urlscan.io logo urlscan.io
SecurityTrails logo

www.cyber.nj.gov Open in urlscan Pro
45.60.124.188  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Submission: On December 14 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 19 IPs in 4 countries across 17 domains to perform 55 HTTP transactions. The main IP is 45.60.124.188, located in United States and belongs to INCAPSULA, US. The main domain is www.cyber.nj.gov.
TLS certificate: Issued by GlobalSign CloudSSL CA - SHA256 - G3 on November 10th 2020. Valid for: a year.
This is the only time www.cyber.nj.gov was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

17    45.60.124.188 (United States)

ASN19551 (INCAPSULA, US)
www.cyber.nj.gov
2    2a00:1450:4001:801::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
4    2001:4de0:ac19::1:b:1b (Netherlands)

ASN20446 (HIGHWINDS3, US)
stackpath.bootstrapcdn.com
1    2a00:1450:4001:820::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
8    2600:9000:206f:9c00:17:108e:3bc0:93a1 (United States)

ASN16509 (AMAZON-02, US)
cdn.buttercms.com
3    2a04:4e42:1b::621 (Ascension Island)

ASN54113 (FASTLY, US)
cdn.polyfill.io
cdn.jsdelivr.net
1    2001:4de0:ac19::1:b:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)
code.jquery.com
1    2606:4700::6812:e234 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.onesignal.com
3    2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    2a00:1450:4001:81a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
6    104.75.88.112 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-75-88-112.deploy.static.akamaitechnologies.com
s7.addthis.com
v1.addthisedge.com
m.addthis.com
1    2a00:1450:4001:820::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    65.9.68.69 (Seattle, United States)

ASN16509 (AMAZON-02, US)
app.artibot.ai
1    2.18.235.40 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com
z.moatads.com
1    34.204.38.77 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-204-38-77.compute-1.amazonaws.com
api.artibot.ai
2    2606:4700:3032::6812:3770 (United States)

ASN13335 (CLOUDFLARENET, US)
prod.artibotcdn.com
1    2600:9000:20c3:400:a:e02a:3080:93a1 (United States)

ASN16509 (AMAZON-02, US)
api-cdn.prod-aws.artibot.ai
1    52.216.225.83 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com
s3.amazonaws.com
Domain Requested by
17 www.cyber.nj.gov 1 redirects www.cyber.nj.gov
8 cdn.buttercms.com www.cyber.nj.gov
4 stackpath.bootstrapcdn.com www.cyber.nj.gov
3 s7.addthis.com www.cyber.nj.gov
s7.addthis.com
3 fonts.gstatic.com fonts.googleapis.com
2 prod.artibotcdn.com app.artibot.ai
2 m.addthis.com s7.addthis.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 cdn.polyfill.io www.cyber.nj.gov
2 fonts.googleapis.com www.cyber.nj.gov
1 s3.amazonaws.com
1 api-cdn.prod-aws.artibot.ai prod.artibotcdn.com
1 v1.addthisedge.com s7.addthis.com
1 api.artibot.ai app.artibot.ai
1 z.moatads.com s7.addthis.com
1 app.artibot.ai www.cyber.nj.gov
1 cdn.onesignal.com www.cyber.nj.gov
1 cdn.jsdelivr.net www.cyber.nj.gov
1 code.jquery.com www.cyber.nj.gov
1 www.googletagmanager.com www.cyber.nj.gov
55 20
Subject Issuer Validity Valid
incapsula.com
GlobalSign CloudSSL CA - SHA256 - G3		 2020-11-10 -
2021-10-28		 a year crt.sh
upload.video.google.com
GTS CA 1O1		 2020-11-10 -
2021-02-02		 3 months crt.sh
*.bootstrapcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2020-09-22 -
2021-10-12		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-11-10 -
2021-02-02		 3 months crt.sh
*.buttercms.com
Sectigo RSA Domain Validation Secure Server CA		 2020-01-08 -
2022-02-06		 2 years crt.sh
f3.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2020-10-26 -
2021-04-17		 6 months crt.sh
jquery.org
Sectigo RSA Domain Validation Secure Server CA		 2020-10-06 -
2021-10-16		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-08-04 -
2021-08-04		 a year crt.sh
*.gstatic.com
GTS CA 1O1		 2020-11-10 -
2021-02-02		 3 months crt.sh
odc-prod-01.oracle.com
DigiCert Secure Site ECC CA-1		 2020-07-22 -
2021-10-13		 a year crt.sh
*.artibot.ai
Amazon		 2020-06-17 -
2021-07-17		 a year crt.sh
moatads.com
DigiCert SHA2 Secure Server CA		 2020-01-17 -
2021-03-17		 a year crt.sh
artibotcdn.com
Cloudflare Inc ECC CA-3		 2020-06-15 -
2021-06-15		 a year crt.sh
s3.amazonaws.com
DigiCert Baltimore CA-2 G2		 2020-08-04 -
2021-08-09		 a year crt.sh

This page contains 3 frames:

Primary Page: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Frame ID: B4F2713C280A309E8EDE36844DCA2218
Requests: 54 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 016658667FF0BE552D7C455B15D65F4E
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: CB50878249A7EC911A501323E7C685F3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer HTTP 301
    https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^Netlify/i

Page Statistics

55
Requests

98 %
HTTPS

67 %
IPv6

17
Domains

20
Subdomains

19
IPs

4
Countries

939 kB
Transfer

2327 kB
Size

6
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer HTTP 301
    https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

55 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Redirect Chain
  • https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer
  • https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
68 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Netlify /
Resource Hash
1dc1b741a3ae394ec70bf6a060c7e275212e6b6f1b1b0b5fbbff486d693ff586
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.cyber.nj.gov
:scheme
https
:path
/threat-center/threat-profiles/macos-malware-variants/shlayer/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
visid_incap_1613844=SdKzLNKXREqlCSQZEPvGDJ7h118AAAAAQUIPAAAAAAAlh7MShEwX4xKz1mtqMFq+; nlbi_1613844=WQTgEKnXoDN6jO2l3cr+KQAAAAAFvbm5htAi8vwyyDlap48f; incap_ses_1095_1613844=o0nseqfprkMOt0SYFDkyD5/h118AAAAAJpRJAXqVyI4ov8RVTdjzkw==
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cache-control
public, max-age=0, must-revalidate
content-type
text/html; charset=UTF-8
date
Mon, 14 Dec 2020 22:05:20 GMT
etag
"7e37c8c442443bcca2870a3b844df9e1-ssl-df"
link
</webpack-runtime-f2086d186e26293dbd9c.js>; rel=preload; as=script, </framework-72d77a3dc9c81291ed98.js>; rel=preload; as=script, </app-8189e10c6c69d0fdd643.js>; rel=preload; as=script, </styles-89fd2ae28bdf06750a71.js>; rel=preload; as=script, </b637e9a5-645fb342d749e2adc83d.js>; rel=preload; as=script, </332e21127b1b48b057feac7ec4976154d43ddaf1-f0e2809079e80c8d8ae5.js>; rel=preload; as=script, </component---src-templates-markdownpage-js-f2c3881157fd61a3d36a.js>; rel=preload; as=script, </page-data/app-data.json>; rel=preload; as=fetch; crossorigin, </page-data/threat-center/threat-profiles/macos-malware-variants/shlayer/page-data.json>; rel=preload; as=fetch; crossorigin
referrer-policy
same-origin
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
content-encoding
gzip
age
1
server
Netlify
vary
Accept-Encoding
x-nf-request-id
2ea08e07-1b23-4eda-a5c9-adf41e4a5a91-82069721
x-cdn
Incapsula
x-iinfo
3-5485834-5485835 NNNN CT(16 35 0) RT(1607983519510 0) q(0 0 0 -1) r(0 3) U12

