www.cyber.nj.gov Open in urlscan Pro
45.60.124.188 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Submission: On November 17 via api (November 17th 2020, 9:14:04 am UTC) from US

Summary HTTP 55 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 19 IPs in 4 countries across 17 domains to perform 55 HTTP transactions. The main IP is 45.60.124.188, located in United States and belongs to INCAPSULA, US. The main domain is www.cyber.nj.gov.
TLS certificate: Issued by GlobalSign CloudSSL CA - SHA256 - G3 on November 10th 2020. Valid for: a year.

This is the only time www.cyber.nj.gov was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 17	45.60.124.188 45.60.124.188	19551 (INCAPSULA) (INCAPSULA)
2	2a00:1450:400... 2a00:1450:4001:817::200a	15169 (GOOGLE) (GOOGLE)
4	2001:4de0:ac1... 2001:4de0:ac19::1:b:1b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:820::2008	15169 (GOOGLE) (GOOGLE)
8	2600:9000:205... 2600:9000:2057:6000:17:108e:3bc0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a04:4e42:3::621 2a04:4e42:3::621	54113 (FASTLY) (FASTLY)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:3a	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a04:4e42:1b:... 2a04:4e42:1b::621	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6812:e234	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:821::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:802::200e	15169 (GOOGLE) (GOOGLE)
6	104.75.88.112 104.75.88.112	16625 (AKAMAI-AS) (AKAMAI-AS)
1	13.226.132.107 13.226.132.107	16509 (AMAZON-02) (AMAZON-02)
1	34.204.38.77 34.204.38.77	14618 (AMAZON-AES) (AMAZON-AES)
1	72.247.226.64 72.247.226.64	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2606:4700:303... 2606:4700:3032::6812:3770	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:209... 2600:9000:2093:9600:a:e02a:3080:93a1	16509 (AMAZON-02) (AMAZON-02)
1	52.216.146.205 52.216.146.205	16509 (AMAZON-02) (AMAZON-02)
55	19

17 45.60.124.188 (United States) 1 redirects

ASN19551 (INCAPSULA, US)

www.cyber.nj.gov	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:817::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2001:4de0:ac19::1:b:1b (Netherlands)

ASN20446 (HIGHWINDS3, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:2057:6000:17:108e:3bc0:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.buttercms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:3::621 (Ascension Island)

ASN54113 (FASTLY, US)

cdn.polyfill.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:1b::621 (Ascension Island)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:e234 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:821::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:802::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.75.88.112 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-75-88-112.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.132.107 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-132-107.dus51.r.cloudfront.net

app.artibot.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.204.38.77 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-204-38-77.compute-1.amazonaws.com

api.artibot.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 72.247.226.64 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a72-247-226-64.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3032::6812:3770 (United States)

ASN13335 (CLOUDFLARENET, US)

prod.artibotcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2093:9600:a:e02a:3080:93a1 (United States)

ASN16509 (AMAZON-02, US)

api-cdn.prod-aws.artibot.ai	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.216.146.205 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com

s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	nj.gov 1 redirects www.cyber.nj.gov	121 KB
8	buttercms.com cdn.buttercms.com	271 KB
5	addthis.com s7.addthis.com m.addthis.com	143 KB
4	bootstrapcdn.com stackpath.bootstrapcdn.com	76 KB
3	artibot.ai app.artibot.ai api.artibot.ai api-cdn.prod-aws.artibot.ai	6 KB
3	gstatic.com fonts.gstatic.com	121 KB
2	artibotcdn.com prod.artibotcdn.com	82 KB
2	google-analytics.com www.google-analytics.com	19 KB
2	polyfill.io cdn.polyfill.io	680 B
2	googleapis.com fonts.googleapis.com	2 KB
1	amazonaws.com s3.amazonaws.com	23 KB
1	addthisedge.com v1.addthisedge.com	911 B
1	moatads.com z.moatads.com	1 KB
1	onesignal.com cdn.onesignal.com	3 KB
1	jsdelivr.net cdn.jsdelivr.net	8 KB
1	jquery.com code.jquery.com	24 KB
1	googletagmanager.com www.googletagmanager.com	38 KB
55	17

	Domain	Requested by
17	www.cyber.nj.gov	1 redirects www.cyber.nj.gov
8	cdn.buttercms.com	www.cyber.nj.gov
4	stackpath.bootstrapcdn.com	www.cyber.nj.gov
3	s7.addthis.com	www.cyber.nj.gov s7.addthis.com
3	fonts.gstatic.com	fonts.googleapis.com
2	prod.artibotcdn.com	app.artibot.ai
2	m.addthis.com	s7.addthis.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	cdn.polyfill.io	www.cyber.nj.gov
2	fonts.googleapis.com	www.cyber.nj.gov
1	s3.amazonaws.com
1	api-cdn.prod-aws.artibot.ai	prod.artibotcdn.com
1	v1.addthisedge.com	s7.addthis.com
1	z.moatads.com	s7.addthis.com
1	api.artibot.ai	app.artibot.ai
1	app.artibot.ai	www.cyber.nj.gov
1	cdn.onesignal.com	www.cyber.nj.gov
1	cdn.jsdelivr.net	www.cyber.nj.gov
1	code.jquery.com	www.cyber.nj.gov
1	www.googletagmanager.com	www.cyber.nj.gov
55	20

This site contains links to these domains. Also see Links.

Domain
nj.gov
www.cisecurity.org
www.intego.com
blog.confiant.com
www.carbonblack.com
www.bleepingcomputer.com
www.njhomelandsecurity.gov
twitter.com
www.facebook.com
www.instagram.com
www.nj.gov
www.addthis.com

