urlscan.io logo urlscan.io
SecurityTrails logo

www.infosecurity-magazine.com Open in urlscan Pro
13.32.99.67  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Submission: On January 23 via api from TR — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 30 IPs in 4 countries across 21 domains to perform 92 HTTP transactions. The main IP is 13.32.99.67, located in United States and belongs to AMAZON-02, US. The main domain is www.infosecurity-magazine.com. The Cisco Umbrella rank of the primary domain is 490859.
TLS certificate: Issued by GlobalSign RSA OV SSL CA 2018 on August 21st 2023. Valid for: a year.
This is the only time www.infosecurity-magazine.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
8 13.32.99.67 16509 (AMAZON-02)
15 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700::68... 13335 (CLOUDFLAR...)
4 2a02:26f0:480... 20940 (AKAMAI-ASN1)
9 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
3 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 18.165.183.115 16509 (AMAZON-02)
1 2606:4700:440... 13335 (CLOUDFLAR...)
10 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a03:2880:f08... 32934 (FACEBOOK)
1 146.75.116.157 54113 (FASTLY)
2 34.117.77.79 396982 (GOOGLE-CL...)
9 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 2001:4860:480... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 104.244.42.197 13414 (TWITTER)
1 104.244.42.195 13414 (TWITTER)
1 52.70.130.140 14618 (AMAZON-AES)
1 2a03:2880:f17... 32934 (FACEBOOK)
1 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 151.101.194.137 54113 (FASTLY)
2 185.221.87.23 54113 (FASTLY)
92 30
8    13.32.99.67 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-67.fra60.r.cloudfront.net
www.infosecurity-magazine.com
15    2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
securepubads.g.doubleclick.net
2    2606:4700::6810:5514 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.jsdelivr.net
4    2a02:26f0:480:f::213:7ec6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
use.typekit.net
9    2606:4700::6812:82ec (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.cookielaw.org
1    2a02:26f0:3500:16::215:1495 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
p.typekit.net
3    2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
2    18.165.183.115 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-165-183-115.zrh55.r.cloudfront.net
assets.infosecurity-magazine.com
1    2606:4700:4400::6812:2089 (United States)

ASN13335 (CLOUDFLARENET, US)
geolocation.onetrust.com
10    2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
1    2a00:1450:4001:829::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
4c51ab793f263c762ac517b3379a19a9.safeframe.googlesyndication.com
2    2a03:2880:f083:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
connect.facebook.net
1    146.75.116.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
static.ads-twitter.com
2    34.117.77.79 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 79.77.117.34.bc.googleusercontent.com
ml314.com
9    2a00:1450:4001:802::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
3    2a00:1450:4001:81c::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagservices.com
1    2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)
region1.analytics.google.com
1    2a00:1450:400c:c00::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
2    2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    104.244.42.197 (United States)

ASN13414 (TWITTER, US)
t.co
1    104.244.42.195 (United States)

ASN13414 (TWITTER, US)
analytics.twitter.com
1    52.70.130.140 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-70-130-140.compute-1.amazonaws.com
in.ml314.com
1    2a03:2880:f176:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
4    2a00:1450:4002:809::2003 (Ireland)

ASN15169 (GOOGLE, US)
csi.gstatic.com
2    2a00:1450:4001:829::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    151.101.194.137 (United States)

ASN54113 (FASTLY, US)
js-agent.newrelic.com
2    185.221.87.23 (Ireland)

ASN54113 (FASTLY, US)
bam.eu01.nr-data.net
Apex Domain
Subdomains		 Transfer
20 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 110
4c51ab793f263c762ac517b3379a19a9.safeframe.googlesyndication.com
tpc.googlesyndication.com — Cisco Umbrella Rank: 157
140 KB
17 doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 209
stats.g.doubleclick.net — Cisco Umbrella Rank: 79
googleads.g.doubleclick.net — Cisco Umbrella Rank: 38
294 KB
10 infosecurity-magazine.com
www.infosecurity-magazine.com — Cisco Umbrella Rank: 490859
assets.infosecurity-magazine.com — Cisco Umbrella Rank: 755061
160 KB
9 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 364
199 KB
5 typekit.net
use.typekit.net — Cisco Umbrella Rank: 463
p.typekit.net — Cisco Umbrella Rank: 566
93 KB
4 gstatic.com
csi.gstatic.com
396 B
3 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 2616
www.google.com — Cisco Umbrella Rank: 2
2 KB
3 googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 230
196 KB
3 ml314.com
ml314.com — Cisco Umbrella Rank: 1870
in.ml314.com — Cisco Umbrella Rank: 10729
11 KB
3 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 37
249 KB
2 nr-data.net
bam.eu01.nr-data.net — Cisco Umbrella Rank: 9136
919 B
2 google.de
www.google.de — Cisco Umbrella Rank: 6518
562 B
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 174
94 KB
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 324
40 KB
1 newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 600
19 KB
1 facebook.com
www.facebook.com — Cisco Umbrella Rank: 107
185 B
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 789
395 B
1 t.co
t.co — Cisco Umbrella Rank: 656
378 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 745
15 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 567
295 B
1 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 27
21 KB
92 21
Domain Requested by
15 securepubads.g.doubleclick.net www.infosecurity-magazine.com
www.googletagservices.com
10 pagead2.googlesyndication.com www.infosecurity-magazine.com
tpc.googlesyndication.com
www.googletagservices.com
9 tpc.googlesyndication.com securepubads.g.doubleclick.net
www.infosecurity-magazine.com
9 cdn.cookielaw.org www.infosecurity-magazine.com
8 www.infosecurity-magazine.com www.infosecurity-magazine.com
4 csi.gstatic.com securepubads.g.doubleclick.net
pagead2.googlesyndication.com
4 use.typekit.net www.infosecurity-magazine.com
use.typekit.net
3 www.googletagservices.com securepubads.g.doubleclick.net
3 www.googletagmanager.com www.infosecurity-magazine.com
2 bam.eu01.nr-data.net www.infosecurity-magazine.com
2 www.google.com www.infosecurity-magazine.com
2 www.google.de www.infosecurity-magazine.com
2 ml314.com www.infosecurity-magazine.com
2 connect.facebook.net www.infosecurity-magazine.com
2 assets.infosecurity-magazine.com www.infosecurity-magazine.com
2 cdn.jsdelivr.net www.infosecurity-magazine.com
1 js-agent.newrelic.com www.infosecurity-magazine.com
1 googleads.g.doubleclick.net www.infosecurity-magazine.com
1 www.facebook.com www.infosecurity-magazine.com
1 in.ml314.com www.infosecurity-magazine.com
1 analytics.twitter.com www.infosecurity-magazine.com
1 t.co www.infosecurity-magazine.com
1 stats.g.doubleclick.net www.googletagmanager.com
1 region1.analytics.google.com www.googletagmanager.com
1 static.ads-twitter.com www.infosecurity-magazine.com
1 4c51ab793f263c762ac517b3379a19a9.safeframe.googlesyndication.com www.infosecurity-magazine.com
1 geolocation.onetrust.com www.infosecurity-magazine.com
1 www.google-analytics.com www.infosecurity-magazine.com
1 p.typekit.net use.typekit.net
92 29
Subject Issuer Validity Valid
*.infosecurity-magazine.com
GlobalSign RSA OV SSL CA 2018		 2023-08-21 -
2024-09-21		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-12-11 -
2024-03-04		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-05-02 -
2024-05-01		 a year crt.sh
use.typekit.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-09-21 -
2024-10-21		 a year crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3		 2023-04-01 -
2024-03-31		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-12-11 -
2024-03-04		 3 months crt.sh
onetrust.com
Cloudflare Inc ECC CA-3		 2023-11-13 -
2024-11-12		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2023-11-01 -
2024-01-30		 3 months crt.sh
ads-twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-07-21 -
2024-07-19		 a year crt.sh
event-horizon.gcp.bomm.in
GTS CA 1D4		 2024-01-01 -
2024-03-31		 3 months crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2023-12-11 -
2024-03-04		 3 months crt.sh
www.google.de
GTS CA 1C3		 2023-12-11 -
2024-03-04		 3 months crt.sh
t.co
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2024-01-07 -
2025-01-06		 a year crt.sh
*.twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-10-31 -
2024-10-29		 a year crt.sh
*.ml314.com
Amazon RSA 2048 M02		 2023-10-16 -
2024-11-12		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2023-12-11 -
2024-03-04		 3 months crt.sh
www.google.com
GTS CA 1C3		 2023-12-11 -
2024-03-04		 3 months crt.sh
js-agent.newrelic.com
GlobalSign Atlas R3 DV TLS CA 2024 Q1		 2024-01-15 -
2025-02-15		 a year crt.sh
*.eu01.nr-data.net
DigiCert TLS RSA SHA256 2020 CA1		 2023-11-03 -
2024-10-01		 a year crt.sh

This page contains 7 frames:

Primary Page: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Frame ID: 782539BC3864F93E07C269A0922C0E54
Requests: 62 HTTP requests in this frame

Frame: https://4c51ab793f263c762ac517b3379a19a9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: A44A11A440B885449F76A9EBF42F3D06
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuPRlI1xrnhgmW9yYcXHlkjIyvrkZkE_tAg3jpz8M3rdE84hvjO41s1abJZ6jCfzxBMO_eesLM9QA-4C-PLgmMFiNJfrgmJ5dU2GSklntscDgv9HNq1Lt7nJme1WflSD6OcITgeGB-Bn4OMKIJByec3W_CPfseyjcKHJprxenIvP_WFIlPpepk3SHLeAzKficOZPneMwH3mFnsGzw97USYJ5c3IRlht_Aykwlch41ymVh6Qina0w3BE9q-JhbCCY7QlaLpUfeXOGIng0jg4z6FQpXDvErOfiq6ohDxZ4qWUDDNNGMNb95koEZ5cNiXkCfTJllCMJx26aNd61E1yVKTOYQ3WnRHi-RH_AeHAs7fPfw8X7DcRXxynSlgrlWxZwI_VMk6P-dXlAPpuP3KYcpvepV7MtVj1y8PxBSR4&sai=AMfl-YRjGtJPs7Mbc9nce_RN7fdQlwticcHo4h3qXFc9ltm2X_rn6HM0qWfdYosGuj3m3NzFVYedibTeUeHlizopIfXVKnV3HCCj_NFnCqokwjnDcabz4Gwn-nB6cvREbUK4Ol6mEK2Hd6g0c_99-SBXpHWX&sig=Cg0ArKJSzEI_EGGkT10nEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: A6776DD834B8F5E8EB70B84C5337BA98
Requests: 9 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssjkghVzI9SOC8FFJMHW_0SIlECnVKbeNxbtEaJmQcnFzwC1uj9WMHeKSvrC6jK4bnBOMBCktLYcppoySRJKERrkCpylEvVhIDuqhUycMqWpyaW0s8OV_DFypPOAFs8PFWoC2a0z78_56KnnPHgHLKU2NgyOulk4LB8NMo32suU-JQ1vo75pnalZHqmlSgHECRAk0ZS_bCBeI1l7fqn1mC09HOOfJoTYvuPAVV-if2RgIq8WT-jsftoCEFrpz5IID2wwY-e2GZo7nPAW7rP2-oibkmOynMCcYIpR_PBtHtBKzPPU1cj9zLtMhQ-p5ygexIuX21RDdhbOwf-ZxiPmXiUQoaJyUs6RXegiGBaEVVNBdeh7hZg6d2HVr9-Ips2uwvClHQZPSNsfxGZnn3kuwRelwNjj55J9I210FTB&sai=AMfl-YQi2I6rFGgygZ7kQB7fLZLiKGzYPD4u7LwptRSyX8waH4ZEbac7LCFbEW05iZnWGL7-Fc9dehKCVebVUwFszslhXhvX2W6YeKegQACUbBCHi8PpMS0R7fw7hNDTkA6UHHnoMTRAxqhoBoYC2F3d3_iT&sig=Cg0ArKJSzIa2qoXH6q_OEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: DD5E750AA61FA0E2BAFD4A42048E8567
Requests: 9 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstyZudwfIHoRR6TNTnYV_mu0xOrC1Xa68zIRvTY3tnHvr5IprRsShTumb6N8uoBFVNhlO-9_A7vF-OUeZONRIoFwiHOgJ_XH_9zUHiok4uwHUit1lkHt5Tfd2ZENi5FaHWZf9EM0v6BzExBLfowHG9u6cLEt-8W0fdcK5c9mNODwMfXbWr1khp_0DY_zZLxm1eiMTV8MQH9bs9cQ05P2jQR1bViD1c1kn0vMGfaf7461a_bzVY3pHkC-fNRC9RxLSoq1jVClIZuIOXB13umpu6z_FBt177DtwxvI6C_2V61mlV_Rmu5sTt--01256zffAelkva0PTmQ33ju68QAVn_gPM1NZszHaCvKxyy-Py1VWJwh2ipIPF0eyHofYQeR-L3m90XexSF1b8OtngX51RlL4CyRPMH3THkZBcWh&sai=AMfl-YR51-iOB1WGWOZejMTszLtHsb-KZ8W3sbG8qrjS5qqPZ_JMReRHNuRQs7ClMBWMxyVroh-5r5l1FmseReVASiORbwIfqLZ1ZcGTaCynrHcn3VqXBHB3a-FgGKsxXFQy90fVKuxWYtt2GiB2isyXC9T5&sig=Cg0ArKJSzLEWX5fDYEI0EAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 2E63DAB8191361578B0E2B23092B40FC
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: E99A698984DBEEABDDA76A641B2CF216
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 7F630AB9D956265F77B7525B56D2F514
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