Redirect headers

cache-control
public, max-age=0, must-revalidate
content-type
text/html; charset=UTF-8
date
Mon, 14 Dec 2020 22:05:19 GMT
etag
"7e37c8c442443bcca2870a3b844df9e1-ssl-df"
link
</webpack-runtime-f2086d186e26293dbd9c.js>; rel=preload; as=script, </framework-72d77a3dc9c81291ed98.js>; rel=preload; as=script, </app-8189e10c6c69d0fdd643.js>; rel=preload; as=script, </styles-89fd2ae28bdf06750a71.js>; rel=preload; as=script, </b637e9a5-645fb342d749e2adc83d.js>; rel=preload; as=script, </332e21127b1b48b057feac7ec4976154d43ddaf1-f0e2809079e80c8d8ae5.js>; rel=preload; as=script, </component---src-templates-markdownpage-js-f2c3881157fd61a3d36a.js>; rel=preload; as=script, </page-data/app-data.json>; rel=preload; as=fetch; crossorigin, </page-data/threat-center/threat-profiles/macos-malware-variants/shlayer/page-data.json>; rel=preload; as=fetch; crossorigin
referrer-policy
same-origin
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
age
0
server
Netlify
location
/threat-center/threat-profiles/macos-malware-variants/shlayer/
x-nf-request-id
2ea08e07-1b23-4eda-a5c9-adf41e4a5a91-82069597
set-cookie
visid_incap_1613844=SdKzLNKXREqlCSQZEPvGDJ7h118AAAAAQUIPAAAAAAAlh7MShEwX4xKz1mtqMFq+; expires=Tue, 14 Dec 2021 08:10:02 GMT; HttpOnly; path=/; Domain=.cyber.nj.gov nlbi_1613844=WQTgEKnXoDN6jO2l3cr+KQAAAAAFvbm5htAi8vwyyDlap48f; path=/; Domain=.cyber.nj.gov incap_ses_1095_1613844=o0nseqfprkMOt0SYFDkyD5/h118AAAAAJpRJAXqVyI4ov8RVTdjzkw==; path=/; Domain=.cyber.nj.gov
x-cdn
Incapsula
x-iinfo
3-5485818-5485819 NNNN CT(16 141 0) RT(1607983518939 0) q(0 0 1 0) r(2 5) U11
webpack-runtime-f2086d186e26293dbd9c.js
www.cyber.nj.gov/ 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/webpack-runtime-f2086d186e26293dbd9c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Netlify /
Resource Hash
63122f0a5a069e952e1d4657ffed2854cf753992e776a4a8181769962da00448
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id
2ea08e07-1b23-4eda-a5c9-adf41e4a5a91-82069814
date
Mon, 14 Dec 2020 22:05:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cdn
Incapsula
age
0
x-iinfo
3-5485838-5465230 2NNN RT(1607983519860 0) q(0 0 0 -1) r(3 3) U18
strict-transport-security
max-age=31536000
x-xss-protection
1; mode=block
referrer-policy
same-origin
server
Netlify
x-frame-options
SAMEORIGIN
etag
"dc6f7fd0c661ceb01373a7ceef49056f-ssl-df"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public,max-age=31536000,immutable
accept-ranges
bytes
framework-72d77a3dc9c81291ed98.js
www.cyber.nj.gov/ 		21 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/framework-72d77a3dc9c81291ed98.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
4fd0a96efe47bae038a9186db469a80e781bb8d1858df5f0f1fba36df8a8a9d9

Request headers

Referer
https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Dec 2020 22:05:19 GMT
content-encoding
gzip
x-cdn
Incapsula
etag
"5eaeeecca18323b6aa7b4540447c4a72-ssl-df"
content-type
application/javascript
x-iinfo
3-5485839-0 0CNN RT(1607983519864 0) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=86400, public
content-length
7977
expires
Tue, 15 Dec 2020 22:05:19 GMT
app-8189e10c6c69d0fdd643.js
www.cyber.nj.gov/ 		56 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/app-8189e10c6c69d0fdd643.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
21b72673423cb72fd3bf711de76c6c08aa2d75f4c18ee916957d9f6482808acd

Request headers

Referer
https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Dec 2020 22:05:19 GMT
content-encoding
gzip
x-cdn
Incapsula
etag
"c4fbc33f06974de3df246a466930d051-ssl-df"
content-type
application/javascript
x-iinfo
3-5485840-0 0CNN RT(1607983519867 0) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=86400, public
content-length
16027
expires
Tue, 15 Dec 2020 22:05:19 GMT
styles-89fd2ae28bdf06750a71.js
www.cyber.nj.gov/ 		61 B
173 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/styles-89fd2ae28bdf06750a71.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
0fae8b03858a764bad3e9af19bfc924ead5b9e25c760432c19e91cba3dff1cf3

Request headers

Referer
https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Dec 2020 22:05:19 GMT
content-encoding
gzip
x-cdn
Incapsula
etag
"b906f077586d62e3fe5e51ddf4c7c900-ssl"
content-type
application/javascript
x-iinfo
3-5485841-0 0CNN RT(1607983519869 0) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=86400, public
content-length
64
expires
Tue, 15 Dec 2020 22:05:19 GMT
b637e9a5-645fb342d749e2adc83d.js
www.cyber.nj.gov/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/b637e9a5-645fb342d749e2adc83d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
f82c48dd8b366d212fc9ade2ecac2c47429d524017f6cce0b5379b78001db63a

Request headers

Referer
https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Dec 2020 22:05:19 GMT
content-encoding
gzip
x-cdn
Incapsula
etag
"968b1209df39f89e5571a9228feebf9d-ssl-df"
content-type
application/javascript
x-iinfo
3-5485842-0 0CNN RT(1607983519870 0) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=86400, public
content-length
31040
expires
Tue, 15 Dec 2020 22:05:19 GMT
332e21127b1b48b057feac7ec4976154d43ddaf1-f0e2809079e80c8d8ae5.js
www.cyber.nj.gov/ 		66 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/332e21127b1b48b057feac7ec4976154d43ddaf1-f0e2809079e80c8d8ae5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Netlify /
Resource Hash
f435c2cdceac9649a3e11888771784e9f910896bad6bf5ce20dc17d869158f75
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id
59adabad-8e0b-40eb-9555-ff088c88f9b4-5863252
date
Mon, 14 Dec 2020 22:05:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cdn
Incapsula
age
0
x-iinfo
3-5485843-5484673 2NNN RT(1607983519872 0) q(0 0 0 -1) r(4 4) U18
strict-transport-security
max-age=31536000
x-xss-protection
1; mode=block
referrer-policy
same-origin
server
Netlify
x-frame-options
SAMEORIGIN
etag
"397912789cdb691b16f674134e31a1d0-ssl-df"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public,max-age=31536000,immutable
accept-ranges
bytes
component---src-templates-markdownpage-js-f2c3881157fd61a3d36a.js
www.cyber.nj.gov/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/component---src-templates-markdownpage-js-f2c3881157fd61a3d36a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
656d8f34a6bef92974e3d20349056a2e85f6a2e8ca11ed96c6162153c6964325