Subject Issuer	Validity	Valid
incapsula.com GlobalSign CloudSSL CA - SHA256 - G3	`2020-11-10` - `2021-10-28`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-10-28` - `2021-01-20`	3 months	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2020-09-22` - `2021-10-12`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-10-28` - `2021-01-20`	3 months	crt.sh
*.buttercms.com Sectigo RSA Domain Validation Secure Server CA	`2020-01-08` - `2022-02-06`	2 years	crt.sh
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-10-26` - `2021-04-17`	6 months	crt.sh
jquery.org Sectigo RSA Domain Validation Secure Server CA	`2020-10-06` - `2021-10-16`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-04` - `2021-08-04`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2020-10-28` - `2021-01-20`	3 months	crt.sh
odc-prod-01.oracle.com DigiCert Secure Site ECC CA-1	`2020-07-22` - `2021-10-13`	a year	crt.sh
*.artibot.ai Amazon	`2020-06-17` - `2021-07-17`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
artibotcdn.com Cloudflare Inc ECC CA-3	`2020-06-15` - `2021-06-15`	a year	crt.sh
s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2020-08-04` - `2021-08-09`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Frame ID: 5956A3E1F8560E880AC6AB2A33F8EEAC
Requests: 54 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: A1D399ACD8602269ADC93B8DBC2345A2
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 6EB194D7B6E305757197B5CE40625C64
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer HTTP 301
https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/ Page URL

Detected technologies

Netlify (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^Netlify/i

Page Statistics

55
Requests

98 %
HTTPS

67 %
IPv6

17
Domains

20
Subdomains

19
IPs

4
Countries

939 kB
Transfer

2314 kB
Size

6
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://nj.gov/
Title: OFFICIAL SITE OF THE STATE OF NEW JERSEY

Search URL Search Domain Scan URL

URL: https://www.cisecurity.org/cybersecurity-threats/alert-level/
Title: NJ's Current Cyber Alert Level: "Guarded"

Search URL Search Domain Scan URL

URL: https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/
Title: here

Search URL Search Domain Scan URL

URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Title: Confiant

Search URL Search Domain Scan URL

URL: https://www.carbonblack.com/2019/02/12/tau-threat-intelligence-notification-new-macos-malware-variant-of-shlayer-osx-discovered/
Title: Carbon Black

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/10-percent-of-all-macs-shlayered-malware-cocktail-served/
Title: Bleeping Computer

Search URL Search Domain Scan URL

URL: https://www.njhomelandsecurity.gov/media/governor-murphy-announces-new-jersey-participation-in-cyberstart-america
Title: 11/09/20 PRESS RELEASE: Governor Murphy Announces New Jersey Participation in CyberStart America

Search URL Search Domain Scan URL

URL: https://twitter.com/NJCybersecurity

Search URL Search Domain Scan URL

URL: https://www.facebook.com/NJCCIC/

Search URL Search Domain Scan URL

URL: https://www.instagram.com/njcybersecurity/

Search URL Search Domain Scan URL

URL: https://www.nj.gov/nj/privacy.html
Title: here

Search URL Search Domain Scan URL

URL: https://www.addthis.com/website-tools/overview?utm_source=AddThis%20Tools&utm_medium=image&utm_campaign=Marketing%20tool%20logo

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer HTTP 301
https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

55 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Redirect Chain

https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer
https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/

68 KB
17 KB

42ms
42ms

Document
text/html

45.60.124.188
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.124.188 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Netlify /

Resource Hash

6044ef62dfc421e8c26dace15cdae091c0fc60a3db811833233937d807888390

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.cyber.nj.gov
:scheme: https
:path: /threat-center/threat-profiles/macos-malware-variants/shlayer/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: visid_incap_1613844=NceSQXR0QwCNbd0gO4C8w0qUs18AAAAAQUIPAAAAAADLsLBp97isSb/0hOu1y1dv; nlbi_1613844=UFXcMhby51EhtrCW3cr+KQAAAAAsuAQuh4SfGSE4DBWZlDfY; incap_ses_128_1613844=SfhXadhpHQ0zRmwQer/GAUqUs18AAAAA4L69rZ8/huO+FyPrw06gXA==
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
cache-control: public, max-age=0, must-revalidate
content-type: text/html; charset=UTF-8
date: Tue, 17 Nov 2020 09:10:12 GMT
etag: "c30a0d95c8720798a0e8da28707f282f-ssl-df"
link: </webpack-runtime-3d5650411111783b033c.js>; rel=preload; as=script, </framework-72d77a3dc9c81291ed98.js>; rel=preload; as=script, </app-8189e10c6c69d0fdd643.js>; rel=preload; as=script, </styles-89fd2ae28bdf06750a71.js>; rel=preload; as=script, </b637e9a5-645fb342d749e2adc83d.js>; rel=preload; as=script, </332e21127b1b48b057feac7ec4976154d43ddaf1-2eae5de1fcbe118bef9b.js>; rel=preload; as=script, </component---src-templates-markdownpage-js-f2c3881157fd61a3d36a.js>; rel=preload; as=script, </page-data/app-data.json>; rel=preload; as=fetch; crossorigin, </page-data/threat-center/threat-profiles/macos-malware-variants/shlayer/page-data.json>; rel=preload; as=fetch; crossorigin
referrer-policy: same-origin
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
content-encoding: gzip
age: 216
server: Netlify
vary: Accept-Encoding
x-nf-request-id: c609a1c3-684e-451c-8c94-2246f0aeab3e-278108
x-cdn: Incapsula
x-iinfo: 0-27423213-27423214 NNNN CT(7 9 0) RT(1605604426692 0) q(0 0 1 -1) r(1 1) U12

Redirect headers

status: 301
cache-control: public, max-age=0, must-revalidate
content-type: text/html; charset=UTF-8
date: Tue, 17 Nov 2020 09:13:47 GMT
etag: "c30a0d95c8720798a0e8da28707f282f-ssl-df"
link: </webpack-runtime-3d5650411111783b033c.js>; rel=preload; as=script, </framework-72d77a3dc9c81291ed98.js>; rel=preload; as=script, </app-8189e10c6c69d0fdd643.js>; rel=preload; as=script, </styles-89fd2ae28bdf06750a71.js>; rel=preload; as=script, </b637e9a5-645fb342d749e2adc83d.js>; rel=preload; as=script, </332e21127b1b48b057feac7ec4976154d43ddaf1-2eae5de1fcbe118bef9b.js>; rel=preload; as=script, </component---src-templates-markdownpage-js-f2c3881157fd61a3d36a.js>; rel=preload; as=script, </page-data/app-data.json>; rel=preload; as=fetch; crossorigin, </page-data/threat-center/threat-profiles/macos-malware-variants/shlayer/page-data.json>; rel=preload; as=fetch; crossorigin
referrer-policy: same-origin
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
age: 0
server: Netlify
location: /threat-center/threat-profiles/macos-malware-variants/shlayer/
x-nf-request-id: c609a1c3-684e-451c-8c94-2246f0aeab3e-277854
set-cookie: visid_incap_1613844=NceSQXR0QwCNbd0gO4C8w0qUs18AAAAAQUIPAAAAAADLsLBp97isSb/0hOu1y1dv; expires=Wed, 17 Nov 2021 07:54:06 GMT; HttpOnly; path=/; Domain=.cyber.nj.gov nlbi_1613844=UFXcMhby51EhtrCW3cr+KQAAAAAsuAQuh4SfGSE4DBWZlDfY; path=/; Domain=.cyber.nj.gov incap_ses_128_1613844=SfhXadhpHQ0zRmwQer/GAUqUs18AAAAA4L69rZ8/huO+FyPrw06gXA==; path=/; Domain=.cyber.nj.gov
x-cdn: Incapsula
x-iinfo: 0-27423207-27423208 NNNN CT(12 16 0) RT(1605604426265 0) q(0 0 0 0) r(1 4) U11