New macOS Malware Targets Cracked Apps - Infosecurity Magazine Back ButtonSearch IconFilter Icon

Detected technologies

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js
Overall confidence: 100%
Detected patterns
  • underscore.*\.js(?:\?ver=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

92
Requests

100 %
HTTPS

69 %
IPv6

21
Domains

29
Subdomains

30
IPs

4
Countries

1536 kB
Transfer

4152 kB
Size

14
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

92 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/ 		97 KB
25 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-67.fra60.r.cloudfront.net
Software
RX /
Resource Hash
5e6db47873ee776b0d0bdc582bf73125e937097d2d385926ed27c61e8b623d25
Security Headers
Name Value
Content-Security-Policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-headers
Content-Type
access-control-allow-methods
*
age
179
cache-control
public, proxy-revalidate, max-age=300
content-encoding
br
content-security-policy
default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content
content-type
text/html; charset=utf-8
date
Tue, 23 Jan 2024 02:15:34 GMT
feature-policy
accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; display-capture 'none'; document-domain 'self'; encrypted-media: 'none'; execution-while-not-rendered 'none'; execution-while-out-of-viewport 'none'; fullscreen 'self'; gamepad 'none'; geolocation 'none'; layout-animations 'self'; legacy-image-formats 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; navigation-override 'none'; oversized-images 'none'; payment 'none'; picture-in-picture 'self'; publickey-credentials-get 'none'; speaker-selection 'none'; sync-xhr 'self'; usb 'none'; web-share 'self'; xr-spatial-tracking 'none'
last-modified
Mon, 22 Jan 2024 16:30:04 GMT
permissions-policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(self), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(self), xr-spatial-tracking=()
referrer-policy
same-origin
server
RX
vary
Accept-Encoding
via
1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront)
x-amz-cf-id
sFlhSLbs5-izsx1Zq4RTyiWuvT-F6_XxqrNggrOr03KNM09MKjGpMA==
x-amz-cf-pop
FRA60-P3
x-cache
Hit from cloudfront
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-ua-compatible
IE=Edge
x-xss-protection
1; mode=block
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		96 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8b2881eb9a5f29bd9fcb54b4ce18ce1a54937c31c441c01acbd868f7b8b09e50
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:33 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
29287
x-xss-protection
0
server
cafe
etag
83 / 19745 / m202401180101 / config-hash: 18080187960036651006
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
expires
Tue, 23 Jan 2024 02:18:33 GMT
jquery.min.js
cdn.jsdelivr.net/npm/jquery@3.7.0/dist/ 		85 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/jquery@3.7.0/dist/jquery.min.js
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:33 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
4822502
x-jsd-version
3.7.0
content-encoding
br
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-served-by
cache-fra-eddf8230128-FRA
x-jsd-version-type
version
server
cloudflare
etag
W/"155a6-Wp7qw02G6S5WYOD0+HIE8e0Mj/Y"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NXZk6M5HJrUX48soJVPfx08hiHxdIHAigsxb86Ve5acVxh%2BbeCZaOd65%2F5NvvC0slKgE%2BjJSSGtXOkQDFUEB77WzkyH%2BY55kDlZgCzy41JGNKGeMcL%2Ftd9VfOPCBKG0AZ%2F9uaYXbgwG2DezFj%2FY%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
849c8bf86d3a2c45-FRA
underscore-min.min.js
cdn.jsdelivr.net/npm/underscore@1.13.6/ 		19 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/underscore@1.13.6/underscore-min.min.js
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bb20d24b99fd1eae4fd77c1e833ce0a4536189961ceb1114fd272ca31e8ebd82
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:33 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
2529
x-jsd-version
1.13.6
content-encoding
br
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-served-by
cache-fra-eddf8230089-FRA, cache-lga21975-LGA
x-jsd-version-type
version
server
cloudflare
etag
W/"4d5b-1Barardb3Bq5uc0bP3wXZk8NDAQ"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aH%2BNsvVoVGpBTSnMuCTIde5wzYbEwfSbQRF8egAHXs4idhjd1v%2FJkqs5tvEOvFDl4A4ZFHQxMzhTszlMVPgKtdUEmaGcBwL5%2Bs0SCDZCTiTlS56QBSO74J9Obr89QEpILDu%2Fs7N8a4lZFZYwD6I%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
849c8bf86d3b2c45-FRA
phq8nwg.css
use.typekit.net/ 		11 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/phq8nwg.css
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
85b50ffe6b0cb56f765532dbac925599ddd984fcaefb0e2590099105dbd044da
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains;
content-encoding
gzip
date
Tue, 23 Jan 2024 02:18:33 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
1297
base.min.css
www.infosecurity-magazine.com/_common/css/23080201/ 		66 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.infosecurity-magazine.com/_common/css/23080201/base.min.css?v=23080201
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-67.fra60.r.cloudfront.net
Software
RX /
Resource Hash
c08e633b39381743b6e6bca9c5922e9aa9ba5f3044c29031b0076a47b4af1927
Security Headers
Name Value
Content-Security-Policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 22 Jan 2024 18:54:27 GMT
content-security-policy
default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content
x-content-type-options
nosniff
content-encoding
br
via
1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
age
26646
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
last-modified
Tue, 01 Aug 2023 11:34:54 GMT
server
RX
etag
W/"1fa172316cc4d91:0"
x-frame-options
SAMEORIGIN
access-control-allow-methods
*
content-type
text/css
vary
Accept-Encoding
feature-policy
accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; display-capture 'none'; document-domain 'self'; encrypted-media: 'none'; execution-while-not-rendered 'none'; execution-while-out-of-viewport 'none'; fullscreen 'self'; gamepad 'none'; geolocation 'none'; layout-animations 'self'; legacy-image-formats 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; navigation-override 'none'; oversized-images 'none'; payment 'none'; picture-in-picture 'self'; publickey-credentials-get 'none'; speaker-selection 'none'; sync-xhr 'self'; usb 'none'; web-share 'self'; xr-spatial-tracking 'none'
permissions-policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(self), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(self), xr-spatial-tracking=()
access-control-allow-headers
Content-Type
x-amz-cf-id
OCBuxlZGf-KAv9HIzMaFN03cAw34h2djfpSUqa6sKiMKI6oNd3hTvQ==
article.min.css
www.infosecurity-magazine.com/_common/css/23080201/ 		5 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.infosecurity-magazine.com/_common/css/23080201/article.min.css?v=23080201
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-67.fra60.r.cloudfront.net
Software
RX /
Resource Hash
778f93243401b2fd6663834b51f4d3f32012d6ee11f40f6169af721331bd1682
Security Headers
Name Value
Content-Security-Policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 22 Jan 2024 15:39:50 GMT
content-security-policy
default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content
x-content-type-options
nosniff
content-encoding
br
via
1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
age
38323
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
last-modified
Tue, 01 Aug 2023 11:34:55 GMT
server
RX
etag
W/"9590ba316cc4d91:0"
x-frame-options
SAMEORIGIN
access-control-allow-methods
*
content-type
text/css
vary
Accept-Encoding
feature-policy
accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; display-capture 'none'; document-domain 'self'; encrypted-media: 'none'; execution-while-not-rendered 'none'; execution-while-out-of-viewport 'none'; fullscreen 'self'; gamepad 'none'; geolocation 'none'; layout-animations 'self'; legacy-image-formats 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; navigation-override 'none'; oversized-images 'none'; payment 'none'; picture-in-picture 'self'; publickey-credentials-get 'none'; speaker-selection 'none'; sync-xhr 'self'; usb 'none'; web-share 'self'; xr-spatial-tracking 'none'
permissions-policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(self), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(self), xr-spatial-tracking=()
access-control-allow-headers
Content-Type
x-amz-cf-id
1zqx7IjJuQawbRNliACD9zEEtqlBiKUPIf3QqM5sRRJK8AgoqqDh6Q==
otSDKStub.js
cdn.cookielaw.org/scripttemplates/ 		21 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
98bc0753b3f7392176a4af252bfae9bcd1f2804b73dee374119899d8f52ae3d2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 23 Jan 2024 02:18:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
FWT01iLvZ++xUAz3aesSug==
age
76186
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
6841
x-ms-lease-status
unlocked
last-modified
Thu, 18 Jan 2024 03:30:15 GMT
server
cloudflare
etag
0x8DC17D5C943CD25
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
3072541c-501e-00a4-5d84-4a3025000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
849c8bf87c87193c-FRA
ism.js
www.infosecurity-magazine.com/_common/js/23080201/ 		5 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.infosecurity-magazine.com/_common/js/23080201/ism.js?v=23080201
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-67.fra60.r.cloudfront.net
Software
RX /
Resource Hash
fded88b84aecf0d550b1d26a85a971351a138a573dbd6bd88cb646de1e7ab42a
Security Headers
Name Value
Content-Security-Policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 22 Jan 2024 15:36:27 GMT
content-security-policy
default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content
x-content-type-options
nosniff
content-encoding
br
via
1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
age
38526
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
last-modified
Tue, 01 Aug 2023 11:38:31 GMT
server
RX
etag
W/"53c59bb26cc4d91:0"
x-frame-options
SAMEORIGIN
access-control-allow-methods
*
content-type
application/javascript
vary
Accept-Encoding
feature-policy
accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; display-capture 'none'; document-domain 'self'; encrypted-media: 'none'; execution-while-not-rendered 'none'; execution-while-out-of-viewport 'none'; fullscreen 'self'; gamepad 'none'; geolocation 'none'; layout-animations 'self'; legacy-image-formats 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; navigation-override 'none'; oversized-images 'none'; payment 'none'; picture-in-picture 'self'; publickey-credentials-get 'none'; speaker-selection 'none'; sync-xhr 'self'; usb 'none'; web-share 'self'; xr-spatial-tracking 'none'
permissions-policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(self), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(self), xr-spatial-tracking=()
access-control-allow-headers
Content-Type
x-amz-cf-id
PIui_G4V2PicA7l7afNocqP0XyzgPbUIHuHCqRlMab0tqt_8AI62qA==
ism.ads.es5.min.js
www.infosecurity-magazine.com/_common/js/23080201/ism/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.infosecurity-magazine.com/_common/js/23080201/ism/ism.ads.es5.min.js?v=23080201
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-67.fra60.r.cloudfront.net
Software
RX /
Resource Hash
cbe5296bf61f4ee88ecab204fe1ec3a144660caa32b71d9744f01102286df62a
Security Headers
Name Value
Content-Security-Policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 22 Jan 2024 23:17:17 GMT
content-security-policy
default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content
x-content-type-options
nosniff
content-encoding
br
via
1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
age
10875
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
last-modified
Wed, 02 Aug 2023 09:03:55 GMT
server
RX
etag
W/"a920204420c5d91:0"
x-frame-options
SAMEORIGIN
access-control-allow-methods
*
content-type
application/javascript
vary
Accept-Encoding
feature-policy
accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; display-capture 'none'; document-domain 'self'; encrypted-media: 'none'; execution-while-not-rendered 'none'; execution-while-out-of-viewport 'none'; fullscreen 'self'; gamepad 'none'; geolocation 'none'; layout-animations 'self'; legacy-image-formats 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; navigation-override 'none'; oversized-images 'none'; payment 'none'; picture-in-picture 'self'; publickey-credentials-get 'none'; speaker-selection 'none'; sync-xhr 'self'; usb 'none'; web-share 'self'; xr-spatial-tracking 'none'
permissions-policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(self), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(self), xr-spatial-tracking=()
access-control-allow-headers
Content-Type
x-amz-cf-id
5zh4K9ilbyAXjYYruCu9Uz2tBxcL__IYzhTDrFrw0FKMIsUZXHPnxg==
ism.whatshot.es5.min.js
www.infosecurity-magazine.com/_common/js/23080201/ism/ 		851 B
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.infosecurity-magazine.com/_common/js/23080201/ism/ism.whatshot.es5.min.js?v=23080201
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-67.fra60.r.cloudfront.net
Software
RX /
Resource Hash
ecde3c0d9f4721fd5bc3989d1e6103966b836786849f65ead031a1c758687ef0
Security Headers
Name Value
Content-Security-Policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-security-policy
default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content
date
Mon, 22 Jan 2024 11:21:34 GMT
x-content-type-options
nosniff
via
1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
age
53819
x-cache
Hit from cloudfront
content-length
851
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
last-modified
Tue, 01 Aug 2023 11:35:05 GMT
server
RX
etag
"bb28fd376cc4d91:0"
x-frame-options
SAMEORIGIN
access-control-allow-methods
*
content-type
application/javascript
feature-policy
accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; display-capture 'none'; document-domain 'self'; encrypted-media: 'none'; execution-while-not-rendered 'none'; execution-while-out-of-viewport 'none'; fullscreen 'self'; gamepad 'none'; geolocation 'none'; layout-animations 'self'; legacy-image-formats 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; navigation-override 'none'; oversized-images 'none'; payment 'none'; picture-in-picture 'self'; publickey-credentials-get 'none'; speaker-selection 'none'; sync-xhr 'self'; usb 'none'; web-share 'self'; xr-spatial-tracking 'none'
permissions-policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(self), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(self), xr-spatial-tracking=()
accept-ranges
bytes
access-control-allow-headers
Content-Type
x-amz-cf-id
643T-Jj56cZs7G80PY5k90FRHSV5zA1MLByKjDLJMEgd7-XKv933pA==
p.css
p.typekit.net/ 		5 B
172 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://p.typekit.net/p.css?s=1&k=phq8nwg&ht=tk&f=15982.15984.37450.16353.37464.37466.37515.37516.37517.37518.37519.37520.51838.51839.51840.51841&a=6157095&app=typekit&e=css
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/phq8nwg.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:33 GMT
last-modified
Fri, 23 Jun 2023 17:09:47 GMT
server
nginx
etag
"6495d1db-5"
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
5
6b575081-117f-49ba-bff7-347875107505.json
cdn.cookielaw.org/consent/6b575081-117f-49ba-bff7-347875107505/ 		4 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/6b575081-117f-49ba-bff7-347875107505/6b575081-117f-49ba-bff7-347875107505.json
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
09ddaf1d1202b5fc93ba151c407e0048b2dd605d8843679a5ec8e070e79a254b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 23 Jan 2024 02:18:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
16633
content-md5
xfOtWclhejhsj9QJZumB3w==
content-length
1487
x-ms-lease-status
unlocked
last-modified
Fri, 08 Sep 2023 08:00:06 GMT
server
cloudflare
etag
0x8DBB0419D43B882
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
969453ec-301e-0046-211c-150d04000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
849c8bfa2c174d93-FRA
expires
Wed, 24 Jan 2024 02:18:33 GMT
gtm.js
www.googletagmanager.com/ 		229 KB
78 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MJ69SWF
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
26c1017967b3f4b73858404614486f1a0eff798f5a9194d95c7f120ebba0e932
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:33 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
79467
x-xss-protection
0
last-modified
Tue, 23 Jan 2024 00:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 23 Jan 2024 02:18:33 GMT
analytics.js
www.google-analytics.com/ 		52 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 23 Jan 2024 01:48:09 GMT
last-modified
Tue, 12 Dec 2023 18:09:08 GMT
server
Golfe2
age
1824
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Tue, 23 Jan 2024 03:48:09 GMT
55ec2c09-d22e-4a3e-a2bf-c0a08a205868.jpeg
assets.infosecurity-magazine.com/webpage/feat/ 		107 KB
108 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.infosecurity-magazine.com/webpage/feat/55ec2c09-d22e-4a3e-a2bf-c0a08a205868.jpeg
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.165.183.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-165-183-115.zrh55.r.cloudfront.net
Software
RX /
Resource Hash
54286278818bb04c87dbe23a2794cdc8bb17948e151dd1a20b5e0f09fb764d3e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.infosecurity-magazine.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:34 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
via
1.1 3d994808da6a9ce8c9e7b1364fa689ea.cloudfront.net (CloudFront)
server
RX
x-amz-cf-pop
ZRH55-P1
x-frame-options
SAMEORIGIN
x-cache
Miss from cloudfront
content-type
image/jpeg
cache-control
private, max-age=2764800
x-amz-cf-id
WAa0i8Z6vJd_-J9HhUIkjYQfLy5uShAWDT_VMR4FN_pfm8sSgLFczw==
content-length
109701
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
l
use.typekit.net/af/73dbad/00000000000000007735a197/30/ 		24 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/73dbad/00000000000000007735a197/30/l?subset_id=2&fvd=n7&v=3
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/phq8nwg.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
4ca1e0e518aaf5d78abd4fc78268ac642cb679dbb56a905d2c57a296566a0bba