Request headers

Referer
https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Dec 2020 22:05:19 GMT
content-encoding
gzip
x-cdn
Incapsula
etag
"b2a657dd4d6cfbe44a7bb74855d4c699-ssl-df"
content-type
application/javascript
x-iinfo
3-5485844-5479404 2CNN RT(1607983519873 0) q(0 0 0 -1) r(0 0) U18
cache-control
max-age=86400, public
content-length
1073
expires
Tue, 15 Dec 2020 22:05:19 GMT
app-data.json
www.cyber.nj.gov/page-data/ 		50 B
275 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/page-data/app-data.json
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Netlify /
Resource Hash
b76b7757d77bfeae47672014f6b897f6742d661ab22c97df706bc8b1b57953f6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Origin
https://www.cyber.nj.gov
Referer
https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id
2ea08e07-1b23-4eda-a5c9-adf41e4a5a91-82069807
date
Mon, 14 Dec 2020 22:04:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cdn
Incapsula
age
33
x-iinfo
3-5485845-5485846 NNYY CT(0 0 0) RT(1607983519876 0) q(0 0 0 -1) r(2 2) U2
x-xss-protection
1; mode=block
referrer-policy
same-origin
server
Netlify
x-frame-options
SAMEORIGIN
etag
"1a57ffd38d2f79dc823e43e4131b9483-ssl"
strict-transport-security
max-age=31536000
content-type
application/json
cache-control
public, max-age=0, must-revalidate
accept-ranges
bytes
page-data.json
www.cyber.nj.gov/page-data/threat-center/threat-profiles/macos-malware-variants/shlayer/ 		4 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/page-data/threat-center/threat-profiles/macos-malware-variants/shlayer/page-data.json
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Netlify /
Resource Hash
6ff352599c7aca7264ed1b1b9df5b724e3d8a2005ec85efcc527c2edac9cf431
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Origin
https://www.cyber.nj.gov
Referer
https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id
2ea08e07-1b23-4eda-a5c9-adf41e4a5a91-82069808
date
Mon, 14 Dec 2020 22:05:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cdn
Incapsula
age
0
x-iinfo
3-5485847-5485848 NNNY CT(0 0 0) RT(1607983519877 0) q(0 0 0 -1) r(4 4) U2
strict-transport-security
max-age=31536000
content-length
1932
x-xss-protection
1; mode=block
referrer-policy
same-origin
server
Netlify
x-frame-options
SAMEORIGIN
etag
"b29271768cc2d9c91131b6e3b0de822f-ssl-df"
vary
Accept-Encoding
content-type
application/json
cache-control
public, max-age=0, must-revalidate
accept-ranges
bytes
css
fonts.googleapis.com/ 		3 KB
925 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2a2062d154a80fe37666440d8a2df7c1801fa5c891a81cc681bcb3af0dd62fc7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Origin
https://www.cyber.nj.gov
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Mon, 14 Dec 2020 22:05:20 GMT
server
ESF
date
Mon, 14 Dec 2020 22:05:20 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 14 Dec 2020 22:05:20 GMT
2001626772.json
www.cyber.nj.gov/page-data/sq/d/ 		6 KB
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/page-data/sq/d/2001626772.json
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Netlify /
Resource Hash
8c93c91a88cce024ff3ee16ff346aa8b4bbb401504162634dab00df69ca9af57
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Origin
https://www.cyber.nj.gov
Referer
https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id
2ea08e07-1b23-4eda-a5c9-adf41e4a5a91-82069825
date
Mon, 14 Dec 2020 22:04:47 GMT
content-encoding
br
x-content-type-options
nosniff
x-cdn
Incapsula
age
33
x-iinfo
3-5485849-5485835 PNNN RT(1607983519941 0) q(0 0 0 -1) r(2 2) U2
strict-transport-security
max-age=31536000
content-length
1225
x-xss-protection
1; mode=block
referrer-policy
same-origin
server
Netlify
x-frame-options
SAMEORIGIN
etag
"a100926c056607fa39d1afca5bf9ec06-ssl-df"
vary
Accept-Encoding
content-type
application/json
cache-control
public, max-age=0, must-revalidate
accept-ranges
bytes
2628674228.json
www.cyber.nj.gov/page-data/sq/d/ 		719 B
507 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/page-data/sq/d/2628674228.json
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Netlify /
Resource Hash
022278202b62f09d48ced661ad9d8116bf0bb72aecf1d4c06fc15377e8d99334
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Origin
https://www.cyber.nj.gov
Referer
https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id
2ea08e07-1b23-4eda-a5c9-adf41e4a5a91-82069834
date
Mon, 14 Dec 2020 22:04:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cdn
Incapsula
age
33
x-iinfo
3-5485850-5485851 NNYN CT(16 19 0) RT(1607983519942 0) q(0 0 0 -1) r(0 2) U2
x-xss-protection
1; mode=block
referrer-policy
same-origin
server
Netlify
x-frame-options
SAMEORIGIN
etag
"f83d40254412929b6d877627663ab48c-ssl"
strict-transport-security
max-age=31536000
content-type
application/json
cache-control
public, max-age=0, must-revalidate
accept-ranges
bytes
2769593191.json
www.cyber.nj.gov/page-data/sq/d/ 		8 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/page-data/sq/d/2769593191.json
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
Netlify /
Resource Hash
e49a0e35778bf081153a907f8c8b7284fa2cecf0e2aa0bb4fa29b1b39003ad9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Origin
https://www.cyber.nj.gov
Referer
https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id
2ea08e07-1b23-4eda-a5c9-adf41e4a5a91-82069839
date
Mon, 14 Dec 2020 22:04:47 GMT
content-encoding
br
x-content-type-options
nosniff
x-cdn
Incapsula
age
33
x-iinfo
3-5485852-5485846 PNNy RT(1607983519944 0) q(0 1 1 -1) r(2 2) U2
strict-transport-security
max-age=31536000
x-xss-protection
1; mode=block
referrer-policy
same-origin
server
Netlify
x-frame-options
SAMEORIGIN
etag
"b9d13b56cd69d88b0545bb73ef4c48b5-ssl-df"
vary
Accept-Encoding
content-type
application/json
cache-control
public, max-age=0, must-revalidate
accept-ranges
bytes
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/ 		157 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://www.cyber.nj.gov
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Dec 2020 22:05:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 06 Aug 2020 16:43:41 GMT
etag
"1596732221"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
23876
js
www.googletagmanager.com/gtag/ 		96 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-162455942-1
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
8c54c0581b69097570c6b0971b20d68e9d9f84901306608a7a048b4eee24c106
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Dec 2020 22:05:20 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
39020
x-xss-protection
0
last-modified
Mon, 14 Dec 2020 21:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 14 Dec 2020 22:05:20 GMT
kWwPshCMTHmgpFkQuK4Q
cdn.buttercms.com/ 		50 KB
51 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.buttercms.com/kWwPshCMTHmgpFkQuK4Q
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:9c00:17:108e:3bc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
a6ea5009d0ef07479970cc3bf6e6012d876d3f35bd8b5102f801c0d4ca826b71