GET
H2 200 webpack-runtime-3d5650411111783b033c.js Show response
www.cyber.nj.gov/ 13 KB
4 KB 38ms
35ms Script
application/javascript 45.60.124.188
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cyber.nj.gov/webpack-runtime-3d5650411111783b033c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: 535b9c618dd16f350629d193c4cfd0611f6fdbea59a8afee5c166fa05f13f788

Request headers

Referer: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 09:13:46 GMT
content-encoding: gzip
x-cdn: Incapsula
etag: "ff094346cb383d3b2eeb4b297fdd7c77-ssl-df"
content-type: application/javascript
status: 200
x-iinfo: 0-27423217-27423218 2CNN RT(1605604426739 0) q(0 0 0 -1) r(0 0) U18
cache-control: max-age=86400, public
content-length: 3584
expires: Wed, 18 Nov 2020 09:13:46 GMT

GET
H2 200 framework-72d77a3dc9c81291ed98.js Show response
www.cyber.nj.gov/ 21 KB
8 KB 38ms
36ms Script
application/javascript 45.60.124.188
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cyber.nj.gov/framework-72d77a3dc9c81291ed98.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: 4fd0a96efe47bae038a9186db469a80e781bb8d1858df5f0f1fba36df8a8a9d9

Request headers

Referer: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 09:13:46 GMT
content-encoding: gzip
x-cdn: Incapsula
etag: "85551d7389e45a6da65cea1cccf3bdaa-ssl-df"
content-type: application/javascript
status: 200
x-iinfo: 0-27423219-27423220 2CNN RT(1605604426741 0) q(0 0 0 -1) r(0 0)
cache-control: max-age=86400, public
content-length: 7977
expires: Wed, 18 Nov 2020 09:13:46 GMT

GET
H2 200 app-8189e10c6c69d0fdd643.js Show response
www.cyber.nj.gov/ 56 KB
16 KB 40ms
38ms Script
application/javascript 45.60.124.188
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cyber.nj.gov/app-8189e10c6c69d0fdd643.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: 21b72673423cb72fd3bf711de76c6c08aa2d75f4c18ee916957d9f6482808acd

Request headers

Referer: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 09:13:46 GMT
content-encoding: gzip
x-cdn: Incapsula
etag: "cc58ab8e241adfc02ac516ef6ba5bc74-ssl-df"
content-type: application/javascript
status: 200
x-iinfo: 0-27423221-27423222 2CNN RT(1605604426743 0) q(0 0 0 -1) r(0 0)
cache-control: max-age=86400, public
content-length: 16027
expires: Wed, 18 Nov 2020 09:13:46 GMT

GET
H2 200 styles-89fd2ae28bdf06750a71.js Show response
www.cyber.nj.gov/ 61 B
254 B 23ms
21ms Script
application/javascript 45.60.124.188
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cyber.nj.gov/styles-89fd2ae28bdf06750a71.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: 0fae8b03858a764bad3e9af19bfc924ead5b9e25c760432c19e91cba3dff1cf3

Request headers

Referer: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 09:13:46 GMT
content-encoding: gzip
x-cdn: Incapsula
etag: "d5dc876d26f2fc01d682c65a2ecef6ae-ssl"
content-type: application/javascript
status: 200
x-iinfo: 0-27423223-0 0CNN RT(1605604426745 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=86400, public
content-length: 64
expires: Wed, 18 Nov 2020 09:13:46 GMT

GET
H2 200 b637e9a5-645fb342d749e2adc83d.js Show response
www.cyber.nj.gov/ 87 KB
30 KB 24ms
23ms Script
application/javascript 45.60.124.188
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cyber.nj.gov/b637e9a5-645fb342d749e2adc83d.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: f82c48dd8b366d212fc9ade2ecac2c47429d524017f6cce0b5379b78001db63a

Request headers

Referer: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 09:13:46 GMT
content-encoding: gzip
x-cdn: Incapsula
etag: "d63d0688b3629024d320ed998ea5e554-ssl-df"
content-type: application/javascript
status: 200
x-iinfo: 0-27423225-0 0CNN RT(1605604426746 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=86400, public
content-length: 31040
expires: Wed, 18 Nov 2020 09:13:46 GMT

GET
H2 200 332e21127b1b48b057feac7ec4976154d43ddaf1-2eae5de1fcbe118bef9b.js Show response
www.cyber.nj.gov/ 66 KB
19 KB 37ms
35ms Script
application/javascript 45.60.124.188
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cyber.nj.gov/332e21127b1b48b057feac7ec4976154d43ddaf1-2eae5de1fcbe118bef9b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: 40039ac50989592adc84ae5e6e9d321a3a74819ad1b8474785ab8f01b5b9fd6b

Request headers

Referer: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 09:13:47 GMT
content-encoding: gzip
x-cdn: Incapsula
etag: "ddcee6459be326c0b341371ebdf0fba3-ssl-df"
content-type: application/javascript
status: 200
x-iinfo: 0-27423228-27422692 2CNN RT(1605604426748 0) q(0 0 0 -1) r(0 0)
cache-control: max-age=86400, public
content-length: 19002
expires: Wed, 18 Nov 2020 09:13:47 GMT

