414fcc1f0ceb539cf8d29f8f8a0438cc935c
dd71e7bfa741c12ffde65deffbc1108ee85dfd3dfd200fb99c684c877fb364c4
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
dfc988a3bfd2d7c74069ed4414fb522a7f9b6536767f897ab15773772f517d17
e2bd3aa46a3827b06b65ff2175efd1536c4969671064c1d2eaccdd61fbe6be97
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e578fb9d0c0b302d35e555500d77181721e76faff484586681b7d08aea225bd0
e6dac340609ed8fff29c34106ccfd90516bd4258e9396a061cf143fdc3cab7db
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1193951467f0698533ba8fd3e78c9cc9e8852b1f5e2ea2a54f05b46ddc8b275
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f475c34186022ba531ebc8bba97fc10df7e4c3ea854f314a18ab0644c851620d
f538d5803d00836b5f946264abb64976a6416ab4cc16f8f83455a025a08ad014
f9b05fa232d19f1752ceaea7eec0110daa8d4401caa7d415fb4e08a3db60df3f
ffa8b5c0d78def1b71617c0ae00e01b295bc29e2e227ba0dc84469a9ba39259c

www.intego.com Open in urlscan Pro 2606:4700::6812:16a Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

118 Requests

97 %HTTPS

68 %IPv6

26 Domains

37 Subdomains

32 IPs

6 Countries

1253 kBTransfer

3544 kBSize

19 Cookies

31 Outgoing links

Redirected requests

118 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.intego.com Open in urlscan Pro
2606:4700::6812:16a Public Scan

Screenshot
Live screenshot

Full Image

118
Requests

97 %
HTTPS

68 %
IPv6

26
Domains

37
Subdomains

32
IPs

6
Countries

1253 kB
Transfer

3544 kB
Size

19
Cookies

118 HTTP transactions
6 data transactions