Request headers

Referer
https://use.typekit.net/phq8nwg.css
Origin
https://www.infosecurity-magazine.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:33 GMT
server
nginx
etag
"550ca47a88a465c010c13a8c017f04a91a75a9a4"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
24168
l
use.typekit.net/af/32b0e4/00000000000000007735a185/30/ 		44 KB
45 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/32b0e4/00000000000000007735a185/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/phq8nwg.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
4f8059cfd6739160b9073e937833a58c728a9791b380f27fcf2d047d76951155

Request headers

Referer
https://use.typekit.net/phq8nwg.css
Origin
https://www.infosecurity-magazine.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:33 GMT
server
nginx
etag
"dead750a1d4bc579636464295fb9e45aa84c4884"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
45468
l
use.typekit.net/af/2180b4/00000000000000007735a193/30/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/2180b4/00000000000000007735a193/30/l?subset_id=2&fvd=n6&v=3
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/phq8nwg.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
a45a4393f8b7ac978e32ac46f58dad43eb83811a4b3d9f7b79cac1f864edd662

Request headers

Referer
https://use.typekit.net/phq8nwg.css
Origin
https://www.infosecurity-magazine.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:33 GMT
server
nginx
etag
"d42a9fe146eae2c4c65475dbd44806c5aed58d8b"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
23312
605bfdcb-abca-4e31-9902-3a3d746228ce.png
assets.infosecurity-magazine.com/s3/infosec-media/images/profile/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.infosecurity-magazine.com/s3/infosec-media/images/profile/605bfdcb-abca-4e31-9902-3a3d746228ce.png?width=64&height=64&mode=crop&scale=both&format=webp
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.165.183.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-165-183-115.zrh55.r.cloudfront.net
Software
RX /
Resource Hash
07ac84596d158248a60c2f747f609a508e6e2f1980a23f0608caee79a30291b7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 22 Jan 2024 17:34:28 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
via
1.1 3d994808da6a9ce8c9e7b1364fa689ea.cloudfront.net (CloudFront)
x-aspnet-version
4.0.30319
x-amz-cf-pop
ZRH55-P1
age
31445
x-cache
Hit from cloudfront
content-length
1686
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
server
RX
x-frame-options
SAMEORIGIN
content-type
image/webp
cache-control
public
x-amz-cf-id
OJsFAZp61MDRQuvUpPcqT9yXu8-28aAP7kDvoH45Mdlqlu3OFgtCAQ==
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401180101/ 		430 KB
135 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401180101/pubads_impl.js
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
5dd0b5724f4bbac4bd58de274236fce36135ce302364b3b8ff5c4c3631e81139
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 22 Jan 2024 13:04:36 GMT
content-encoding
br
x-content-type-options
nosniff
age
47637
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
138095
x-xss-protection
0
server
cafe
etag
16105826302836755247
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
expires
Tue, 21 Jan 2025 13:04:36 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/ 		138 B
108 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.infosecurity-magazine.com
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0ea356cd6846f263b1b34b57486b13499100ebdf3bbb9dca20f9d848756e1a6e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:33 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
83
x-xss-protection
0
expires
Tue, 23 Jan 2024 02:18:33 GMT
/
www.infosecurity-magazine.com/account-buttons/ 		240 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.infosecurity-magazine.com/account-buttons/?time=1705976313870
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-67.fra60.r.cloudfront.net
Software
RX /
Resource Hash
4e916eb59cd64cce6fc41e3355180f0284ae0edc2602686431e90f2e7f082652
Security Headers
Name Value
Content-Security-Policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

X-NewRelic-ID
Vg8GV1ZVCxACUFBSAgMEV1c=
tracestate
2916063@nr=0-1-2916063-322535572-c6953b157d5a9915----1705976313871
traceparent
00-0aba843c520eab03c575ba2cf8c72878-c6953b157d5a9915-01
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
newrelic
eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI5MTYwNjMiLCJhcCI6IjMyMjUzNTU3MiIsImlkIjoiYzY5NTNiMTU3ZDVhOTkxNSIsInRyIjoiMGFiYTg0M2M1MjBlYWIwM2M1NzViYTJjZjhjNzI4NzgiLCJ0aSI6MTcwNTk3NjMxMzg3MX19
Accept
*/*
Referer
https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
X-Requested-With
XMLHttpRequest

Response headers

date
Tue, 23 Jan 2024 02:18:33 GMT
content-security-policy
default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content
x-content-type-options
nosniff
via
1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
x-cache
Miss from cloudfront
content-length
240
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
pragma
no-cache
referrer-policy
same-origin
server
RX
x-frame-options
SAMEORIGIN
access-control-allow-methods
*
content-type
application/json; charset=utf-8
cache-control
no-cache, no-store
feature-policy
accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; display-capture 'none'; document-domain 'self'; encrypted-media: 'none'; execution-while-not-rendered 'none'; execution-while-out-of-viewport 'none'; fullscreen 'self'; gamepad 'none'; geolocation 'none'; layout-animations 'self'; legacy-image-formats 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; navigation-override 'none'; oversized-images 'none'; payment 'none'; picture-in-picture 'self'; publickey-credentials-get 'none'; speaker-selection 'none'; sync-xhr 'self'; usb 'none'; web-share 'self'; xr-spatial-tracking 'none'
permissions-policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(self), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(self), xr-spatial-tracking=()
access-control-allow-headers
Content-Type
x-amz-cf-id
xaKt3nEPPtE7Sqlqt36JZ4xKyY5CLFt9986OdZuPtohnEQui8zfxKg==
expires
-1
/
www.infosecurity-magazine.com/nav/mobile/ 		4 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.infosecurity-magazine.com/nav/mobile/
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-67.fra60.r.cloudfront.net
Software
RX /
Resource Hash
53fc4495c7705b2373e2b73ec881c82dffb40cfbd744d8e5bd8ba7f5a018575b
Security Headers
Name Value
Content-Security-Policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

X-NewRelic-ID
Vg8GV1ZVCxACUFBSAgMEV1c=
tracestate
2916063@nr=0-1-2916063-322535572-bdcd65319bac100c----1705976313871
traceparent
00-4f7d4fd5c04e812739a68a0b5577b457-bdcd65319bac100c-01
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
newrelic
eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjI5MTYwNjMiLCJhcCI6IjMyMjUzNTU3MiIsImlkIjoiYmRjZDY1MzE5YmFjMTAwYyIsInRyIjoiNGY3ZDRmZDVjMDRlODEyNzM5YTY4YTBiNTU3N2I0NTciLCJ0aSI6MTcwNTk3NjMxMzg3MX19
Accept
*/*
Referer
https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
X-Requested-With
XMLHttpRequest