GET
H2 200 component---src-templates-markdownpage-js-f2c3881157fd61a3d36a.js Show response
www.cyber.nj.gov/ 3 KB
1 KB 42ms
41ms Script
application/javascript 45.60.124.188
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cyber.nj.gov/component---src-templates-markdownpage-js-f2c3881157fd61a3d36a.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: 656d8f34a6bef92974e3d20349056a2e85f6a2e8ca11ed96c6162153c6964325

Request headers

Referer: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 09:13:47 GMT
content-encoding: gzip
x-cdn: Incapsula
etag: "4633b588074c9fc94762a9c7beb5ffa5-ssl-df"
content-type: application/javascript
status: 200
x-iinfo: 0-27423229-27423230 2CNN RT(1605604426749 0) q(0 0 0 -1) r(0 0) U18
cache-control: max-age=86400, public
content-length: 1073
expires: Wed, 18 Nov 2020 09:13:47 GMT

GET
H2 200 app-data.json
www.cyber.nj.gov/page-data/ 50 B
268 B 44ms
43ms Other
application/json 45.60.124.188
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyber.nj.gov/page-data/app-data.json

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.124.188 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Netlify /

Resource Hash

4cf982efdfd2736d811b145b4fb66ba250ab37a06bf501cd5a9bb140140055b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Origin: https://www.cyber.nj.gov
Referer: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id: c609a1c3-684e-451c-8c94-2246f0aeab3e-278126
date: Sun, 15 Nov 2020 15:53:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cdn: Incapsula
age: 148814
status: 200
x-iinfo: 0-27423231-27423214 PNYN RT(1605604426751 0) q(0 0 0 -1) r(0 0) U2
x-xss-protection: 1; mode=block
referrer-policy: same-origin
server: Netlify
x-frame-options: SAMEORIGIN
etag: "9c2a3a6b7e324300f02ebf4bc5cee300-ssl"
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes

GET
H2 200 page-data.json
www.cyber.nj.gov/page-data/threat-center/threat-profiles/macos-malware-variants/shlayer/ 4 KB
2 KB 51ms
50ms Other
application/json 45.60.124.188
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyber.nj.gov/page-data/threat-center/threat-profiles/macos-malware-variants/shlayer/page-data.json

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.124.188 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Netlify /

Resource Hash

8fd07f4fb017b94b05684b6c36ec74d1a16528c8b473404a622e6a3d74018e59

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Origin: https://www.cyber.nj.gov
Referer: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id: c609a1c3-684e-451c-8c94-2246f0aeab3e-278133
date: Tue, 17 Nov 2020 09:10:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cdn: Incapsula
age: 215
status: 200
x-iinfo: 0-27423232-27423233 NNNY CT(0 0 0) RT(1605604426752 0) q(0 0 0 -1) r(0 0) U2
strict-transport-security: max-age=31536000
content-length: 1977
x-xss-protection: 1; mode=block
referrer-policy: same-origin
server: Netlify
x-frame-options: SAMEORIGIN
etag: "b3fba81bd67278dc3534a2db82cd18aa-ssl-df"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes

GET
H2 200 2001626772.json
www.cyber.nj.gov/page-data/sq/d/ 6 KB
1 KB 39ms
38ms Other
application/json 45.60.124.188
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyber.nj.gov/page-data/sq/d/2001626772.json

Requested by

Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.124.188 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Netlify /

Resource Hash

8c93c91a88cce024ff3ee16ff346aa8b4bbb401504162634dab00df69ca9af57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Origin: https://www.cyber.nj.gov
Referer: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id: c609a1c3-684e-451c-8c94-2246f0aeab3e-278139
date: Sun, 15 Nov 2020 16:14:56 GMT
content-encoding: br
x-content-type-options: nosniff
x-cdn: Incapsula
age: 147531
status: 200
x-iinfo: 0-27423234-27423237 NNNY CT(0 0 0) RT(1605604426754 0) q(0 0 0 -1) r(0 0) U2
strict-transport-security: max-age=31536000
content-length: 1225
x-xss-protection: 1; mode=block
referrer-policy: same-origin
server: Netlify
x-frame-options: SAMEORIGIN
etag: "2039beef0efa61476244cb9e16a5e129-ssl-df"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes

GET
H2 200 2628674228.json
www.cyber.nj.gov/page-data/sq/d/ 719 B
532 B 54ms
54ms Other
application/json 45.60.124.188
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyber.nj.gov/page-data/sq/d/2628674228.json

Requested by

Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.124.188 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Netlify /

Resource Hash

022278202b62f09d48ced661ad9d8116bf0bb72aecf1d4c06fc15377e8d99334

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Origin: https://www.cyber.nj.gov
Referer: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id: c609a1c3-684e-451c-8c94-2246f0aeab3e-278154
date: Sun, 15 Nov 2020 15:24:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-cdn: Incapsula
age: 150552
status: 200
x-iinfo: 0-27423236-27423239 NNYN CT(7 9 0) RT(1605604426756 0) q(0 0 0 -1) r(0 0) U2
x-xss-protection: 1; mode=block
referrer-policy: same-origin
server: Netlify
x-frame-options: SAMEORIGIN
etag: "6c2abcac2587eabdd18f62b2a44403a0-ssl"
strict-transport-security: max-age=31536000
content-type: application/json
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes

GET
H2 200 2769593191.json
www.cyber.nj.gov/page-data/sq/d/ 8 KB
2 KB 39ms
38ms Other
application/json 45.60.124.188
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyber.nj.gov/page-data/sq/d/2769593191.json

Requested by

Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.124.188 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Netlify /

Resource Hash

e49a0e35778bf081153a907f8c8b7284fa2cecf0e2aa0bb4fa29b1b39003ad9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Origin: https://www.cyber.nj.gov
Referer: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id: c609a1c3-684e-451c-8c94-2246f0aeab3e-278145
date: Sun, 15 Nov 2020 15:24:36 GMT
content-encoding: br
x-content-type-options: nosniff
x-cdn: Incapsula
age: 150552
status: 200
x-iinfo: 0-27423238-27423214 PNNN RT(1605604426758 0) q(0 0 0 -1) r(0 0) U2
strict-transport-security: max-age=31536000
content-length: 1956
x-xss-protection: 1; mode=block
referrer-policy: same-origin
server: Netlify
x-frame-options: SAMEORIGIN
etag: "4e55564cad64c3eaf5a3efb11e593d6e-ssl-df"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes

GET
H2 200 css
fonts.googleapis.com/ 3 KB
1 KB 36ms
16ms Stylesheet
text/css 2a00:1450:4001:817::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap

Requested by

Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ac8d961b3fc8abf1332f8d62410fe7a2aa211ce7aaf6c998e60971bdbd55620f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Origin: https://www.cyber.nj.gov
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 17 Nov 2020 09:13:47 GMT
server: ESF
date: Tue, 17 Nov 2020 09:13:47 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 17 Nov 2020 09:13:47 GMT

GET
H2 200 bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/ 157 KB
24 KB 30ms
11ms Stylesheet
text/css 2001:4de0:ac19::1:b:1b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css

Requested by

Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.cyber.nj.gov
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 09:13:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Aug 2020 16:43:41 GMT
status: 200
etag: "1596732221"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 23876

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 96 KB
38 KB 45ms
19ms Script
application/javascript 2a00:1450:4001:820::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-162455942-1

Requested by

Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

065051cc95fc5d960efb274da9f1b1b568a15ef570458b413898a8cb3c0621e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 09:13:47 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38696
x-xss-protection: 0
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 17 Nov 2020 09:13:47 GMT

GET
H2 200 kWwPshCMTHmgpFkQuK4Q
cdn.buttercms.com/ 50 KB
51 KB 46ms
7ms Image
image/png 2600:9000:2057:6000:17:108e:3bc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.buttercms.com/kWwPshCMTHmgpFkQuK4Q
Requested by: Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:6000:17:108e:3bc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: a6ea5009d0ef07479970cc3bf6e6012d876d3f35bd8b5102f801c0d4ca826b71

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 08 Nov 2020 07:31:15 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 a56d6b55603697d6c44b19d4f907baaa.cloudfront.net (CloudFront)
age: 2227055
x-cache: Hit from cloudfront
status: 200
content-disposition: inline; filename="Cream & Gray Massage Logo-seal.png"
content-length: 51068
x-served-by: cache-bwi5141-BWI, cache-hhn4027-HHN
last-modified: Sat, 23 May 2020 14:48:06 GMT
server: nginx
x-file-name: Cream & Gray Massage Logo-seal.png
x-timer: S1604820676.858689,VS0,VE1
etag: "d6b6dce3a65b92bd2b046af24e07f7b5"
access-control-max-age: 21600
access-control-allow-methods: DELETE, GET, HEAD, POST, PUT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2678400
filestack-trace-id: 1603377371-6qHNYrH8Tj
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
access-control-allow-headers: Content-Type, X-No-Stream
x-amz-cf-id: I95KJdkJVA-SigbYqvL1NF1fFmA_c9EWbhC0uoA8uQ7S1oiDkoqZNg==
x-cache-hits: 1, 1

GET
H2 200 zCC5PhwYS9Klxami3nT3
cdn.buttercms.com/ 52 KB
53 KB 58ms
20ms Image
image/png 2600:9000:2057:6000:17:108e:3bc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.buttercms.com/zCC5PhwYS9Klxami3nT3
Requested by: Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:6000:17:108e:3bc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 54e02c1aad708d776f8aa97405117122d1915765bcbe0e5a6a91bee43b64af89

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 27 Oct 2020 16:34:07 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 a56d6b55603697d6c44b19d4f907baaa.cloudfront.net (CloudFront)
age: 2169545
x-cache: Hit from cloudfront
status: 200
content-disposition: inline; filename="NJCCIC (3).png"
content-length: 53257
x-served-by: cache-bwi5121-BWI, cache-fra19172-FRA
last-modified: Fri, 23 Aug 2019 19:18:36 GMT
server: nginx
x-file-name: NJCCIC (3).png
x-timer: S1603816447.048374,VS0,VE1
etag: "d4d9bca3cdafe641d16fa67ea86a2d48"
access-control-max-age: 21600
access-control-allow-methods: DELETE, GET, HEAD, POST, PUT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2678400
filestack-trace-id: 1603434881-8lGdNEORMS
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
access-control-allow-headers: Content-Type, X-No-Stream
x-amz-cf-id: 7L4znpkKRUCMVuu7JlIiu0wQ_6-sHSv1TL7vSYyHi0Mln09hdTmUBw==
x-cache-hits: 1, 1

GET
H2 200 bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/ 157 KB
23 KB 12ms
9ms Stylesheet
text/css 2001:4de0:ac19::1:b:1b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

Requested by

Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.cyber.nj.gov
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 09:13:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 12 May 2020 17:29:51 GMT
status: 200
etag: "1589304591"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 23841

GET
H2 200 bootstrap.min.js Show response
stackpath.bootstrapcdn.com/bootstrap/4.5.0/js/ 59 KB
15 KB 14ms
10ms Script
text/javascript 2001:4de0:ac19::1:b:1b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/js/bootstrap.min.js

Requested by

Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.cyber.nj.gov
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 09:13:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 12 May 2020 17:27:09 GMT
status: 200
etag: "1589304429"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 14885

GET
H2 200 polyfill.min.js Show response
cdn.polyfill.io/v3/ 72 B
536 B 23ms
7ms Script
text/javascript 2a04:4e42:3::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.polyfill.io/v3/polyfill.min.js?features=fetch

Requested by

Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::621 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: br
x-content-type-options: nosniff
content-type: text/javascript; charset=utf-8
age: 1099816
detected-user-agent: Chrome Mobile/83.0.4103
status: 200
server-timing: HIT-CLUSTER, fastly;desc="Edge time";dur=1, HIT-CLUSTER, fastly;desc="Edge time";dur=1
content-length: 74
referrer-policy: origin-when-cross-origin
last-modified: Wed, 04 Nov 2020 15:43:21 GMT
date: Tue, 17 Nov 2020 09:13:47 GMT
vary: User-Agent, Accept-Encoding
access-control-allow-methods: GET,HEAD,OPTIONS
normalized-user-agent: chrome/83.0.0
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 css
fonts.googleapis.com/ 0
878 B 19ms
16ms Other
text/css 2a00:1450:4001:817::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap

Requested by

Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Origin: https://www.cyber.nj.gov
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 17 Nov 2020 09:13:47 GMT
server: ESF
date: Tue, 17 Nov 2020 09:13:47 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 17 Nov 2020 09:13:47 GMT