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 05:51:20 GMT
via
1.1 varnish, 1.1 varnish, 1.1 c4a2e8b9ec0bdec016055cf127d5dad8.cloudfront.net (CloudFront)
age
2122400
x-cache
Hit from cloudfront
content-disposition
inline; filename="Cream & Gray Massage Logo-seal.png"
content-length
51068
x-served-by
cache-bwi5146-BWI, cache-fra19131-FRA
last-modified
Sat, 23 May 2020 14:48:06 GMT
server
nginx
x-file-name
Cream & Gray Massage Logo-seal.png
x-timer
S1606110681.740853,VS0,VE3
etag
"d6b6dce3a65b92bd2b046af24e07f7b5"
access-control-max-age
21600
access-control-allow-methods
DELETE, GET, HEAD, POST, PUT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2678400
filestack-trace-id
1605861121-F09Q9bSJSo
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
access-control-allow-headers
Content-Type, X-No-Stream
x-amz-cf-id
dmDTvlMem9jFtxx0HgYfbn10G1qS4-doBXQi48Kx7sRVjc__4MdiEg==
x-cache-hits
1, 1
zCC5PhwYS9Klxami3nT3
cdn.buttercms.com/ 		52 KB
53 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.buttercms.com/zCC5PhwYS9Klxami3nT3
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:9c00:17:108e:3bc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
54e02c1aad708d776f8aa97405117122d1915765bcbe0e5a6a91bee43b64af89

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 22 Nov 2020 07:43:37 GMT
via
1.1 varnish, 1.1 varnish, 1.1 c4a2e8b9ec0bdec016055cf127d5dad8.cloudfront.net (CloudFront)
age
2139551
x-cache
Hit from cloudfront
content-disposition
inline; filename="NJCCIC (3).png"
content-length
53257
x-served-by
cache-bwi5132-BWI, cache-hhn4028-HHN
last-modified
Fri, 23 Aug 2019 19:18:36 GMT
server
nginx
x-file-name
NJCCIC (3).png
x-timer
S1606031017.213422,VS0,VE1
etag
"d4d9bca3cdafe641d16fa67ea86a2d48"
access-control-max-age
21600
access-control-allow-methods
DELETE, GET, HEAD, POST, PUT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2678400
filestack-trace-id
1605843969-AoMXR7iRki
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
access-control-allow-headers
Content-Type, X-No-Stream
x-amz-cf-id
jnW5BZ99ISyriy5Ah_g3MeaQXwnIPwx0auXMuF-KQUes8eSxo37tow==
x-cache-hits
1, 1
css
fonts.googleapis.com/ 		0
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Origin
https://www.cyber.nj.gov
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Mon, 14 Dec 2020 22:05:20 GMT
server
ESF
date
Mon, 14 Dec 2020 22:05:20 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 14 Dec 2020 22:05:20 GMT
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/ 		157 KB
23 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://www.cyber.nj.gov
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Dec 2020 22:05:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 12 May 2020 17:29:51 GMT
etag
"1589304591"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
23841
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.5.0/js/ 		59 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/js/bootstrap.min.js
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://www.cyber.nj.gov
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Dec 2020 22:05:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 12 May 2020 17:27:09 GMT
etag
"1589304429"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
14885
polyfill.min.js
cdn.polyfill.io/v3/ 		72 B
208 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.polyfill.io/v3/polyfill.min.js?features=fetch
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains; preload
content-encoding
br
x-content-type-options
nosniff
content-type
text/javascript; charset=utf-8
age
3478909
detected-user-agent
Chrome Mobile/83.0.4103
server-timing
MISS-CLUSTER, fastly;desc="Edge time";dur=1254, HIT-CLUSTER, fastly;desc="Edge time";dur=1
content-length
74
referrer-policy
origin-when-cross-origin
last-modified
Wed, 04 Nov 2020 15:43:21 GMT
date
Mon, 14 Dec 2020 22:05:20 GMT
vary
User-Agent, Accept-Encoding
access-control-allow-methods
GET,HEAD,OPTIONS
normalized-user-agent
chrome/83.0.0
access-control-allow-origin
*
cache-control
public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges
bytes
timing-allow-origin
*
jquery-3.5.1.slim.min.js
code.jquery.com/ 		71 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.5.1.slim.min.js
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db

Request headers

Origin
https://www.cyber.nj.gov
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Dec 2020 22:05:20 GMT
content-encoding
gzip
last-modified
Mon, 04 May 2020 23:02:39 GMT
server
nginx
etag
W/"5eb09f0f-11abc"
vary
Accept-Encoding
x-hw
1607983520.dop212.fr8.t,1607983520.cds284.fr8.hc,1607983520.cds240.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
24606
popper.min.js
cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/ 		21 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.cyber.nj.gov
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
age
4067509
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
content-length
7503
etag
W/"52f1-MTeJyg4xtlR4TbuosPg/Nk+Gg7Q"
x-served-by
cache-fra19178-FRA, cache-hhn4029-HHN
date
Mon, 14 Dec 2020 22:05:20 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/ 		59 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
/
Resource Hash
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Origin
https://www.cyber.nj.gov
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Dec 2020 22:05:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 06 Aug 2020 16:43:44 GMT
etag
"1596732224"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
14811
OneSignalSDK.js
cdn.onesignal.com/sdks/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.onesignal.com/sdks/OneSignalSDK.js
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8304827477215b517f051f116d5581a5e030e7f29df69061cb9cf108aa9cbc90

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Dec 2020 22:05:20 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
1626
etag
W/"f35a2111ffcc2dc2fded1fe3c98a7bee"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=43200
cf-ray
601b39cded14c272-FRA
cf-request-id
0704e274ad0000c272be8bc000000001
expires
Tue, 15 Dec 2020 10:05:20 GMT
_Incapsula_Resource
www.cyber.nj.gov/ 		138 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=2&cb=191298966
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
d0903afaa59bdc10a9449d3e52a8bfac10e54301957fc079bed10633991a843a

Request headers

Referer
https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-encoding
gzip
cache-control
no-cache, no-store
x-robots-tag
noindex
content-length
20084
content-type
application/javascript
flUhRq6tzZclQEJ-Vdg-IuiaDsNcIhQ8tQ.woff2
fonts.gstatic.com/s/materialicons/v67/ 		92 KB
93 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/materialicons/v67/flUhRq6tzZclQEJ-Vdg-IuiaDsNcIhQ8tQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6963af239ecfb1f9722ba86fe3456a19c1d64a995295b3f3b220f5c8c22ef13a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.cyber.nj.gov
Referer
https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 09 Dec 2020 18:38:24 GMT
x-content-type-options
nosniff
last-modified
Tue, 03 Nov 2020 05:39:50 GMT
server
sffe
age
444416
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
94648
x-xss-protection
0
expires
Thu, 09 Dec 2021 18:38:24 GMT
wlp_gwjKBV1pqhv43IE7225P.woff2
fonts.gstatic.com/s/cardo/v13/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/cardo/v13/wlp_gwjKBV1pqhv43IE7225P.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8204d955949011c5828e9abf4d8b96d072565c688aef0b35b502e5c41529a7aa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.cyber.nj.gov
Referer
https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 13 Dec 2020 14:29:58 GMT
x-content-type-options
nosniff
last-modified
Thu, 24 Sep 2020 23:55:39 GMT
server
sffe
age
113722
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14860
x-xss-protection
0
expires
Mon, 13 Dec 2021 14:29:58 GMT
XRXW3I6Li01BKofAnsSUYevIWzgPDA.woff2
fonts.gstatic.com/s/nunito/v16/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/nunito/v16/XRXW3I6Li01BKofAnsSUYevIWzgPDA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
57d8856c7c69e9f64c198cf86ef7117164496ce7c8b179a7c82fe03764f2dce3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.cyber.nj.gov
Referer
https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 11 Dec 2020 01:13:41 GMT
x-content-type-options
nosniff
last-modified
Wed, 25 Nov 2020 02:44:29 GMT
server
sffe
age
334299
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13056
x-xss-protection
0
expires
Sat, 11 Dec 2021 01:13:41 GMT
tZSSHXB0QZ6S9l1PQvjR
cdn.buttercms.com/ 		30 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.buttercms.com/tZSSHXB0QZ6S9l1PQvjR
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:9c00:17:108e:3bc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
a0e636a68a658ecb12cc186d1f7f9eaf7d44c9ecf6b3daf9ea069ca0173e0e3f