Response headers

date
Tue, 23 Jan 2024 02:18:33 GMT
content-security-policy
default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content
x-content-type-options
nosniff
content-encoding
br
via
1.1 319f376925908156190f5fc160137b42.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
x-cache
Miss from cloudfront
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
server
RX
x-frame-options
SAMEORIGIN
access-control-allow-methods
*
content-type
text/html; charset=utf-8
vary
Accept-Encoding
cache-control
private
feature-policy
accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; display-capture 'none'; document-domain 'self'; encrypted-media: 'none'; execution-while-not-rendered 'none'; execution-while-out-of-viewport 'none'; fullscreen 'self'; gamepad 'none'; geolocation 'none'; layout-animations 'self'; legacy-image-formats 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; navigation-override 'none'; oversized-images 'none'; payment 'none'; picture-in-picture 'self'; publickey-credentials-get 'none'; speaker-selection 'none'; sync-xhr 'self'; usb 'none'; web-share 'self'; xr-spatial-tracking 'none'
permissions-policy
accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(self), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(self), xr-spatial-tracking=()
access-control-allow-headers
Content-Type
x-amz-cf-id
EIT73hbcbuY3MQEJr0J1qE-GKluw4RQdGCCGkoIHqYoUNmYT9nUXqA==
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 		59 B
295 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept
application/json
Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:34 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cf-ray
849c8bfb697d3680-FRA
access-control-allow-headers
Content-Type
rum.js
pagead2.googlesyndication.com/pagead/js/ 		65 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/rum.js
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d8a7c81e5addaa20d965ad0c095aad1f118c03679b388ec5a5dbbac38f149b7f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 01:40:07 GMT
content-encoding
br
x-content-type-options
nosniff
age
2307
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
24629
x-xss-protection
0
server
cafe
etag
106683528911992433
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=3600
timing-allow-origin
*
expires
Tue, 23 Jan 2024 02:40:07 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		50 KB
19 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1319515112026595&correlator=1657395364207178&eid=31079724%2C44777897%2C31079527%2C31061691%2C31061692&output=ldjh&gdfp_req=1&vrg=202401180101&ptt=17&impl=fifs&iu_parts=1165%2Crx_infosecurity_magazine%2Cnews%2Cmacos-malware-targets-cracked-apps&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=728x90&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1705976314050&lmt=1705941004&adxs=436&adys=8&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Fmacos-malware-targets-cracked-apps%2F&rumc=1319515112026595&rume=1&vis=1&psz=1600x50&msz=728x50&fws=0&ohw=0&ga_vid=896452633.1705976314&ga_sid=1705976314&ga_hid=1883687034&ga_fc=true&dlt=1705976313566&idt=431&cust_params=topics%3DApplication%2520Security%252CCybercrime%252CHuman%2520Factor%252CMalware%252CNetwork%2520Security%252CPayment%2520Security%252CSecure%2520Coding%252CPhishing%252CThreat%2520Intelligence%252CSocial%2520Engineering%252CEnd%2520Point%2520Security%252CCrypto-currency%2520%252CThreats%252C%2520Exploits%2520and%2520Vulnerabilities&adks=745914674&frm=20
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ae293d258c9169bb80f8721f9d641118116f64f8d856d8ebaad36d53c8fe5afb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:34 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
19171
x-xss-protection
0
google-lineitem-id
6475931511
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138461847757
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.infosecurity-magazine.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		50 KB
19 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1319515112026595&correlator=1314292738031445&eid=31079724%2C44777897%2C31079527%2C31061691%2C31061692&output=ldjh&gdfp_req=1&vrg=202401180101&ptt=17&impl=fifs&iu_parts=1165%2Crx_infosecurity_magazine%2Cnews%2Cmacos-malware-targets-cracked-apps&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&ifi=2&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1705976314055&lmt=1705941004&adxs=1046&adys=770&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Fmacos-malware-targets-cracked-apps%2F&rumc=1319515112026595&rume=1&vis=1&psz=364x331&msz=300x250&fws=0&ohw=0&ga_vid=896452633.1705976314&ga_sid=1705976314&ga_hid=1883687034&ga_fc=true&dlt=1705976313566&idt=431&cust_params=topics%3DApplication%2520Security%252CCybercrime%252CHuman%2520Factor%252CMalware%252CNetwork%2520Security%252CPayment%2520Security%252CSecure%2520Coding%252CPhishing%252CThreat%2520Intelligence%252CSocial%2520Engineering%252CEnd%2520Point%2520Security%252CCrypto-currency%2520%252CThreats%252C%2520Exploits%2520and%2520Vulnerabilities&adks=917848018&frm=20
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
95ccfe8ac8d7118cd5b9336476eb36a0fbaebefda7bf822c6450d29a79f6ba91
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:34 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
18980
x-xss-protection
0
google-lineitem-id
6475931511
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138461298257
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.infosecurity-magazine.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		50 KB
19 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1319515112026595&correlator=2142995099579253&eid=31079724%2C44777897%2C31079527%2C31061691%2C31061692&output=ldjh&gdfp_req=1&vrg=202401180101&ptt=17&impl=fifs&iu_parts=1165%2Crx_infosecurity_magazine%2Cnews%2Cmacos-malware-targets-cracked-apps&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=728x90&ifi=3&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1705976314057&lmt=1705941004&adxs=436&adys=1142&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Fmacos-malware-targets-cracked-apps%2F&rumc=1319515112026595&rume=1&vis=1&psz=1600x50&msz=728x50&fws=512&ohw=0&ga_vid=896452633.1705976314&ga_sid=1705976314&ga_hid=1883687034&ga_fc=true&dlt=1705976313566&idt=431&cust_params=topics%3DApplication%2520Security%252CCybercrime%252CHuman%2520Factor%252CMalware%252CNetwork%2520Security%252CPayment%2520Security%252CSecure%2520Coding%252CPhishing%252CThreat%2520Intelligence%252CSocial%2520Engineering%252CEnd%2520Point%2520Security%252CCrypto-currency%2520%252CThreats%252C%2520Exploits%2520and%2520Vulnerabilities&adks=2433805320&frm=20
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
5feafebfc5a89cdf7aaec3520d7d43e5ec43456fac12ecf8bdb9c32902766c9e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:34 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
19056
x-xss-protection
0
google-lineitem-id
6475931511
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138461847757
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.infosecurity-magazine.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
4c51ab793f263c762ac517b3379a19a9.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame A44A 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://4c51ab793f263c762ac517b3379a19a9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 23 Jan 2024 02:18:34 GMT
expires
Wed, 22 Jan 2025 02:18:34 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
js
www.googletagmanager.com/gtag/ 		275 KB
91 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-8VSXE5KKGM&l=dataLayer&cx=c
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
9df688d410bb3459acdeb1f1400c485cfb167ce9d4fe06fcd2b877e9f65d6fa2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:34 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
92808
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Tue, 23 Jan 2024 02:18:34 GMT
fbevents.js
connect.facebook.net/en_US/ 		213 KB
57 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
d7800992c70337710a800628bad888bebad0a275102de46a3370179e373c034b
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

permissions-policy-report-only
autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy
default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Tue, 23 Jan 2024 02:18:34 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
57022
x-xss-protection
0
reporting-endpoints
pragma
public
x-fb-debug
EN13kGUFMrVGtr3Was3XSRkP1NawwiN2Giij3iePV2NzrvWnt3eR++ZrEqBjTZolqnBO7TVNtGbl4qY7aAK6SA==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin
*
expires
Sat, 01 Jan 2000 00:00:00 GMT
oct.js
static.ads-twitter.com/ 		56 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.ads-twitter.com/oct.js
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:34 GMT
content-encoding
gzip
last-modified
Thu, 27 Oct 2022 16:56:53 GMT
etag
"32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary
Accept-Encoding,Host
x-cache
HIT, HIT
content-type
application/javascript; charset=utf-8
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn
FT
cache-control
no-cache
accept-ranges
bytes
content-length
15375
x-served-by
cache-iad-kjyo7100093-IAD, cache-fra-eddf8230077-FRA
tag.aspx
ml314.com/ 		31 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ml314.com/tag.aspx?2302024
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
79.77.117.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
b2fe03efc1e879c2c5bd27bf86f71ad3790b0d6765498480f4c8071fa7f59051

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 01:41:25 GMT
via
1.1 google
content-encoding
br
age
2229
x-guploader-uploadid
ABPtcPoKhfzvo5g_-df5XZ3l7r8KMnWQPujTdyrzHESOvD3wInSGxqG8ABgbj8iQWmJyLao4ddasqpsT
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
10218
last-modified
Mon, 18 Dec 2023 20:13:43 GMT
server
UploadServer
vary
Accept-Encoding
x-goog-hash
crc32c=P2fgBQ==, md5=IwpC9BBrIFbFRmT73giztw==
x-goog-generation
1702930423872068
content-language
en
content-type
application/javascript
cache-control
public,max-age=3600
x-cache-hit
hit
x-goog-stored-content-length
32241
accept-ranges
bytes
cache-id
FRA-fa985ced
view
securepubads.g.doubleclick.net/pcs/ Frame A677 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuPRlI1xrnhgmW9yYcXHlkjIyvrkZkE_tAg3jpz8M3rdE84hvjO41s1abJZ6jCfzxBMO_eesLM9QA-4C-PLgmMFiNJfrgmJ5dU2GSklntscDgv9HNq1Lt7nJme1WflSD6OcITgeGB-Bn4OMKIJByec3W_CPfseyjcKHJprxenIvP_WFIlPpepk3SHLeAzKficOZPneMwH3mFnsGzw97USYJ5c3IRlht_Aykwlch41ymVh6Qina0w3BE9q-JhbCCY7QlaLpUfeXOGIng0jg4z6FQpXDvErOfiq6ohDxZ4qWUDDNNGMNb95koEZ5cNiXkCfTJllCMJx26aNd61E1yVKTOYQ3WnRHi-RH_AeHAs7fPfw8X7DcRXxynSlgrlWxZwI_VMk6P-dXlAPpuP3KYcpvepV7MtVj1y8PxBSR4&sai=AMfl-YRjGtJPs7Mbc9nce_RN7fdQlwticcHo4h3qXFc9ltm2X_rn6HM0qWfdYosGuj3m3NzFVYedibTeUeHlizopIfXVKnV3HCCj_NFnCqokwjnDcabz4Gwn-nB6cvREbUK4Ol6mEK2Hd6g0c_99-SBXpHWX&sig=Cg0ArKJSzEI_EGGkT10nEAE&uach_m=%5BUACH%5D&adurl=
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:34 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 23 Jan 2024 02:18:34 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20240118/r20110914/client/ Frame A677 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20240118/r20110914/client/window_focus_fy2021.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401180101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 22 Jan 2024 10:08:32 GMT
content-encoding
br
x-content-type-options
nosniff
age
58202
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 05 Feb 2024 10:08:32 GMT
ufs_web_display.js
www.googletagservices.com/activeview/js/current/ Frame A677 		206 KB
65 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401180101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
69c32d8650b1e5f0bcb76d787972b68a1ba327ea5bd8da7ab8ca1a04336735c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
66453
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1705495733332172"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 23 Jan 2024 02:18:34 GMT
8900631034824418145
tpc.googlesyndication.com/simgad/ Frame A677 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/8900631034824418145
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401180101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
aa7811ca51ac944fe3b5c4ea85e55892f9f776fd88e7abb159e5ad07fe4a016d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires
Thu, 16 Jan 2025 02:32:34 GMT
date
Wed, 17 Jan 2024 02:32:34 GMT
x-content-type-options
nosniff
age
517560
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
19121
x-xss-protection
0
last-modified
Mon, 15 Jan 2024 10:17:54 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons
true
truncated
/ Frame A677 		214 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b4c05d3d7ec885ca38bd223fe03246825f92c0eb1ca3a5b5bf1e3b423d0fd398