GET
H2 200 jquery-3.5.1.slim.min.js Show response
code.jquery.com/ 71 KB
24 KB 30ms
9ms Script
application/javascript 2001:4de0:ac19::1:b:3a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.5.1.slim.min.js
Requested by: Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db

Request headers

Origin: https://www.cyber.nj.gov
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 09:13:47 GMT
content-encoding: gzip
last-modified: Mon, 04 May 2020 23:02:39 GMT
server: nginx
status: 200
etag: W/"5eb09f0f-11abc"
vary: Accept-Encoding
x-hw: 1605604427.dop146.fr8.t,1605604427.cds240.fr8.hn,1605604427.cds240.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 24606

GET
H2 200 popper.min.js Show response
cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/ 21 KB
8 KB 22ms
6ms Script
application/javascript 2a04:4e42:1b::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js

Requested by

Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::621 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.cyber.nj.gov
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 5819954
x-cache: HIT, HIT
status: 200
cross-origin-resource-policy: cross-origin
content-length: 7503
etag: W/"52f1-MTeJyg4xtlR4TbuosPg/Nk+Gg7Q"
x-served-by: cache-fra19142-FRA, cache-hhn4083-HHN
date: Tue, 17 Nov 2020 09:13:47 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 bootstrap.min.js Show response
stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/ 59 KB
15 KB 16ms
14ms Script
text/javascript 2001:4de0:ac19::1:b:1b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js

Requested by

Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.cyber.nj.gov
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 09:13:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Aug 2020 16:43:44 GMT
status: 200
etag: "1596732224"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 14811

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 8 KB
3 KB 37ms
18ms Script
application/javascript 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js
Requested by: Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ffb110318b55e8d7acaeaa7816d495e33a5000643327241099565537973ed051

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 09:13:47 GMT
content-encoding: gzip
cf-cache-status: HIT
server: cloudflare
age: 350
etag: W/"af07e3bccd7885748057bb532c526ac5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=43200
cf-ray: 5f38567949899ac8-FRA
cf-request-id: 0677145fcf00009ac82db14000000001
expires: Tue, 17 Nov 2020 21:13:47 GMT

GET
H2 200 _Incapsula_Resource Show response
www.cyber.nj.gov/ 125 KB
18 KB 23ms
21ms Script
application/javascript 45.60.124.188
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cyber.nj.gov/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=2&cb=559198444
Requested by: Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: e3dca5e33144f0b49b9181489acfa1e698c0b9efe319fc679a129b25190af685

Request headers

Referer: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
content-encoding: gzip
cache-control: no-cache, no-store
x-robots-tag: noindex
content-length: 18284
content-type: application/javascript

GET
H2 200 flUhRq6tzZclQEJ-Vdg-IuiaDsNcIhQ8tQ.woff2
fonts.gstatic.com/s/materialicons/v67/ 92 KB
93 KB 36ms
13ms Font
font/woff2 2a00:1450:4001:821::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/materialicons/v67/flUhRq6tzZclQEJ-Vdg-IuiaDsNcIhQ8tQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6963af239ecfb1f9722ba86fe3456a19c1d64a995295b3f3b220f5c8c22ef13a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.cyber.nj.gov
Referer: https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 14 Nov 2020 18:38:22 GMT
x-content-type-options: nosniff
last-modified: Tue, 03 Nov 2020 05:39:50 GMT
server: sffe
age: 225325
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 94648
x-xss-protection: 0
expires: Sun, 14 Nov 2021 18:38:22 GMT

GET
H2 200 wlp_gwjKBV1pqhv43IE7225P.woff2
fonts.gstatic.com/s/cardo/v13/ 15 KB
15 KB 34ms
12ms Font
font/woff2 2a00:1450:4001:821::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/cardo/v13/wlp_gwjKBV1pqhv43IE7225P.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8204d955949011c5828e9abf4d8b96d072565c688aef0b35b502e5c41529a7aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.cyber.nj.gov
Referer: https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 19:25:40 GMT
x-content-type-options: nosniff
last-modified: Thu, 24 Sep 2020 23:55:39 GMT
server: sffe
age: 395287
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14860
x-xss-protection: 0
expires: Fri, 12 Nov 2021 19:25:40 GMT

GET
H2 200 XRXW3I6Li01BKofAnsSUYevIWzgPDA.woff2
fonts.gstatic.com/s/nunito/v14/ 13 KB
14 KB 29ms
7ms Font
font/woff2 2a00:1450:4001:821::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/nunito/v14/XRXW3I6Li01BKofAnsSUYevIWzgPDA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ded984ad3aa0617a3ad1ee35e5d132434f76a461b7a6d5bc18f48c676ce1e9a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.cyber.nj.gov
Referer: https://fonts.googleapis.com/css?family=Cardo|Nunito:300|Material+Icons&display=swap
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 14 Nov 2020 18:32:07 GMT
x-content-type-options: nosniff
last-modified: Thu, 10 Sep 2020 17:04:03 GMT
server: sffe
age: 225700
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13668
x-xss-protection: 0
expires: Sun, 14 Nov 2021 18:32:07 GMT

GET
H2 200 tZSSHXB0QZ6S9l1PQvjR
cdn.buttercms.com/ 30 KB
31 KB 10ms
8ms Image
image/png 2600:9000:2057:6000:17:108e:3bc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.buttercms.com/tZSSHXB0QZ6S9l1PQvjR
Requested by: Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:6000:17:108e:3bc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: a0e636a68a658ecb12cc186d1f7f9eaf7d44c9ecf6b3daf9ea069ca0173e0e3f

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 02 Nov 2020 20:48:43 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 a56d6b55603697d6c44b19d4f907baaa.cloudfront.net (CloudFront)
age: 2227012
x-cache: Hit from cloudfront
status: 200
content-disposition: inline; filename="N CCIC (9).png"
content-length: 30731
x-served-by: cache-bwi5124-BWI, cache-fra19176-FRA
last-modified: Mon, 06 Apr 2020 19:41:11 GMT
server: nginx
x-file-name: N CCIC (9).png
x-timer: S1604350124.949112,VS0,VE1
etag: "9faf37d72772f749a87cb21a510fefc8"
access-control-max-age: 21600
access-control-allow-methods: DELETE, GET, HEAD, POST, PUT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2678400
filestack-trace-id: 1603377414-PGfMJUx0QA
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
access-control-allow-headers: Content-Type, X-No-Stream
x-amz-cf-id: ba11pvFaV2RIx98X9WzWUYooPeBHZK5h874qkrgTtPSNJlD6flZnmA==
x-cache-hits: 1, 1