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 22 Nov 2020 21:28:08 GMT
via
1.1 varnish, 1.1 varnish, 1.1 c4a2e8b9ec0bdec016055cf127d5dad8.cloudfront.net (CloudFront)
age
1991044
x-cache
Hit from cloudfront
content-disposition
inline; filename="N CCIC (9).png"
content-length
30731
x-served-by
cache-bwi5120-BWI, cache-hhn4045-HHN
last-modified
Mon, 06 Apr 2020 19:41:11 GMT
server
nginx
x-file-name
N CCIC (9).png
x-timer
S1606080488.017242,VS0,VE89
etag
"9faf37d72772f749a87cb21a510fefc8"
access-control-max-age
21600
access-control-allow-methods
DELETE, GET, HEAD, POST, PUT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2678400
filestack-trace-id
1605992476-yqGCuQUQJe
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
access-control-allow-headers
Content-Type, X-No-Stream
x-amz-cf-id
pqbKhy-4Lgd9rS-0DoGdxzienK0bZm-cwkrCoXLKWftNOXYURHAjzQ==
x-cache-hits
1, 0
Qn0dlkOAQhO8adwRg2C0
cdn.buttercms.com/ 		88 KB
89 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.buttercms.com/Qn0dlkOAQhO8adwRg2C0
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:9c00:17:108e:3bc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
39fc3cf190b011ab899a8f5d5ba9e2442dfebb1bcaf4c87289ca98c05cc29b63

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 23 Nov 2020 06:34:49 GMT
via
1.1 varnish, 1.1 varnish, 1.1 c4a2e8b9ec0bdec016055cf127d5dad8.cloudfront.net (CloudFront)
age
2650745
x-cache
Hit from cloudfront
content-disposition
inline; filename="icons-footer-5-21.png"
content-length
89868
x-served-by
cache-bwi5146-BWI, cache-fra19153-FRA
last-modified
Sat, 23 May 2020 14:41:30 GMT
server
nginx
x-file-name
icons-footer-5-21.png
x-timer
S1606113289.083535,VS0,VE90
etag
"741c6511ab9ffd6544063467cd0742eb"
access-control-max-age
21600
access-control-allow-methods
DELETE, GET, HEAD, POST, PUT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2678400
filestack-trace-id
1605332775-eVRjXDYgRS
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
access-control-allow-headers
Content-Type, X-No-Stream
x-amz-cf-id
FmjIyxTaVwag3BnHpGhWvYA90KfM54DnDwMmOAEP1bOnibDlJK1w9w==
x-cache-hits
1, 0
yPnhycftTNGAh5m2V6uD
cdn.buttercms.com/ 		14 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.buttercms.com/yPnhycftTNGAh5m2V6uD
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:9c00:17:108e:3bc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
b8e8a5e125fc685f61004c304e204222ed9f66b50eb663d812ebfb5ec0142f98

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 09 Dec 2020 19:49:48 GMT
via
1.1 varnish, 1.1 varnish, 1.1 c4a2e8b9ec0bdec016055cf127d5dad8.cloudfront.net (CloudFront)
age
977930
x-cache
Hit from cloudfront
content-disposition
inline; filename="3.png"
content-length
14324
x-served-by
cache-bwi5135-BWI, cache-fra19158-FRA
last-modified
Mon, 06 Apr 2020 19:56:24 GMT
server
nginx
x-file-name
3.png
x-timer
S1607543388.039315,VS0,VE1
etag
"2440d61115634bdba11e5d627c94753d"
access-control-max-age
21600
access-control-allow-methods
DELETE, GET, HEAD, POST, PUT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2678400
filestack-trace-id
1607005591-NS1Nn6YzQQ
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
access-control-allow-headers
Content-Type, X-No-Stream
x-amz-cf-id
UnFf4YZvelyl8KPqEUsYdWnQBqXgk6vEbhO3xK0zbr3kD-gvKjpFTw==
x-cache-hits
1, 1
Gy9nQewnQIOPbCe8DGPF
cdn.buttercms.com/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.buttercms.com/Gy9nQewnQIOPbCe8DGPF
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:9c00:17:108e:3bc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
46b24625f14216fcbb72db91af1aec8cd72a69513dfa48d1cc8cd62c91435d1a

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 11 Dec 2020 09:32:50 GMT
via
1.1 varnish, 1.1 varnish, 1.1 c4a2e8b9ec0bdec016055cf127d5dad8.cloudfront.net (CloudFront)
age
304351
x-cache
Hit from cloudfront
content-disposition
inline; filename="2.png"
content-length
6114
x-served-by
cache-bwi5144-BWI, cache-hhn4074-HHN
last-modified
Mon, 06 Apr 2020 19:56:33 GMT
server
nginx
x-file-name
2.png
x-timer
S1607679170.023442,VS0,VE505
etag
"41c819e5f85b125ed5f42393f675082d"
access-control-max-age
21600
access-control-allow-methods
DELETE, GET, HEAD, POST, PUT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2678400
filestack-trace-id
1607679170-rNqE7w04SO
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
access-control-allow-headers
Content-Type, X-No-Stream
x-amz-cf-id
NYLmnHWHDp53IeNpn0QwGNvf7lDMpua40-4nZJTCgblwoF-fJDsTMw==
x-cache-hits
0, 0
W6tvy9nIRsu45tiOUO89
cdn.buttercms.com/ 		14 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.buttercms.com/W6tvy9nIRsu45tiOUO89
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:9c00:17:108e:3bc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
b31da6455e725fab3e9a95eeef26dd077d327824a00c28b797123096499c200d

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 21 Nov 2020 07:05:48 GMT
via
1.1 varnish, 1.1 varnish, 1.1 c4a2e8b9ec0bdec016055cf127d5dad8.cloudfront.net (CloudFront)
age
2139551
x-cache
Hit from cloudfront
content-disposition
inline; filename="Cream & Gray Massage Logo (2).png"
content-length
14313
x-served-by
cache-bwi5148-BWI, cache-fra19143-FRA
last-modified
Fri, 25 Sep 2020 14:45:26 GMT
server
nginx
x-file-name
Cream & Gray Massage Logo (2).png
x-timer
S1605942348.072061,VS0,VE131
etag
"d7c9f28e093031db7e9106bd83ef8ff8"
access-control-max-age
21600
access-control-allow-methods
DELETE, GET, HEAD, POST, PUT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2678400
filestack-trace-id
1605843969-XoIqvXwaSm
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
access-control-allow-headers
Content-Type, X-No-Stream
x-amz-cf-id
Ps-9-MRs1GUeafwb_kF1aXNj90iLxPM39qDyxI8X7MT3qAvVQrL6OQ==
x-cache-hits
1, 0
QSZCMoTS5OvR8soCNfWP
cdn.buttercms.com/ 		11 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.buttercms.com/QSZCMoTS5OvR8soCNfWP
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:9c00:17:108e:3bc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
e800bcd0513a356d83750467536b76b377e1a3620c69a0f32b25355c8959dd50