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type
image/png
collect
region1.analytics.google.com/g/ 		0
264 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-8VSXE5KKGM&gtm=45je41h0v898772242z878347448&_p=1705976313846&_gaz=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=896452633.1705976314&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1705976314&sct=1&seg=0&dl=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Fmacos-malware-targets-cracked-apps%2F&dt=New%20macOS%20Malware%20Targets%20Cracked%20Apps%20-%20Infosecurity%20Magazine&en=page_view&_fv=1&_ss=1&tfd=852
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-8VSXE5KKGM&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 23 Jan 2024 02:18:34 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.infosecurity-magazine.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/ 		0
255 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-8VSXE5KKGM&cid=896452633.1705976314&gtm=45je41h0v898772242z878347448&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-8VSXE5KKGM&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 23 Jan 2024 02:18:34 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.infosecurity-magazine.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-8VSXE5KKGM&cid=896452633.1705976314&gtm=45je41h0v898772242z878347448&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&z=327819459
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 23 Jan 2024 02:18:34 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/202308.2.0/ 		421 KB
101 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/202308.2.0/otBannerSdk.js
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ee39d0cbc9e9cd88b7dac8ebca680b89e8879081f855152f21772c7834474437
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 23 Jan 2024 02:18:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
B7RJGeSCnZZuAb1NQkB81w==
age
1274
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
103637
x-ms-lease-status
unlocked
last-modified
Wed, 20 Sep 2023 06:26:02 GMT
server
cloudflare
etag
0x8DBB9A2763B37CA
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
21d158e6-101e-007e-2a3b-eca9c4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
849c8bfbde3c193c-FRA
view
securepubads.g.doubleclick.net/pcs/ Frame DD5E 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssjkghVzI9SOC8FFJMHW_0SIlECnVKbeNxbtEaJmQcnFzwC1uj9WMHeKSvrC6jK4bnBOMBCktLYcppoySRJKERrkCpylEvVhIDuqhUycMqWpyaW0s8OV_DFypPOAFs8PFWoC2a0z78_56KnnPHgHLKU2NgyOulk4LB8NMo32suU-JQ1vo75pnalZHqmlSgHECRAk0ZS_bCBeI1l7fqn1mC09HOOfJoTYvuPAVV-if2RgIq8WT-jsftoCEFrpz5IID2wwY-e2GZo7nPAW7rP2-oibkmOynMCcYIpR_PBtHtBKzPPU1cj9zLtMhQ-p5ygexIuX21RDdhbOwf-ZxiPmXiUQoaJyUs6RXegiGBaEVVNBdeh7hZg6d2HVr9-Ips2uwvClHQZPSNsfxGZnn3kuwRelwNjj55J9I210FTB&sai=AMfl-YQi2I6rFGgygZ7kQB7fLZLiKGzYPD4u7LwptRSyX8waH4ZEbac7LCFbEW05iZnWGL7-Fc9dehKCVebVUwFszslhXhvX2W6YeKegQACUbBCHi8PpMS0R7fw7hNDTkA6UHHnoMTRAxqhoBoYC2F3d3_iT&sig=Cg0ArKJSzIa2qoXH6q_OEAE&uach_m=%5BUACH%5D&adurl=
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:34 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 23 Jan 2024 02:18:34 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20240118/r20110914/client/ Frame DD5E 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20240118/r20110914/client/window_focus_fy2021.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401180101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 22 Jan 2024 10:08:32 GMT
content-encoding
br
x-content-type-options
nosniff
age
58202
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 05 Feb 2024 10:08:32 GMT
ufs_web_display.js
www.googletagservices.com/activeview/js/current/ Frame DD5E 		206 KB
65 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401180101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
69c32d8650b1e5f0bcb76d787972b68a1ba327ea5bd8da7ab8ca1a04336735c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
66453
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1705495733332172"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 23 Jan 2024 02:18:34 GMT
1879232023555935293
tpc.googlesyndication.com/simgad/ Frame DD5E 		32 KB
32 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/1879232023555935293
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401180101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f14f606d6eaf3f4b815b26312f9438ad146701ccbd387b83d4b6f69217ba2b13
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires
Thu, 16 Jan 2025 02:38:01 GMT
date
Wed, 17 Jan 2024 02:38:01 GMT
x-content-type-options
nosniff
age
517233
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
32619
x-xss-protection
0
last-modified
Mon, 15 Jan 2024 09:45:19 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons
true
view
securepubads.g.doubleclick.net/pcs/ Frame 2E63 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstyZudwfIHoRR6TNTnYV_mu0xOrC1Xa68zIRvTY3tnHvr5IprRsShTumb6N8uoBFVNhlO-9_A7vF-OUeZONRIoFwiHOgJ_XH_9zUHiok4uwHUit1lkHt5Tfd2ZENi5FaHWZf9EM0v6BzExBLfowHG9u6cLEt-8W0fdcK5c9mNODwMfXbWr1khp_0DY_zZLxm1eiMTV8MQH9bs9cQ05P2jQR1bViD1c1kn0vMGfaf7461a_bzVY3pHkC-fNRC9RxLSoq1jVClIZuIOXB13umpu6z_FBt177DtwxvI6C_2V61mlV_Rmu5sTt--01256zffAelkva0PTmQ33ju68QAVn_gPM1NZszHaCvKxyy-Py1VWJwh2ipIPF0eyHofYQeR-L3m90XexSF1b8OtngX51RlL4CyRPMH3THkZBcWh&sai=AMfl-YR51-iOB1WGWOZejMTszLtHsb-KZ8W3sbG8qrjS5qqPZ_JMReRHNuRQs7ClMBWMxyVroh-5r5l1FmseReVASiORbwIfqLZ1ZcGTaCynrHcn3VqXBHB3a-FgGKsxXFQy90fVKuxWYtt2GiB2isyXC9T5&sig=Cg0ArKJSzLEWX5fDYEI0EAE&uach_m=%5BUACH%5D&adurl=
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:34 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 23 Jan 2024 02:18:34 GMT
8900631034824418145
tpc.googlesyndication.com/simgad/ Frame 2E63 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/8900631034824418145
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401180101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
aa7811ca51ac944fe3b5c4ea85e55892f9f776fd88e7abb159e5ad07fe4a016d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires
Thu, 16 Jan 2025 02:32:34 GMT
date
Wed, 17 Jan 2024 02:32:34 GMT
x-content-type-options
nosniff
age
517560
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
19121
x-xss-protection
0
last-modified
Mon, 15 Jan 2024 10:17:54 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons
true
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20240118/r20110914/client/ Frame 2E63 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20240118/r20110914/client/window_focus_fy2021.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401180101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 22 Jan 2024 10:08:32 GMT
content-encoding
br
x-content-type-options
nosniff
age
58202
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 05 Feb 2024 10:08:32 GMT
ufs_web_display.js
www.googletagservices.com/activeview/js/current/ Frame 2E63 		206 KB
65 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401180101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
69c32d8650b1e5f0bcb76d787972b68a1ba327ea5bd8da7ab8ca1a04336735c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
66453
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1705495733332172"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 23 Jan 2024 02:18:34 GMT
truncated
/ Frame DD5E 		211 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0077ab948d48c9f54f0e5e3873105d7e194fb1d0d625fbe2dd8d2ba694502a78

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 2E63 		208 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5f745ee083e836342b1cccc02b0cb37ae3f6f1397c841a1d29f64b48d11bb481

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type
image/png
adsct
t.co/i/ 		43 B
378 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/i/adsct?bci=1&eci=1&event_id=a45bd06c-e300-46a6-8375-dbad73850927&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=07ce9e57-5010-4178-85fb-6d163f86bf31&tw_document_href=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Fmacos-malware-targets-cracked-apps%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o7tzd&type=javascript&version=2.3.29
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.197 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-response-time
181
date
Tue, 23 Jan 2024 02:18:33 GMT
strict-transport-security
max-age=0
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
0ffbfab37deb3675
cache-control
no-cache, no-store, max-age=0
perf
7469935968
x-connection-hash
2bd18d15e5f7f348fb51a9b11c856570716b3b0c5a7cb3c7d645b32589b40a8f
content-length
43
adsct
analytics.twitter.com/i/ 		43 B
395 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://analytics.twitter.com/i/adsct?bci=1&eci=1&event_id=a45bd06c-e300-46a6-8375-dbad73850927&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=07ce9e57-5010-4178-85fb-6d163f86bf31&tw_document_href=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Fmacos-malware-targets-cracked-apps%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o7tzd&type=javascript&version=2.3.29
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-response-time
178
date
Tue, 23 Jan 2024 02:18:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
41a480a5903382d0
cache-control
no-cache, no-store, max-age=0
perf
7469935968
x-connection-hash
38d4b716e275c01fe813b313deefb126b157eb2ce8f7b32a024e4d288da7674e
content-length
43
utsync.ashx
ml314.com/ 		62 B
254 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=81370&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Fmacos-malware-targets-cracked-apps%2F&pv=1705976314237_qtts43zp7&bl=en-us&cb=173446&return=&ht=&d=&dc=&si=1705976314237_qtts43zp7&cid=&s=1600x1200&rp=&v=2.5.5.72
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
79.77.117.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 23 Jan 2024 02:18:34 GMT
via
1.1 google, 1.1 google
server
Google Frontend
content-type
application/javascript
p3p
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
0
ud.ashx
in.ml314.com/ 		20 B
482 B 		Script
General
Check archive.org
Download Go to
Full URL
https://in.ml314.com/ud.ashx?topiclimit=&cb=2302024&v=2.5.5.72
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.70.130.140 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-70-130-140.compute-1.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Tue, 23 Jan 2024 02:18:34 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public
Connection
keep-alive
Content-Length
138
Expires
Wed, 24 Jan 2024 02:18:34 GMT
en.json
cdn.cookielaw.org/consent/6b575081-117f-49ba-bff7-347875107505/2ca9783c-e3b0-47d5-889b-bd0759260e50/ 		51 KB
13 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/6b575081-117f-49ba-bff7-347875107505/2ca9783c-e3b0-47d5-889b-bd0759260e50/en.json
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c3e5ede41b753a0a4790584be6a9f296f37243b9cb3129a6cb8ccbce2a1a8257
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 23 Jan 2024 02:18:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
16634
content-md5
RjwReuRxecEXv85qdtvB+A==
content-length
13474
x-ms-lease-status
unlocked
last-modified
Fri, 08 Sep 2023 08:00:07 GMT
server
cloudflare
etag
0x8DBB0419E1A236F
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
b66d2c3d-501e-00a4-5992-133025000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
849c8bfc6d834d93-FRA
expires
Wed, 24 Jan 2024 02:18:34 GMT
580638648955413
connect.facebook.net/signals/config/ 		144 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/580638648955413?v=2.9.142&r=stable&domain=www.infosecurity-magazine.com
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
6b1a8b7c7c0e82019e478ac7fe789d6ab59987a686389859a0241d1f95a612a2
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