GET
H2 200 Qn0dlkOAQhO8adwRg2C0
cdn.buttercms.com/ 88 KB
89 KB 10ms
8ms Image
image/png 2600:9000:2057:6000:17:108e:3bc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.buttercms.com/Qn0dlkOAQhO8adwRg2C0
Requested by: Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:6000:17:108e:3bc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 39fc3cf190b011ab899a8f5d5ba9e2442dfebb1bcaf4c87289ca98c05cc29b63

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 08 Nov 2020 12:46:17 GMT
via: 1.1 varnish, 1.1 a56d6b55603697d6c44b19d4f907baaa.cloudfront.net (CloudFront)
age: 802729
x-cache: Hit from cloudfront
status: 200
content-disposition: inline; filename="icons-footer-5-21.png"
content-length: 89868
x-served-by: cache-bwi5121-BWI, cache-hhn4029-HHN
last-modified: Sat, 23 May 2020 14:41:30 GMT
server: nginx
x-file-name: icons-footer-5-21.png
x-timer: S1604839577.498283,VS0,VE89
etag: "741c6511ab9ffd6544063467cd0742eb"
access-control-max-age: 21600
access-control-allow-methods: DELETE, GET, HEAD, POST, PUT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2678400
filestack-trace-id: 1604801697-aMu8K4lReG
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
access-control-allow-headers: Content-Type, X-No-Stream
x-amz-cf-id: jHkPWg_mlvPWJBRciSqy07eSliG3ZT2B3qk-HLs58i2HFZERzITrAA==
x-cache-hits: 1, 0

GET
H2 200 yPnhycftTNGAh5m2V6uD
cdn.buttercms.com/ 14 KB
15 KB 14ms
13ms Image
image/png 2600:9000:2057:6000:17:108e:3bc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.buttercms.com/yPnhycftTNGAh5m2V6uD
Requested by: Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:6000:17:108e:3bc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b8e8a5e125fc685f61004c304e204222ed9f66b50eb663d812ebfb5ec0142f98

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 08 Nov 2020 20:02:23 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 a56d6b55603697d6c44b19d4f907baaa.cloudfront.net (CloudFront)
age: 783410
x-cache: Hit from cloudfront
status: 200
content-disposition: inline; filename="3.png"
content-length: 14324
x-served-by: cache-bwi5134-BWI, cache-fra19176-FRA
last-modified: Mon, 06 Apr 2020 19:56:24 GMT
server: nginx
x-file-name: 3.png
x-timer: S1604865744.804885,VS0,VE1
etag: "2440d61115634bdba11e5d627c94753d"
access-control-max-age: 21600
access-control-allow-methods: DELETE, GET, HEAD, POST, PUT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2678400
filestack-trace-id: 1604821016-gkCP7ediQr
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
access-control-allow-headers: Content-Type, X-No-Stream
x-amz-cf-id: 1sjMzrKY5qGBkP17WZ9ZzXrgoFGy0aZNdEl9nbjn5g3oY3qyW7isng==
x-cache-hits: 1, 1

GET
H2 200 Gy9nQewnQIOPbCe8DGPF
cdn.buttercms.com/ 6 KB
7 KB 16ms
15ms Image
image/png 2600:9000:2057:6000:17:108e:3bc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.buttercms.com/Gy9nQewnQIOPbCe8DGPF
Requested by: Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:6000:17:108e:3bc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 46b24625f14216fcbb72db91af1aec8cd72a69513dfa48d1cc8cd62c91435d1a

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 03 Nov 2020 15:15:29 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 a56d6b55603697d6c44b19d4f907baaa.cloudfront.net (CloudFront)
age: 1261702
x-cache: Hit from cloudfront
status: 200
content-disposition: inline; filename="2.png"
content-length: 6114
x-served-by: cache-bwi5147-BWI, cache-fra19157-FRA
last-modified: Mon, 06 Apr 2020 19:56:33 GMT
server: nginx
x-file-name: 2.png
x-timer: S1604416529.133899,VS0,VE1
etag: "41c819e5f85b125ed5f42393f675082d"
access-control-max-age: 21600
access-control-allow-methods: DELETE, GET, HEAD, POST, PUT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2678400
filestack-trace-id: 1604342724-fVmisVFSQ7
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
access-control-allow-headers: Content-Type, X-No-Stream
x-amz-cf-id: g0xs9l76mhJXiLUAw-w_-nadS9btf3TmQUThcDVmv8iZzNxuX9FERA==
x-cache-hits: 1, 1

GET
H2 200 W6tvy9nIRsu45tiOUO89
cdn.buttercms.com/ 14 KB
15 KB 15ms
13ms Image
image/png 2600:9000:2057:6000:17:108e:3bc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.buttercms.com/W6tvy9nIRsu45tiOUO89
Requested by: Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:6000:17:108e:3bc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b31da6455e725fab3e9a95eeef26dd077d327824a00c28b797123096499c200d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 12 Nov 2020 08:13:05 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 a56d6b55603697d6c44b19d4f907baaa.cloudfront.net (CloudFront)
age: 920679
x-cache: Hit from cloudfront
status: 200
content-disposition: inline; filename="Cream & Gray Massage Logo (2).png"
content-length: 14313
x-served-by: cache-bwi5134-BWI, cache-fra19156-FRA
last-modified: Fri, 25 Sep 2020 14:45:26 GMT
server: nginx
x-file-name: Cream & Gray Massage Logo (2).png
x-timer: S1605168785.947246,VS0,VE89
etag: "d7c9f28e093031db7e9106bd83ef8ff8"
access-control-max-age: 21600
access-control-allow-methods: DELETE, GET, HEAD, POST, PUT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2678400
filestack-trace-id: 1604683747-29IekcVuQl
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
access-control-allow-headers: Content-Type, X-No-Stream
x-amz-cf-id: lWIYnMHrD41iYysCEZbfnEYUFUJrIAEAgyyYJQpQOKUyKxdc_yBO1w==
x-cache-hits: 1, 0