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 22 Nov 2020 14:41:29 GMT
via
1.1 varnish, 1.1 varnish, 1.1 c4a2e8b9ec0bdec016055cf127d5dad8.cloudfront.net (CloudFront)
age
1960871
x-cache
Hit from cloudfront
content-disposition
inline; filename="Cream & Gray Massage Logo (1).png"
content-length
11666
x-served-by
cache-bwi5128-BWI, cache-fra19133-FRA
last-modified
Fri, 25 Sep 2020 14:16:14 GMT
server
nginx
x-file-name
Cream & Gray Massage Logo (1).png
x-timer
S1606056089.236205,VS0,VE1
etag
"e595313d4e0e164cec67b83a0786161e"
access-control-max-age
21600
access-control-allow-methods
DELETE, GET, HEAD, POST, PUT
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2678400
filestack-trace-id
1606022649-ZoqH7XZoQQ
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
access-control-allow-headers
Content-Type, X-No-Stream
x-amz-cf-id
ECBjLPAyNkDBFH4tIF_efOgsONMYuvjOtdSDmNnx-Fb959H8tgQacg==
x-cache-hits
1, 1
polyfill.min.js
cdn.polyfill.io/v3/ 		72 B
167 B 		Other
General
Check archive.org
Download Go to
Full URL
https://cdn.polyfill.io/v3/polyfill.min.js?features=fetch
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains; preload
content-encoding
br
x-content-type-options
nosniff
content-type
text/javascript; charset=utf-8
age
3478909
detected-user-agent
Chrome Mobile/83.0.4103
server-timing
MISS-CLUSTER, fastly;desc="Edge time";dur=1254, HIT, fastly;desc="Edge time";dur=1
content-length
74
referrer-policy
origin-when-cross-origin
last-modified
Wed, 04 Nov 2020 15:43:21 GMT
date
Mon, 14 Dec 2020 22:05:21 GMT
access-control-allow-methods
GET,HEAD,OPTIONS
normalized-user-agent
chrome/83.0.0
access-control-allow-origin
*
cache-control
public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges
bytes
timing-allow-origin
*
_Incapsula_Resource
www.cyber.nj.gov/ 		1 B
35 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cyber.nj.gov/_Incapsula_Resource?SWKMTFSR=1&e=0.2348903580340207
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cache-control
no-cache, no-store
x-robots-tag
noindex
content-length
1
content-type
text/plain
analytics.js
www.google-analytics.com/ 		46 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-162455942-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Oct 2020 03:00:57 GMT
server
Golfe2
age
4531
date
Mon, 14 Dec 2020 20:49:50 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18817
expires
Mon, 14 Dec 2020 22:49:50 GMT
addthis_widget.js
s7.addthis.com/js/300/ 		353 KB
114 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/js/300/addthis_widget.js
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/332e21127b1b48b057feac7ec4976154d43ddaf1-f0e2809079e80c8d8ae5.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-112.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
"5f971164-5834c"
vary
Accept-Encoding
x-distribution
99
content-type
application/javascript
cache-control
public, max-age=600
date
Mon, 14 Dec 2020 22:05:21 GMT
x-host
s7.addthis.com
content-length
116325
chatbot.js
www.cyber.nj.gov/ 		500 B
559 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyber.nj.gov/chatbot.js
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/332e21127b1b48b057feac7ec4976154d43ddaf1-f0e2809079e80c8d8ae5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
99b054bbf28ebb11f60fba7fa59854d940564492598afdb0c28c7e9110580e51

Request headers

Referer
https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Dec 2020 22:05:20 GMT
content-encoding
gzip
x-cdn
Incapsula
etag
"21c9c79e7e2c8d20a174036616b70115-ssl"
content-type
application/javascript
x-iinfo
3-5485877-5484673 2CNN RT(1607983520801 0) q(0 0 0 -1) r(0 0) U18
cache-control
max-age=86400, public, must-revalidate
content-length
337
expires
Tue, 15 Dec 2020 22:05:20 GMT
collect
www.google-analytics.com/j/ 		1 B
69 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j87&a=843279325&t=pageview&_s=1&dl=https%3A%2F%2Fwww.cyber.nj.gov%2Fthreat-center%2Fthreat-profiles%2Fmacos-malware-variants%2Fshlayer&ul=en-us&de=UTF-8&dt=NJCCIC%20Threat%20Profile%20Shlayer&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=1107778651&gjid=1482081103&cid=218896897.1607983521&tid=UA-162455942-1&_gid=1369034134.1607983521&_r=1&gtm=2oubu0&z=1082780817
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 14 Dec 2020 22:05:21 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.cyber.nj.gov
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
loader.js
app.artibot.ai/ 		10 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://app.artibot.ai/loader.js
Requested by
Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/chatbot.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
65.9.68.69 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2a49c08c9a5a4e2636db8f1f3c11f7e49d177bb8be87a432414ea30e2ddb2802

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
null
Content-Encoding
gzip
Vary
Accept-Encoding
Last-Modified
Thu, 09 Jul 2020 18:41:19 GMT
Server
AmazonS3
X-Amz-Cf-Pop
FRA56-C1
ETag
"486ae3c31d0f430acafd42539b3f98b4"
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Content-Type
application/javascript; charset=utf-8
Via
1.1 47a7b8b932d91b0edbfc42f1ba94ebc1.cloudfront.net (CloudFront)
Cache-Control
public, max-age=14400
Date
Mon, 14 Dec 2020 22:05:21 GMT
Connection
keep-alive
X-Amz-Cf-Id
4EPDE0Qeu6aODuMMZqGAaEBw4m6ml7jn9vEHFCbnGQdqjoPB6en35w==
moatframe.js
z.moatads.com/addthismoatframe568911941483/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Dec 2020 22:05:21 GMT
content-encoding
gzip
last-modified
Fri, 08 Nov 2019 20:13:52 GMT
server
AmazonS3
x-amz-request-id
D5503D14AA2F06AA
etag
"f14b4e1f799b14f798a195f43cf58376"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=62386
accept-ranges
bytes
content-length
948
x-amz-id-2
JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=
version
api.artibot.ai/api/bots/021304d7-ea6f-4035-bec0-698b42ca0a81/ 		90 B
203 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.artibot.ai/api/bots/021304d7-ea6f-4035-bec0-698b42ca0a81/version
Requested by
Host: app.artibot.ai
URL: https://app.artibot.ai/loader.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.204.38.77 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-204-38-77.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
215bc18f93d5ce559e953e942460a1996c3911b09dcea4d446f75a92e1bc7def

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 14 Dec 2020 22:05:21 GMT
server
Kestrel
content-type
application/json; charset=utf-8
_ate.track.config_resp
v1.addthisedge.com/live/boost/ra-5e263a6ccdf8622d/ 		1 KB
911 B 		Script
General
Check archive.org
Download Go to
Full URL
https://v1.addthisedge.com/live/boost/ra-5e263a6ccdf8622d/_ate.track.config_resp
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-112.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
ba804fd763c5bb7b453d45e8fe61afa5f2c8ee4bd0828dc4e50c8f86aaf07826

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Dec 2020 22:05:21 GMT
content-encoding
gzip
etag
128670746--gzip
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
public, max-age=60, s-maxage=86400
content-disposition
attachment; filename=1.txt
content-length
736
300lo.json
m.addthis.com/live/red_lojson/ 		89 B
249 B 		Script
General
Check archive.org
Download Go to
Full URL
https://m.addthis.com/live/red_lojson/300lo.json?si=5fd7e1a1c08210c6&bkl=0&bl=1&pdt=2188&sid=5fd7e1a1c08210c6&pub=ra-5e263a6ccdf8622d&rev=v8.28.8-wp&ln=en&pc=men&cb=0&ab=-&dp=www.cyber.nj.gov&fp=threat-center%2Fthreat-profiles%2Fmacos-malware-variants%2Fshlayer&fr=&of=1&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&colc=1607983521397&jsl=1&skipb=1&callback=addthis.cbs.jsonp__29432417858351270
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-112.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
107d6ae449fd3cdd25c91a77cbb2440c1beeadbf75e9565ec9f1b4b3288c939e