permissions-policy-report-only
autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy
default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Tue, 23 Jan 2024 02:18:34 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-xss-protection
0
reporting-endpoints
pragma
public
x-fb-debug
pm8jiN8o1Ezd/oiknY3SqfS0hs75mtpMlUBDoYEnmoaOCGwnzKUGcmsVXovzXwmu4tk7ccdT2LAk2vu2IJCOhA==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin
*
expires
Sat, 01 Jan 2000 00:00:00 GMT
js
www.googletagmanager.com/gtag/ 		234 KB
81 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-875375440
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d63d097628bb23826565f8a1b6e2a7a5b2bbfc85d82837e4f7dd68838b89f079
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:34 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
82571
x-xss-protection
0
last-modified
Tue, 23 Jan 2024 00:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 23 Jan 2024 02:18:34 GMT
otCenterRounded.json
cdn.cookielaw.org/scripttemplates/202308.2.0/assets/ 		9 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/202308.2.0/assets/otCenterRounded.json
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
09b627933e01faa4979dc5661f7e616c7db1c12ea1984ca0549bdb253d24da9b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 23 Jan 2024 02:18:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
lVxK9llV8eU2kvSDRI+c8w==
age
16633
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
2626
x-ms-lease-status
unlocked
last-modified
Wed, 20 Sep 2023 06:25:55 GMT
server
cloudflare
etag
0x8DBB9A272739A66
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
4b6cbf6a-601e-005b-0d3c-0d00b8000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
849c8bfccdda4d93-FRA
otPcCenter.json
cdn.cookielaw.org/scripttemplates/202308.2.0/assets/ 		62 KB
15 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/202308.2.0/assets/otPcCenter.json
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b78d22857981449097f8c6afcc0159c0c67d071d3ba92ded2386d0e09aac17f7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 23 Jan 2024 02:18:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
WCXObRDj43OZp6c5Nb0COw==
age
16633
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
15020
x-ms-lease-status
unlocked
last-modified
Wed, 20 Sep 2023 06:25:55 GMT
server
cloudflare
etag
0x8DBB9A2725CBA66
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
85e1f1f0-d01e-003c-2679-131044000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
849c8bfccddb4d93-FRA
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/202308.2.0/assets/ 		21 KB
4 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/202308.2.0/assets/otCommonStyles.css
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 23 Jan 2024 02:18:34 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
c7xAZ9MSGAobGaTYg/Qtag==
age
16633
x-ms-lease-status
unlocked
last-modified
Wed, 20 Sep 2023 06:26:05 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
7f4e21ce-f01e-0076-806e-22b3cb000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
849c8bfccddc4d93-FRA
view
securepubads.g.doubleclick.net/pcs/ Frame A677 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsveovId0iUESpEMWGt6TOzGfq0W56NbEcgUbN9x2bVZ3j-qSjrYkFgEDRKsm91JxFnBSC_sDcORKv-ZPyoM8UJV9Cipc2LZawnskGdsiKBoG39sTizrMkSGYm48zVb36MxksjZ1Hl3o9U6LadRZCaztzXNLwdUzG_4fDSb4cUN4kc0MrPdFCExrr2iWe3KxJXaAGm9CuILk4qlFJDN9WUXsKfe83ZmnUvboZkeWztcoSBEmMlfC4fhauwvPtqJ8piSk0PKm1iHH6t2uzbkWwi7lSJjVN2DSa48VxJ2ZF-F9ApbKXYKlT8lSd3TLLY_yqlXdictoFsqa2DuQ42gbUVI-tRFAr49m6li-9sij7LrLZUxZ5YHJQifeAYEJLf54OPrTkBhJ7f2ZzsRRnO0V4gxyLffeKh6klCi7F_3F5_w&sai=AMfl-YTg7h6z-Vjn7Ux3rIIi8hduorvLpswSOnMpxR3QhuPfvC-OxvBHv42yx5RWOJYmOKoleetNKw-WFpKXxe7gJD4_QTbjUh9g3mcP08mCM7iCzKWx9f-NrRrP5duHd7hQMBvtt1mPCEV-rfewk1aJS6sg&sig=Cg0ArKJSzDHYoQj_eiDOEAE&uach_m=%5BUACH%5D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:34 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 23 Jan 2024 02:18:34 GMT
rum.js
securepubads.g.doubleclick.net/pagead/js/ Frame A677 		65 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/js/rum.js
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d8a7c81e5addaa20d965ad0c095aad1f118c03679b388ec5a5dbbac38f149b7f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:05:57 GMT
content-encoding
br
x-content-type-options
nosniff
age
757
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
24629
x-xss-protection
0
server
cafe
etag
106683528911992433
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=3600
timing-allow-origin
*
expires
Tue, 23 Jan 2024 03:05:57 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame DD5E 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsujpED4Ni1qx1GiapWVMwTewIYTy3ZhUAYYbZf9aG7qzFlHvwnLBTMwgp8gEziql5O6G2oduMJ1emIdiTWkaUtsR2rIvdn2zSXZzfSWZuVPLJRv6Yp1eouYv1pkQeim81wXKWnvKg1S5dG5ONyFvWFKGYV1BA46pUCP0WwnLbL88rucM6ziwZtNM3LUGQaeNxLHPWHSXqAnnsA977E8duDvlLcNffY4Gw-AFPWMJqOxO_0TULs6-P0rO-LjqXqmTBXsLn5IfPiqpLLPJx2V8CwDekW9IZ1zAu7KeLATZlbeo6aOhOUg3CAYVNHr8bfCgq7XP81ew7bEvzihWqr595kh1VHEBU_bBfg2P_DJLtSUgr1GZmeOUyE5Jh64_vDIXeQao922fMkV_uS7LHrsYPLJJ10qcFfsQGgV-0bs1Zs&sai=AMfl-YQmXE-WhvB4vTqBDjrV_2tSFcK2MF6MthbeEGawRypIKuJjT2Iuc--ReeZxzA6sVoBruJUY5tkrFrAcaKdiFpqA6_BCZo1_VL2tgfumENq-qFhfOeGw9BfnBbBD7gDx5HXQtiIZmYtLsH1LiVqut5HT&sig=Cg0ArKJSzJoi4XuVufRpEAE&uach_m=%5BUACH%5D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:34 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 23 Jan 2024 02:18:34 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 2E63 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu1unRLQG5T4Ay_0b43LW_05ti8u68koI8fDu01_T6Sv9d3BA20ueY4jqoEVDD2Wo0ndKuTPc1kqblQq2FX7dt6kzd323_uTp8B-ZgnWFGc4aaTKbL2K2VtjW-9LZIkd_1yJoLn-QHBycJNnDWJNX7yEVaIntLNjiyM0gBaV56OXRoGXjjNo9cyldhpXqB5cJ8KZDvx6EoMcFzX6Rlvx-7_61WdbmjPad6Yp5UjjIaPk6U4jAS2JDRf5BR8QPt9k_FkSoQmrEDlos5mjRYYT8QDtDn2W7jpbqW9yBnZLXpkt-yY8r7olTICk1ndAsFB5GVs35CZnWECwb9IHdELOqF6JDswgc9H3aepnWYhNjZduS91IKwnKwDhQbATfdVrNz9P66dzmaLEyUCxSCa3ZeqU2J0_MIs-0Zz8R3H79QU&sai=AMfl-YQvFWA8goGjnpzj9jBTtIdCbsPjmBKFwXkQE1LvQo9Wt94OqCOyo9i1KKWJIysTeSkfYHEmtUI5u04FqqoiiX9wGDJPpJAN-Q0lB5IKqYmUip2kAuC7p6rEACZscZDxbfMYtjluEiGJTq6VQNglxG5l&sig=Cg0ArKJSzJ9--yzgl2f_EAE&uach_m=%5BUACH%5D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:34 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 23 Jan 2024 02:18:34 GMT
rum.js
securepubads.g.doubleclick.net/pagead/js/ Frame DD5E 		65 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/js/rum.js
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d8a7c81e5addaa20d965ad0c095aad1f118c03679b388ec5a5dbbac38f149b7f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:05:57 GMT
content-encoding
br
x-content-type-options
nosniff
age
757
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
24629
x-xss-protection
0
server
cafe
etag
106683528911992433
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=3600
timing-allow-origin
*
expires
Tue, 23 Jan 2024 03:05:57 GMT
/
www.facebook.com/tr/ 		0
185 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=580638648955413&ev=PageView&dl=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Fmacos-malware-targets-cracked-apps%2F&rl=&if=false&ts=1705976314492&sw=1600&sh=1200&v=2.9.142&r=stable&a=tmgoogletagmanager&ec=0&o=4126&fbp=fb.1.1705976314491.2147208293&cs_est=true&ler=empty&it=1705976314301&coo=false&rqm=GET
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Tue, 23 Jan 2024 02:18:34 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
rum.js
securepubads.g.doubleclick.net/pagead/js/ Frame 2E63 		65 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/js/rum.js
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d8a7c81e5addaa20d965ad0c095aad1f118c03679b388ec5a5dbbac38f149b7f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:05:57 GMT
content-encoding
br
x-content-type-options
nosniff
age
757
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
24629
x-xss-protection
0
server
cafe
etag
106683528911992433
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=3600
timing-allow-origin
*
expires
Tue, 23 Jan 2024 03:05:57 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/875375440/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/875375440/?random=1705976314507&cv=11&fst=1705976314507&bg=ffffff&guid=ON&async=1&gtm=45be41h0v892578457&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Fmacos-malware-targets-cracked-apps%2F&hn=www.googleadservices.com&frm=0&tiba=New%20macOS%20Malware%20Targets%20Cracked%20Apps%20-%20Infosecurity%20Magazine&auid=483163222.1705976315&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
5bcbd2d94a260d6415c494b3380be71a196eda9882862ed4bc2066c4a220a292
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 23 Jan 2024 02:18:34 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1332
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame A677 		0
234 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~lrpq90ux&chm=1&c=1319515112026595&ctx=2&qqid=CJqxyYG58oMDFTQlVQgdXyQBKA&met.4=fb.8~lb.b~ol.7n~idt.95~dt.-2u&met.1=1.lrpq90kv~14.0~15.0~16.0~17.0~18.0~19.1~20.1~21.1~22.j~23.j&met.7=CBsQCDgB~CCIQBBgBIAooCjBWOEtoC3BVeKwCsAEBuAED~CB4QChgBIAsoCzCaATiQAWhwcJkBeIAMgAHUCYgBgRWwAQG4AQM~CFEQChgBIAsoCzDuATjjAVARWGdgOGhncJYBeMGJBIABlYcEiAGI7QywAQG4AQM~CBcQBhgBIAwoDDDCATi3AVAZWHBgQmhwcJwBeN2XAYABsZUBiAGxlQGwAQG4AQM~CCgQChgBIJUCKJUCML8COCtolQJwvAJ44cIBgAG1wAGIAYSFBLABAbgBAw&met.3=113.a3_2~112.a2_3
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4002:809::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 23 Jan 2024 02:18:34 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame DD5E 		0
54 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~lrpq90v6&chm=1&c=1319515112026595&ctx=2&qqid=CLu9yYG58oMDFU4fVQgdnBcPPw&met.4=fb.4~lb.5~ol.7i~idt.7z~dt.-40&met.1=1.lrpq90lz~14.0~15.0~16.0~17.0~18.0~19.0~20.0~21.0~22.z~23.z&met.7=CBsQCDgB~CCIQBBgBIAQoBDBPOEtoBXBOeKwCsAEBuAED~CB4QChgBIAQoBDB1OHBoSXB0eIAMgAHUCYgBgRWwAQG4AQM~CFEQChgBIAUoBTDgATjbAWg_cLcBeMGJBIABlYcEiAGI7QywAQG4AQM~CBcQBhgBIAUoBTDBATi8AWhJcKsBeJeBAoAB6_4BiAHr_gGwAQG4AQM~CCgQChgBIKACKKACMMsCOCpooQJwxwJ44cIBgAG1wAGIAYSFBLABAbgBAw&met.3=113.98~112.97_1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4002:809::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 23 Jan 2024 02:18:34 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csi
csi.gstatic.com/ Frame 2E63 		0
54 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~lrpq90vl&chm=1&c=1319515112026595&ctx=2&qqid=CI-wyYG58oMDFeowVQgdpM8N9w&met.4=fb.5~lb.6~ol.7m~idt.7h~dt.-4i&met.1=1.lrpq90mc~14.0~15.0~16.0~17.0~18.0~19.0~20.0~21.0~22.m~23.m&met.7=CBsQCDgB~CCIQBBgBIAYoBjBSOExoBnBReKwCsAEBuAED~CB4QChgBIAYoBjBmOGBoO3BleIAMgAHUCYgBgRWwAQG4AQM~CBcQBhgBIAYoBjCdATiXAWg7cI0BeN2XAYABsZUBiAGxlQGwAQG4AQM~CFEQChgBIAYoBjDgATjaAWgycMsBeMGJBIABlYcEiAGI7QywAQG4AQM~CCgQChgBIJ8CKJ8CMM0COC5onwJwxgJ44cIBgAG1wAGIAYSFBLABAbgBAw&met.3=113.9a~112.9a
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4002:809::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 23 Jan 2024 02:18:34 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/875375440/ 		42 B
455 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/875375440/?random=1705976314507&cv=11&fst=1705975200000&bg=ffffff&guid=ON&async=1&gtm=45be41h0v892578457&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Fmacos-malware-targets-cracked-apps%2F&frm=0&tiba=New%20macOS%20Malware%20Targets%20Cracked%20Apps%20-%20Infosecurity%20Magazine&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_cAqpLVy_63HmRJYHCp_Vh4v1G8H5rV7J0l9_bFKZPJWpl88G&random=1022228009&rmt_tld=0&ipr=y
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 23 Jan 2024 02:18:34 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/875375440/ 		42 B
154 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/875375440/?random=1705976314507&cv=11&fst=1705975200000&bg=ffffff&guid=ON&async=1&gtm=45be41h0v892578457&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Fmacos-malware-targets-cracked-apps%2F&frm=0&tiba=New%20macOS%20Malware%20Targets%20Cracked%20Apps%20-%20Infosecurity%20Magazine&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_cAqpLVy_63HmRJYHCp_Vh4v1G8H5rV7J0l9_bFKZPJWpl88G&random=1022228009&rmt_tld=1&ipr=y
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 23 Jan 2024 02:18:34 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ 		0
121 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=gpt_pgbrk&pvsid=1319515112026595&vrg=202401180101&nw_id=1165&nslots=4&eid=31079724%2C44777897%2C31079527%2C676982961%2C31061691%2C31061692&pub_url=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Fmacos-malware-targets-cracked-apps%2F&qid=CLu9yYG58oMDFU4fVQgdnBcPPw&iu=%2F1165%2Frx_infosecurity_magazine%2Fnews%2Fmacos-malware-targets-cracked-apps&e=0&ret=300x250&req=300x250&bm=0&efh=1&stk=0&ifi=3
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 23 Jan 2024 02:18:34 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
nr-spa-1216.min.js
js-agent.newrelic.com/ 		49 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/nr-spa-1216.min.js
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
545156adeae44dadc82b98d504f805ebe77fb79c928ef34eed1057bb9d4cb8fe
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-amz-version-id
MElzWumrf8lREc3kORDlSWHVtEZAK4m8
content-encoding
br
via
1.1 varnish
date
Tue, 23 Jan 2024 02:18:34 GMT
strict-transport-security
max-age=300
x-amz-request-id
TY9JRGV4PP0WZF1F
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
19141
x-amz-id-2
hEx4r1hU0Wtc9uyNqrGzlfmOtUja5/eGieVcA+fwEhwWqw6lxZH8PA35IqgTThXsiATCjwG/mzc=
x-served-by
cache-fra-etou8220055-FRA
last-modified
Wed, 18 Oct 2023 21:31:16 GMT
server
AmazonS3
x-timer
S1705976315.895526,VS0,VE0
etag
"63e2df852d15ab21d7ff8fc4363222e8"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges
bytes
x-cache-hits
91931
sodar
pagead2.googlesyndication.com/getconfig/ 		16 KB
12 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202401180101&st=env
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
84264d36fefbf53c2ce379dbd89b677e86886e745f6875d9d4df3fa070bf21dd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:34 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
12275
x-xss-protection
0
RX_Logo_-_primary_logo_for_everyday_use.png
cdn.cookielaw.org/logos/c7f35e9f-bc78-43c8-9f0e-7cd83009704c/d5d2d0ac-164a-4501-8141-3a264a81333e/95f66c83-9442-43f5-9fb4-8a136c33442a/ 		51 KB
51 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.cookielaw.org/logos/c7f35e9f-bc78-43c8-9f0e-7cd83009704c/d5d2d0ac-164a-4501-8141-3a264a81333e/95f66c83-9442-43f5-9fb4-8a136c33442a/RX_Logo_-_primary_logo_for_everyday_use.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
279b6c8b97bfb37476d6d075d1431d85a380ca36ebe6af4146844cfb135c21d6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 23 Jan 2024 02:18:34 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
yxwPB4FKahj/CgrZY2+Gbg==
age
52039
content-length
52319
x-ms-lease-status
unlocked
last-modified
Mon, 02 Aug 2021 09:46:17 GMT
server
cloudflare
etag
0x8D9559A5FD49D88
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
1174c535-401e-004c-1219-15a9b3000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
849c8bffa868193c-FRA
powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.cookielaw.org/logos/static/powered_by_logo.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:82ec , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 23 Jan 2024 02:18:34 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
Y+c301RBZNK39PvKQWrIBw==
age
23755
x-ms-lease-status
unlocked
last-modified
Thu, 18 Jan 2024 03:30:18 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
a69a7916-701e-0068-7ac2-495f13000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
849c8bffa86a193c-FRA
gen_204
pagead2.googlesyndication.com/pagead/ 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_stats&su=www.infosecurity-magazine.com&doc=complete&pg_h=3015&pg_w=1600&pg_hs=3015&c=3&aa_c=0&av_h=143.333&av_w=585.333&av_a=68680&s=42.016&all_s=42.016&b=1823&all_b=1823&d=0.143&all_d=0.143&ard=0.043&all_ard=0.043&dt=d
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 23 Jan 2024 02:18:34 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
NRJS-70b3f9b2c6f17cc4471
bam.eu01.nr-data.net/1/ 		56 B
550 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bam.eu01.nr-data.net/1/NRJS-70b3f9b2c6f17cc4471?a=241052313&v=1216.487a282&to=MhBSZQoZXxEDUkdRWQtacWIoV0UHD0FfWUIABh9GHRpBAwVUHVlFFQ0%3D&rst=1587&ck=1&ref=https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/&ap=17&be=246&fe=1457&dc=529&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1705976313340,%22n%22:0,%22f%22:0,%22dn%22:10,%22dne%22:10,%22c%22:10,%22s%22:49,%22ce%22:169,%22rq%22:169,%22rp%22:224,%22rpe%22:228,%22dl%22:226,%22di%22:529,%22ds%22:529,%22de%22:529,%22dc%22:1457,%22l%22:1457,%22le%22:1467%7D,%22navigation%22:%7B%7D%7D&fp=532&fcp=532&jsonp=NREUM.setToken
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.221.87.23 , Ireland, ASN54113 (FASTLY, US),
Reverse DNS
Software
istio-envoy /
Resource Hash
1b1e54380b8b8e45010115f3d0f7caad60ca0f34be8bee3e11e11727cc64d49f

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:35 GMT
server
istio-envoy
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
content-type
text/javascript
access-control-allow-origin
*
access-control-allow-credentials
true
x-envoy-upstream-service-time
4
cross-origin-resource-policy
cross-origin
Connection
keep-alive
Content-Length
56
x-served-by
cache-fra-etou8220098-FRA
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 23 Jan 2024 02:18:34 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame E99A 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
58128
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 22 Jan 2024 10:09:47 GMT
expires
Tue, 21 Jan 2025 10:09:47 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame 7F63 		829 B
982 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
a468a35fd6723a60e3c1e95862635d5ef76774edbabe63c9a028a321ec1cfb78
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-3v4a7Nf8h7MrA-DimBDLKQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-3v4a7Nf8h7MrA-DimBDLKQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 23 Jan 2024 02:18:35 GMT
expires
Tue, 23 Jan 2024 02:18:35 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js
pagead2.googlesyndication.com/bg/ Frame E99A 		39 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Mon, 22 Jan 2024 10:08:32 GMT
content-encoding
br
x-content-type-options
nosniff
age
58203
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15219
x-xss-protection
0
last-modified
Mon, 15 Jan 2024 09:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 21 Jan 2025 10:08:32 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame 7F63 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202401180101&jk=1319515112026595&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers
NRJS-70b3f9b2c6f17cc4471
bam.eu01.nr-data.net/resources/1/ 		36 B
369 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bam.eu01.nr-data.net/resources/1/NRJS-70b3f9b2c6f17cc4471?a=241052313&v=1216.487a282&to=MhBSZQoZXxEDUkdRWQtacWIoV0UHD0FfWUIABh9GHRpBAwVUHVlFFQ0%3D&rst=1746&ck=1&ref=https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/&st=1705976313340
Requested by
Host: www.infosecurity-magazine.com
URL: https://www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.221.87.23 , Ireland, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
08fe3d3f743de15d179d4e34f8e5e4ac471d6d297d5abc11d750bf82d94718c4

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
content-type
text/plain

Response headers

date
Tue, 23 Jan 2024 02:18:35 GMT
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
content-type
text/plain
access-control-allow-origin
https://www.infosecurity-magazine.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
36
x-served-by
cache-fra-etou8220098-FRA
generate_204
tpc.googlesyndication.com/ Frame E99A 		0
10 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?hchdKA
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 02:18:35 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
activeview
pagead2.googlesyndication.com/pcs/ Frame A677 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst4GF7REY2rAM7_HrmHLwtJrmcI7b3_PFt83xaVwJ-7wYOJx9efQDVqnstdvUgf7D6RmQmCjslEfXG9ZS2APhQJvPXZRdcQ4Dm-t2B_94jJUiQ993gZGAcvnyY3_oWizPIdN2ILBEmPvljEZ1BfnSBI0w&sig=Cg0ArKJSzCU1eqtm0aZ5EAE&id=lidar2&mcvt=1000&p=1102,436,1192,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20240117&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=2433805320&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1705976314159&rpt=270&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 23 Jan 2024 02:18:35 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame DD5E 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv_g4QKhJ2hxoyIALcMay3Jerh6o7IRPNaiuUdxc3njySG64Gcqgdvu7WSIck3q6rGcbGI3YKHyVEyR7h7jya5gRuUveLEUY_5pfuXFgrjOvYrGHpgJ9AsO9HAVRhi2Vddkjj4nQyajnMoy-dAzH16tEQ&sig=Cg0ArKJSzIlCk62VY1oeEAE&id=lidar2&mcvt=1000&p=809,1046,1059,1346&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20240117&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=917848018&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1705976314199&rpt=266&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 23 Jan 2024 02:18:35 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 2E63 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuxdkTDlejt4iXWH8aBmQglzEh66FpRNJsJ_HFXAk9GXJ0NAYpzbcSFrzC3e1GGeEqSaThLm4sqtvXMUtINPJQJ0hjcWJR1GZxXsOhFWc6-iMU7Kdi47Xj1chODZ93Gs-z_pzfONfoIrXc8Be79F7zcGg&sig=Cg0ArKJSzBZlBIrVDwT2EAE&id=lidar2&mcvt=1000&p=8,436,98,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20240117&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=745914674&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1705976314212&rpt=271&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 23 Jan 2024 02:18:35 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/pagead/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202401180101&jk=1319515112026595&bg=!mJulm9TNAAa8BdJLnAU7ADQBe5WfOFv51wxLqiWfTIZM62DFbaZ8ntaB489aWgSHJyeElTnaWLI-sQuOvMIamkahysYDAgAAADBSAAAAAmgBBwoAngwxZwALH1jNGL4pfhHytTbCx63cy53R3H9UHAypiAdhtueZgjKPa0Lf2gQ6ovLUy2U6kiNWiwxpHSmqMaV6dpjebxl0d7RvBb47OlHmnWTzT3nfehiWmqj8z79mOZyB7Q0qylPQSwmPAtOZHqKkfg_bBT7jXwh1Wo3KqqF23AcHwDUTYw4kucjMBFqBipmx3CFbJfbIovS3sR1SHwxDmQKosh8zyskz83Wl3loaX5zG14q1mZmjrlh_UiGjABuH4xzAe8bqlhf6CPfrEk2yXWAz2O4Xa7c8MomuSB0ci7Sb2HAl8xqrRBFGmBKnwMvGa4x97sEyrgHbugSZY91otBubx2YVsUKfIxtmO0Hg3ez4L_GOcIHk3YtRENN7InZ-Wnkz9l5tytQJPSpxjx4s1fkI6MxS6rTmAx9V_-VeOJfMBCIn4yqEQjZYAQ0pS6PdPxUmaPRaS_9BLawFB6UJGWFqM4nFBnohbmO4xF3GuqylFCVIRCxtKiQQzM_5uDU_zaLCsBIa_OGdInJWuguSQwlyeGh3pgosABhk9hDBPw3lYvPj5wPhTJvUOzspII7zCisqjActNJIVXicSibNRVgeRIygcQzlzLa8NK_Tmt4Vyn518flwFIzj29nchhE2EFvFEPgIVw4iCNtUqFMRwu4zx16bv9Iej7tw34Pq7VvNGrIvRTgy0RmutWhDSbgmwT_wod92nRquwA39WM5dOUFM1fsZFN0N5pciPS7aqJEHF5IjVGkJgg0RG367pbmVZr98VjmP-oDsSzZw3Z2NFSiBPA-gHIL_WoD3FgikTDv3t0lnqaAEzJc8B8-OqGAfM4qUAeE_Dyyu963hfj2cD3rix6agBRAxunh-sMtEDQlEtTrhsWdnB3s38WIh5BnLA0PLyLiWriyYdf41w6eSPpySaIMNcZiFpVA_nSoh60oz2gGasiZoF77Sst7_h0e-yCs3stfz9C5OTgbKe3BIq9JuPXHhQ5DD29xBa3qctvZ6Q5NE--xtklGTER6MKEbmv8idRbCWg67T70iQKBrIJRQVvPaRUgPnEuf-sO8S0FRwsGMz4c83IlgyvsDcmNDegHKEm45LpNpmoFvz5geqfHDAbEyJDAntBXoc
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers
csi
csi.gstatic.com/ 		0
54 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=1~lrpq90mv&c=1319515112026595&e=31061691%2C31061692&ctx=1&met.9=1.el~2.i9~13.jb~9.0~9.0~9.0~3_5.jy~3_14.jy~3_23.jy~7_5.0~7_14.0~7_23.0~4_23.mk~5_23.mq~6_23.ms~4_14.nr~5_14.nu~6_14.nv~4_5.o1~5_5.o7~6_5.o8&met.10=1_1.CAAQABgAIKoFKAA~1_2.CAAQABgAIKoFKAA~1_3.CAAQABgAIKoFKAA~1_5.CJh1EJh1GICYdSC3BSgB~1_14.CPjJBBD4yQQYgJh1ILcFKAE~1_23.CJh1EJh1GICYdSC3BSgB~1_4.CAAQABiAmHUgtwUoAQ&met.3=112.or_1~113.14s_1&met.1=1.lrpq8zy4~6.0~7.a~8.a~9.a~10.4p~11.1d~12.4p~13.68~14.6c~15.6a~16.ep~17.ep~18.ep~19.14h~20.14h~21.14r~22.et~23.et&qqid.3=CJqxyYG58oMDFTQlVQgdXyQBKA&qqid.2=CLu9yYG58oMDFU4fVQgdnBcPPw&qqid.1=CI-wyYG58oMDFeowVQgdpM8N9w
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/rum.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4002:809::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 23 Jan 2024 02:18:35 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