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 14 Dec 2020 22:05:21 GMT
cache-control
max-age=0, no-cache, no-store, no-transform
content-disposition
attachment; filename=1.txt
content-length
89
content-type
application/javascript;charset=utf-8
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 0166 		0
0
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame CB50 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-112.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

:method
GET
:authority
s7.addthis.com
:scheme
https
:path
/static/sh.f48a1a04fe8dbf021b4cda1d.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

server
nginx/1.15.8
content-type
text/html
last-modified
Thu, 04 Jun 2020 15:49:19 GMT
etag
W/"5ed917ff-11adc"
timing-allow-origin
*
cache-control
public, max-age=86313600
p3p
CP="NON ADM OUR DEV IND COM STA"
strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
content-length
26421
date
Mon, 14 Dec 2020 22:05:21 GMT
vary
Accept-Encoding
x-host
s7.addthis.com
custom-messages.5799ddf75a30812a3d49.js
s7.addthis.com/static/ 		114 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/static/custom-messages.5799ddf75a30812a3d49.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-112.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
e08ee0a0555b2527719a5d5581fb11ae492e0a111be1f89ceedd3b51e995c7c5
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Thu, 04 Jun 2020 15:49:19 GMT
server
nginx/1.15.8
etag
W/"5ed917ff-1c9fc"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=86313600
date
Mon, 14 Dec 2020 22:05:21 GMT
x-host
s7.addthis.com
timing-allow-origin
*
content-length
28521
_ArtiBotLauncherCB_Manifest
prod.artibotcdn.com/manifest/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://prod.artibotcdn.com/manifest/_ArtiBotLauncherCB_Manifest?_=_
Requested by
Host: app.artibot.ai
URL: https://app.artibot.ai/loader.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6812:3770 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b7f23db44eff87a2e41aac89798c0031f3bfacae38eeacc489297b5e07c5809b

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Dec 2020 22:05:21 GMT
via
1.1 29d33c5cd70a6501fde7bc2dba557906.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
age
337
cf-ray
601b39d31ab3dfef-FRA
x-cache
Hit from cloudfront
content-encoding
br
cf-request-id
0704e277ed0000dfefd2036000000001
last-modified
Thu, 09 Jul 2020 18:41:20 GMT
server
cloudflare
etag
W/"10f7dba4b59666c1375e931a82d99285"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=mEOonxLNTcj3cmmUD4YY6%2FBd1r0yKFVSkdxwEd2ZNslpa7RuyYlpdPNgJvpG1CJEALXlReXPiavxwM7n3Jh04P%2BObTkdx%2FLzW5K0A5GDXmw0d7XmKEy7RWO8%2FzEuH37t"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
null
cache-control
public, max-age=900
x-amz-cf-pop
FRA56-C1
content-type
application/javascript; charset=utf-8
x-amz-cf-id
AgTXcvhALyEoCfoowUgZw2yGM7hesYutoHhBOfJAcvT3_spdo1QvSA==
launcher.4449.js
prod.artibotcdn.com/ 		287 KB
81 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://prod.artibotcdn.com/launcher.4449.js
Requested by
Host: app.artibot.ai
URL: https://app.artibot.ai/loader.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6812:3770 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1fe7d4f7f202f5218f44b4576266a20cb105b3cb3500a7ae69b8ac092a3f682e

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 14 Dec 2020 22:05:21 GMT
via
1.1 f2ee8ec5deee40e44013272a9c7aa35c.cloudfront.net (CloudFront)
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
3353480
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
content-encoding
br
cf-request-id
0704e278210000dfef4f376000000001
last-modified
Thu, 09 Jul 2020 18:41:15 GMT
server
cloudflare
etag
W/"82d281dd05ae9a5476267c10f5640be2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=7NZziT%2Bx0dskpCPFO5cjk3SGgQtyWl8qfjCz0End%2Bt9e3%2FQFEVewl11AvPvl0OYPbSfhQR6FICzHhzPaSLwe7vcRWedmC%2B7idTFYR%2FQapQaptToCac6o%2FgygrSOAdaUS"}],"group":"cf-nel","max_age":604800}
x-amz-version-id
null
cache-control
public, max-age=31536000
x-amz-cf-pop
FRA6-C1
cf-ray
601b39d36b53dfef-FRA
x-amz-cf-id
ulfznQcPfQg0VTMVAQ6Fi5cu1F_VqoXaxuIm8f5HuNf4cx8HvjYryg==
300vi.png
m.addthis.com/live/red_lojson/ 		0
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://m.addthis.com/live/red_lojson/300vi.png?cad=shba%3Duim1&positions=uim1%3Dbottom&goals=uim1%3Dshare&first=1&rv=0&uvs=5fd7e1a15f37dab5&pub=ra-5e263a6ccdf8622d&dp=www.cyber.nj.gov&rev=v8.28.8-wp
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-75-88-112.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 14 Dec 2020 22:05:22 GMT
cache-control
max-age=0, no-cache, no-store
expires
Mon, 14 Dec 2020 22:05:22 GMT
truncated
/ 		98 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
02a3d2b1c51fa7c978d0ceeabb1253da4b02194d2f4e3c83ce840aa26306b242

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
settings
api-cdn.prod-aws.artibot.ai/api/bots/021304d7-ea6f-4035-bec0-698b42ca0a81/ 		622 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api-cdn.prod-aws.artibot.ai/api/bots/021304d7-ea6f-4035-bec0-698b42ca0a81/settings?settingsVersion=22&botVersionId=11044ade-a5c4-4aaf-b98e-4bcf9066cf0e
Requested by
Host: prod.artibotcdn.com
URL: https://prod.artibotcdn.com/launcher.4449.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20c3:400:a:e02a:3080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Kestrel /
Resource Hash
ee4f852015ea30eebc7adaa7f17f4fed4ea69c29d9b2cfba140768a66de05848

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sun, 08 Nov 2020 18:05:52 GMT
Via
1.1 b8d6320dae849a3360537a2233718764.cloudfront.net (CloudFront)
Connection
keep-alive
Server
Kestrel
Age
3124770
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
public,max-age=2147483647
X-Amz-Cf-Pop
MUC50-C1
X-Amz-Cf-Id
HTCZfhrgR-t_8ouWAaWoeIttBT6L8lYZ8fyStd4qflKQ2M5jrmr18g==
botImage
s3.amazonaws.com/artibot-account-files-prod/ed/ed970824-bdf0-4739-9bde-cec1af330a41/021304d7-ea6f-4035-bec0-698b42ca0a81/ 		23 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3.amazonaws.com/artibot-account-files-prod/ed/ed970824-bdf0-4739-9bde-cec1af330a41/021304d7-ea6f-4035-bec0-698b42ca0a81/botImage?v=637344160031844726
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.225.83 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
9bad9ac5e80d98acbb10f67395739bcfcf9141b1e23c4549f68f04e6358c8d27