71 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| NREUM object| newrelic function| __nr_require object| dataLayer object| OneTrustStub function| OptanonWrapper function| $ function| jQuery string| GoogleAnalyticsObject function| ga object| sharelink number| webpageId object| prevalErrors undefined| obj undefined| error undefined| control string| gptZone object| gptTopics function| _ boolean| isFlyoutMenu boolean| isFlyoutOpen string| tabbableElements undefined| activeMegaDropdown function| openFlyout function| closeFlyout function| openMegaDrop function| closeMegaDrop function| megaDropFocusOutside function| saveResponse function| equalHeights function| moveToAnchor function| scrollToTop function| highlightNavigation object| googletag object| ggeac object| google_tag_data object| google_js_reporting_queue object| ism object| gaplugins object| gaGlobal object| gaData boolean| google_measure_js_timing object| google_rum_config number| google_unique_id object| google_tag_manager function| fbq function| _fbq object| _ml undefined| google_timing_params function| onYouTubeIframeAPIReady string| OnetrustActiveGroups string| OptanonActiveGroups object| otStubData number| google_srt object| _google_rum_ns_ object| regeneratorRuntime object| twttr object| Optanon object| OneTrust function| gtag object| GooglebQhCsO object| google_image_requests undefined| google_rum_values object| GoogleGcLKhOms

14 Cookies

Domain/Path Name / Value
www.infosecurity-magazine.com/news/macos-malware-targets-cracked-apps Name: ISM.ScreenSize
Value: 1600
.infosecurity-magazine.com/ Name: _gid
Value: GA1.2.2019424479.1705976314
.infosecurity-magazine.com/ Name: __eoi
Value: ID=6686200efa60bf6f:T=1705976314:RT=1705976314:S=AA-AfjaBvKk3GpA1BIggWLUt-biU
.infosecurity-magazine.com/ Name: _ga_8VSXE5KKGM
Value: GS1.1.1705976314.1.0.1705976314.60.0.0
.infosecurity-magazine.com/ Name: _ga
Value: GA1.1.896452633.1705976314
.infosecurity-magazine.com/ Name: __gads
Value: ID=9659f8d8b5d59d02:T=1705976314:RT=1705976314:S=ALNI_MYaN5KPjMJc24CZYL653__sFHDUTQ
.infosecurity-magazine.com/ Name: __gpi
Value: UID=00000d47b772fb5d:T=1705976314:RT=1705976314:S=ALNI_MbxQq9D-FviSKTt-38HfaOBYlhXtQ
.doubleclick.net/ Name: IDE
Value: AHWqTUn6BEMZx5yOkg0CVb3TqK8krGhA2sEHxQHk0wvOKJuMSdcEM_AaktMNYmpKu1M
.infosecurity-magazine.com/ Name: _fbp
Value: fb.1.1705976314491.2147208293
.infosecurity-magazine.com/ Name: _gcl_au
Value: 1.1.483163222.1705976315
.twitter.com/ Name: personalization_id
Value: "v1_MzYI7EFCm82lpaNa3wx6jA=="
.t.co/ Name: muc_ads
Value: d8c6f305-7f0f-487b-8297-eb184023e995
.infosecurity-magazine.com/ Name: OptanonConsent
Value: isGpcEnabled=0&datestamp=Tue+Jan+23+2024+03%3A18%3A34+GMT%2B0100+(Central+European+Standard+Time)&version=202308.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=cc58bbd2-7eb9-44fd-b3da-8b50e9f1bf3a&interactionCount=0&landingPath=https%3A%2F%2Fwww.infosecurity-magazine.com%2Fnews%2Fmacos-malware-targets-cracked-apps%2F&groups=1%3A1%2C2%3A0%2C3%3A0%2C4%3A0
.nr-data.net/ Name: JSESSIONID
Value: 76587a7d5fa9c0f9

20 Console Messages

Source Level URL
Text
security warning
Message:
Error with Feature-Policy header: Unrecognized feature: 'ambient-light-sensor'.
security warning
Message:
Error with Feature-Policy header: Unrecognized feature: 'battery'.
security warning
Message:
Error with Feature-Policy header: Unrecognized feature: 'document-domain'.
security warning
Message:
Error with Feature-Policy header: Unrecognized feature: 'encrypted-media:'.
security warning
Message:
Error with Feature-Policy header: Unrecognized feature: 'execution-while-not-rendered'.
security warning
Message:
Error with Feature-Policy header: Unrecognized feature: 'execution-while-out-of-viewport'.
security warning
Message:
Error with Feature-Policy header: Unrecognized feature: 'layout-animations'.
security warning
Message:
Error with Feature-Policy header: Unrecognized feature: 'legacy-image-formats'.
security warning
Message:
Error with Feature-Policy header: Unrecognized feature: 'navigation-override'.
security warning
Message:
Error with Feature-Policy header: Unrecognized feature: 'oversized-images'.
security warning
Message:
Error with Feature-Policy header: Unrecognized feature: 'speaker-selection'.
security warning
Message:
Error with Feature-Policy header: Unrecognized feature: 'web-share'.
security warning
Message:
Error with Feature-Policy header: Some features are specified in both Feature-Policy and Permissions-Policy header: accelerometer, autoplay, camera, display-capture, fullscreen, geolocation, magnetometer, microphone, midi, payment, picture-in-picture, publickey-credentials-get, sync-xhr, usb, xr-spatial-tracking. Values defined in Permissions-Policy header will be used.
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'ambient-light-sensor'.
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'battery'.
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'document-domain'.
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'execution-while-not-rendered'.
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'execution-while-out-of-viewport'.
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'navigation-override'.
security warning
Message:
Error with Permissions-Policy header: Unrecognized feature: 'web-share'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src * data: 'unsafe-inline' 'unsafe-eval'; upgrade-insecure-requests; block-all-mixed-content
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4c51ab793f263c762ac517b3379a19a9.safeframe.googlesyndication.com
analytics.twitter.com
assets.infosecurity-magazine.com
bam.eu01.nr-data.net
cdn.cookielaw.org
cdn.jsdelivr.net
connect.facebook.net
csi.gstatic.com
geolocation.onetrust.com
googleads.g.doubleclick.net
in.ml314.com
js-agent.newrelic.com
ml314.com
p.typekit.net
pagead2.googlesyndication.com
region1.analytics.google.com
securepubads.g.doubleclick.net
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tpc.googlesyndication.com
use.typekit.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.infosecurity-magazine.com
104.244.42.195
104.244.42.197
13.32.99.67
146.75.116.157
151.101.194.137
18.165.183.115
185.221.87.23
2001:4860:4802:32::36
2606:4700:4400::6812:2089
2606:4700::6810:5514
2606:4700::6812:82ec
2a00:1450:4001:802::2001
2a00:1450:4001:80b::2002
2a00:1450:4001:80e::2002
2a00:1450:4001:813::2002
2a00:1450:4001:813::2008
2a00:1450:4001:81c::2002
2a00:1450:4001:829::2001
2a00:1450:4001:829::2004
2a00:1450:4001:82b::2003
2a00:1450:4001:82b::200e
2a00:1450:4002:809::2003
2a00:1450:400c:c00::9c
2a02:26f0:3500:16::215:1495
2a02:26f0:480:f::213:7ec6
2a03:2880:f083:100:face:b00c:0:3
2a03:2880:f176:181:face:b00c:0:25de
34.117.77.79
52.70.130.140
0077ab948d48c9f54f0e5e3873105d7e194fb1d0d625fbe2dd8d2ba694502a78
07ac84596d158248a60c2f747f609a508e6e2f1980a23f0608caee79a30291b7
08fe3d3f743de15d179d4e34f8e5e4ac471d6d297d5abc11d750bf82d94718c4
09b627933e01faa4979dc5661f7e616c7db1c12ea1984ca0549bdb253d24da9b
09ddaf1d1202b5fc93ba151c407e0048b2dd605d8843679a5ec8e070e79a254b
0ea356cd6846f263b1b34b57486b13499100ebdf3bbb9dca20f9d848756e1a6e
1b1e54380b8b8e45010115f3d0f7caad60ca0f34be8bee3e11e11727cc64d49f
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
26c1017967b3f4b73858404614486f1a0eff798f5a9194d95c7f120ebba0e932
279b6c8b97bfb37476d6d075d1431d85a380ca36ebe6af4146844cfb135c21d6
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
4ca1e0e518aaf5d78abd4fc78268ac642cb679dbb56a905d2c57a296566a0bba
4e916eb59cd64cce6fc41e3355180f0284ae0edc2602686431e90f2e7f082652
4f8059cfd6739160b9073e937833a58c728a9791b380f27fcf2d047d76951155
53fc4495c7705b2373e2b73ec881c82dffb40cfbd744d8e5bd8ba7f5a018575b
54286278818bb04c87dbe23a2794cdc8bb17948e151dd1a20b5e0f09fb764d3e
545156adeae44dadc82b98d504f805ebe77fb79c928ef34eed1057bb9d4cb8fe
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1
5bcbd2d94a260d6415c494b3380be71a196eda9882862ed4bc2066c4a220a292
5dd0b5724f4bbac4bd58de274236fce36135ce302364b3b8ff5c4c3631e81139
5e6db47873ee776b0d0bdc582bf73125e937097d2d385926ed27c61e8b623d25
5f745ee083e836342b1cccc02b0cb37ae3f6f1397c841a1d29f64b48d11bb481
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
5feafebfc5a89cdf7aaec3520d7d43e5ec43456fac12ecf8bdb9c32902766c9e
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
69c32d8650b1e5f0bcb76d787972b68a1ba327ea5bd8da7ab8ca1a04336735c0
6b1a8b7c7c0e82019e478ac7fe789d6ab59987a686389859a0241d1f95a612a2
778f93243401b2fd6663834b51f4d3f32012d6ee11f40f6169af721331bd1682
84264d36fefbf53c2ce379dbd89b677e86886e745f6875d9d4df3fa070bf21dd
85b50ffe6b0cb56f765532dbac925599ddd984fcaefb0e2590099105dbd044da
8b2881eb9a5f29bd9fcb54b4ce18ce1a54937c31c441c01acbd868f7b8b09e50
95ccfe8ac8d7118cd5b9336476eb36a0fbaebefda7bf822c6450d29a79f6ba91
98bc0753b3f7392176a4af252bfae9bcd1f2804b73dee374119899d8f52ae3d2
9df688d410bb3459acdeb1f1400c485cfb167ce9d4fe06fcd2b877e9f65d6fa2
a45a4393f8b7ac978e32ac46f58dad43eb83811a4b3d9f7b79cac1f864edd662
a468a35fd6723a60e3c1e95862635d5ef76774edbabe63c9a028a321ec1cfb78
aa7811ca51ac944fe3b5c4ea85e55892f9f776fd88e7abb159e5ad07fe4a016d
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae293d258c9169bb80f8721f9d641118116f64f8d856d8ebaad36d53c8fe5afb
b2fe03efc1e879c2c5bd27bf86f71ad3790b0d6765498480f4c8071fa7f59051
b4c05d3d7ec885ca38bd223fe03246825f92c0eb1ca3a5b5bf1e3b423d0fd398
b78d22857981449097f8c6afcc0159c0c67d071d3ba92ded2386d0e09aac17f7
bb20d24b99fd1eae4fd77c1e833ce0a4536189961ceb1114fd272ca31e8ebd82
c08e633b39381743b6e6bca9c5922e9aa9ba5f3044c29031b0076a47b4af1927
c3e5ede41b753a0a4790584be6a9f296f37243b9cb3129a6cb8ccbce2a1a8257
cbe5296bf61f4ee88ecab204fe1ec3a144660caa32b71d9744f01102286df62a
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec
d63d097628bb23826565f8a1b6e2a7a5b2bbfc85d82837e4f7dd68838b89f079
d7800992c70337710a800628bad888bebad0a275102de46a3370179e373c034b
d8a7c81e5addaa20d965ad0c095aad1f118c03679b388ec5a5dbbac38f149b7f
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ecde3c0d9f4721fd5bc3989d1e6103966b836786849f65ead031a1c758687ef0
ee39d0cbc9e9cd88b7dac8ebca680b89e8879081f855152f21772c7834474437
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f14f606d6eaf3f4b815b26312f9438ad146701ccbd387b83d4b6f69217ba2b13
fded88b84aecf0d550b1d26a85a971351a138a573dbd6bd88cb646de1e7ab42a