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 14 Dec 2020 22:05:23 GMT
Last-Modified
Sun, 30 Aug 2020 20:26:44 GMT
Server
AmazonS3
x-amz-request-id
47F971E8F7B0836D
ETag
"2cf68ca7d0143e0cc480accf3541ebe1"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
23490
x-amz-id-2
zLu6UpY75eT9x6dcwNuqTl2+ut6C861MnP+qSB1jgVTTO0kbmuUzW0KZMWgfOxT9iEzZan6mYHQ=

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
s7.addthis.com
URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

58 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| gtag object| dataLayer object| bootstrap string| pagePath object| ___chunkMapping function| $ function| jQuery function| Popper object| OneSignal object| webpackJsonp object| asyncRequires object| ___emitter object| ___loader function| ___push function| ___replace function| ___navigate object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga string| ___webpackCompilationHash object| gaplugins object| gaGlobal object| gaData object| artibotApi function| atwpjp string| _atd function| _euc function| _duc object| _atc string| _atr object| addthis string| addthis_pub function| emdot object| _ate object| _adr object| addthis_conf function| addthis_open function| addthis_close function| addthis_sendto boolean| __@@##MUH function| ArtiBot object| addthis_share object| addthis_config function| setImmediate function| clearImmediate object| _artibotLauncherInitializer

6 Cookies

Domain/Path Name / Value
.nj.gov/ Name: _gat_gtag_UA_162455942_1
Value: 1
.nj.gov/ Name: _gid
Value: GA1.2.1369034134.1607983521
.cyber.nj.gov/ Name: incap_ses_1095_1613844
Value: o0nseqfprkMOt0SYFDkyD5/h118AAAAAJpRJAXqVyI4ov8RVTdjzkw==
.nj.gov/ Name: _ga
Value: GA1.2.218896897.1607983521
.cyber.nj.gov/ Name: nlbi_1613844
Value: rqnCZUd5PXexRYwm3cr+KQAAAADqxrmWfBiVqH1xu91UKtAc
.cyber.nj.gov/ Name: visid_incap_1613844
Value: SdKzLNKXREqlCSQZEPvGDJ7h118AAAAAQUIPAAAAAAAlh7MShEwX4xKz1mtqMFq+

1 Console Messages

Source Level URL
Text
console-api log URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js(Line 1)
Message:
OneSignal: Using fallback ES5 Stub for backwards compatibility.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api-cdn.prod-aws.artibot.ai
api.artibot.ai
app.artibot.ai
cdn.buttercms.com
cdn.jsdelivr.net
cdn.onesignal.com
cdn.polyfill.io
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
m.addthis.com
prod.artibotcdn.com
s3.amazonaws.com
s7.addthis.com
stackpath.bootstrapcdn.com
v1.addthisedge.com
www.cyber.nj.gov
www.google-analytics.com
www.googletagmanager.com
z.moatads.com
s7.addthis.com
104.75.88.112
2.18.235.40
2001:4de0:ac19::1:b:1b
2001:4de0:ac19::1:b:3a
2600:9000:206f:9c00:17:108e:3bc0:93a1
2600:9000:20c3:400:a:e02a:3080:93a1
2606:4700:3032::6812:3770
2606:4700::6812:e234
2a00:1450:4001:801::200a
2a00:1450:4001:81a::200e
2a00:1450:4001:820::2008
2a00:1450:4001:820::200e
2a00:1450:4001:825::2003
2a04:4e42:1b::621
34.204.38.77
45.60.124.188
52.216.225.83
65.9.68.69
022278202b62f09d48ced661ad9d8116bf0bb72aecf1d4c06fc15377e8d99334
02a3d2b1c51fa7c978d0ceeabb1253da4b02194d2f4e3c83ce840aa26306b242
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
0fae8b03858a764bad3e9af19bfc924ead5b9e25c760432c19e91cba3dff1cf3
107d6ae449fd3cdd25c91a77cbb2440c1beeadbf75e9565ec9f1b4b3288c939e
1dc1b741a3ae394ec70bf6a060c7e275212e6b6f1b1b0b5fbbff486d693ff586
1fe7d4f7f202f5218f44b4576266a20cb105b3cb3500a7ae69b8ac092a3f682e
215bc18f93d5ce559e953e942460a1996c3911b09dcea4d446f75a92e1bc7def
21b72673423cb72fd3bf711de76c6c08aa2d75f4c18ee916957d9f6482808acd
2a2062d154a80fe37666440d8a2df7c1801fa5c891a81cc681bcb3af0dd62fc7
2a49c08c9a5a4e2636db8f1f3c11f7e49d177bb8be87a432414ea30e2ddb2802
38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff
39fc3cf190b011ab899a8f5d5ba9e2442dfebb1bcaf4c87289ca98c05cc29b63
46b24625f14216fcbb72db91af1aec8cd72a69513dfa48d1cc8cd62c91435d1a
4fd0a96efe47bae038a9186db469a80e781bb8d1858df5f0f1fba36df8a8a9d9
54e02c1aad708d776f8aa97405117122d1915765bcbe0e5a6a91bee43b64af89
57d8856c7c69e9f64c198cf86ef7117164496ce7c8b179a7c82fe03764f2dce3
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
63122f0a5a069e952e1d4657ffed2854cf753992e776a4a8181769962da00448
656d8f34a6bef92974e3d20349056a2e85f6a2e8ca11ed96c6162153c6964325
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
6963af239ecfb1f9722ba86fe3456a19c1d64a995295b3f3b220f5c8c22ef13a
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6ff352599c7aca7264ed1b1b9df5b724e3d8a2005ec85efcc527c2edac9cf431
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
8204d955949011c5828e9abf4d8b96d072565c688aef0b35b502e5c41529a7aa
8304827477215b517f051f116d5581a5e030e7f29df69061cb9cf108aa9cbc90
8c54c0581b69097570c6b0971b20d68e9d9f84901306608a7a048b4eee24c106
8c93c91a88cce024ff3ee16ff346aa8b4bbb401504162634dab00df69ca9af57
99b054bbf28ebb11f60fba7fa59854d940564492598afdb0c28c7e9110580e51
9bad9ac5e80d98acbb10f67395739bcfcf9141b1e23c4549f68f04e6358c8d27
a0e636a68a658ecb12cc186d1f7f9eaf7d44c9ecf6b3daf9ea069ca0173e0e3f
a6ea5009d0ef07479970cc3bf6e6012d876d3f35bd8b5102f801c0d4ca826b71
aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
b31da6455e725fab3e9a95eeef26dd077d327824a00c28b797123096499c200d
b76b7757d77bfeae47672014f6b897f6742d661ab22c97df706bc8b1b57953f6
b7f23db44eff87a2e41aac89798c0031f3bfacae38eeacc489297b5e07c5809b
b8e8a5e125fc685f61004c304e204222ed9f66b50eb663d812ebfb5ec0142f98
ba804fd763c5bb7b453d45e8fe61afa5f2c8ee4bd0828dc4e50c8f86aaf07826
d0903afaa59bdc10a9449d3e52a8bfac10e54301957fc079bed10633991a843a
e08ee0a0555b2527719a5d5581fb11ae492e0a111be1f89ceedd3b51e995c7c5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
e49a0e35778bf081153a907f8c8b7284fa2cecf0e2aa0bb4fa29b1b39003ad9a
e800bcd0513a356d83750467536b76b377e1a3620c69a0f32b25355c8959dd50
ee4f852015ea30eebc7adaa7f17f4fed4ea69c29d9b2cfba140768a66de05848
f435c2cdceac9649a3e11888771784e9f910896bad6bf5ce20dc17d869158f75
f82c48dd8b366d212fc9ade2ecac2c47429d524017f6cce0b5379b78001db63a
fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f