GET
H2 200 QSZCMoTS5OvR8soCNfWP
cdn.buttercms.com/ 11 KB
12 KB 15ms
14ms Image
image/png 2600:9000:2057:6000:17:108e:3bc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.buttercms.com/QSZCMoTS5OvR8soCNfWP
Requested by: Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:6000:17:108e:3bc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e800bcd0513a356d83750467536b76b377e1a3620c69a0f32b25355c8959dd50

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 23:01:07 GMT
via: 1.1 varnish, 1.1 varnish, 1.1 a56d6b55603697d6c44b19d4f907baaa.cloudfront.net (CloudFront)
age: 2245494
x-cache: Hit from cloudfront
status: 200
content-disposition: inline; filename="Cream & Gray Massage Logo (1).png"
content-length: 11666
x-served-by: cache-bwi5140-BWI, cache-fra19141-FRA
last-modified: Fri, 25 Sep 2020 14:16:14 GMT
server: nginx
x-file-name: Cream & Gray Massage Logo (1).png
x-timer: S1603753267.249174,VS0,VE1
etag: "e595313d4e0e164cec67b83a0786161e"
access-control-max-age: 21600
access-control-allow-methods: DELETE, GET, HEAD, POST, PUT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2678400
filestack-trace-id: 1603358932-ppyCT71NSH
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
access-control-allow-headers: Content-Type, X-No-Stream
x-amz-cf-id: l5ui8jpNi0x-py-3HPa7dwA5QprOcD5rIWl0ynY4chcWdy0e2Y5EqA==
x-cache-hits: 1, 1

GET
H2 200 polyfill.min.js
cdn.polyfill.io/v3/ 72 B
144 B 7ms
6ms Other
text/javascript 2a04:4e42:3::621
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.polyfill.io/v3/polyfill.min.js?features=fetch

Requested by

Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:3::621 , Ascension Island, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: br
x-content-type-options: nosniff
content-type: text/javascript; charset=utf-8
age: 1099816
detected-user-agent: Chrome Mobile/83.0.4103
status: 200
server-timing: HIT-CLUSTER, fastly;desc="Edge time";dur=1, HIT, fastly;desc="Edge time";dur=0
content-length: 74
referrer-policy: origin-when-cross-origin
last-modified: Wed, 04 Nov 2020 15:43:21 GMT
date: Tue, 17 Nov 2020 09:13:47 GMT
access-control-allow-methods: GET,HEAD,OPTIONS
normalized-user-agent: chrome/83.0.0
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 _Incapsula_Resource
www.cyber.nj.gov/ 1 B
35 B 15ms
15ms Image
text/plain 45.60.124.188
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cyber.nj.gov/_Incapsula_Resource?SWKMTFSR=1&e=0.7957762103957575
Requested by: Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
cache-control: no-cache, no-store
x-robots-tag: noindex
content-length: 1
content-type: text/plain

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
19 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-162455942-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 23 Oct 2020 03:00:57 GMT
server: Golfe2
age: 5064
date: Tue, 17 Nov 2020 07:49:24 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18817
expires: Tue, 17 Nov 2020 09:49:24 GMT

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 353 KB
114 KB 97ms
51ms Script
application/javascript 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/332e21127b1b48b057feac7ec4976154d43ddaf1-2eae5de1fcbe118bef9b.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
server: nginx/1.15.8
etag: W/"5f971164-5834c"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
status: 200
cache-control: public, max-age=600
date: Tue, 17 Nov 2020 09:13:48 GMT
x-host: s7.addthis.com
content-length: 116325

GET
H2 200 chatbot.js Show response
www.cyber.nj.gov/ 500 B
554 B 28ms
28ms Script
application/javascript 45.60.124.188
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cyber.nj.gov/chatbot.js
Requested by: Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/332e21127b1b48b057feac7ec4976154d43ddaf1-2eae5de1fcbe118bef9b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.124.188 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: 99b054bbf28ebb11f60fba7fa59854d940564492598afdb0c28c7e9110580e51

Request headers

Referer: https://www.cyber.nj.gov/threat-center/threat-profiles/macos-malware-variants/shlayer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 09:13:47 GMT
content-encoding: gzip
x-cdn: Incapsula
etag: "1fde6ef68200ca6dc5843239c60b5d29-ssl"
content-type: application/javascript
status: 200
x-iinfo: 0-27423244-0 0CNN RT(1605604427186 0) q(0 -1 -1 -1) r(0 -1)
cache-control: max-age=86400, public, must-revalidate
content-length: 337
expires: Wed, 18 Nov 2020 09:13:47 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 1 B
389 B 40ms
14ms XHR
text/plain 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j87&a=1527810963&t=pageview&_s=1&dl=https%3A%2F%2Fwww.cyber.nj.gov%2Fthreat-center%2Fthreat-profiles%2Fmacos-malware-variants%2Fshlayer&ul=en-us&de=UTF-8&dt=NJCCIC%20Threat%20Profile%20Shlayer&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=1103415725&gjid=1510472833&cid=1572203540.1605604428&tid=UA-162455942-1&_gid=1285864974.1605604428&_r=1&gtm=2oub41&z=1148267949

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 17 Nov 2020 09:13:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://www.cyber.nj.gov
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK loader.js Show response
app.artibot.ai/ 10 KB
5 KB 87ms
22ms Script
application/javascript 13.226.132.107
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://app.artibot.ai/loader.js
Requested by: Host: www.cyber.nj.gov
URL: https://www.cyber.nj.gov/chatbot.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.132.107 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-132-107.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2a49c08c9a5a4e2636db8f1f3c11f7e49d177bb8be87a432414ea30e2ddb2802

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: null
Content-Encoding: gzip
ETag: "486ae3c31d0f430acafd42539b3f98b4"
Age: 13355
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Thu, 09 Jul 2020 18:41:19 GMT
Server: AmazonS3
Date: Tue, 17 Nov 2020 05:31:16 GMT
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Via: 1.1 2395e6175733260a159a0b484ed8febd.cloudfront.net (CloudFront)
Cache-Control: public, max-age=14400
X-Amz-Cf-Pop: DUS51-C1
X-Amz-Cf-Id: tWMS6ZWmyRHHoeZ41ve9AdOxe09zzscOKxIa6cNPz17MDjcHfsfBMQ==

GET
H2 200 version Show response
api.artibot.ai/api/bots/021304d7-ea6f-4035-bec0-698b42ca0a81/ 90 B
203 B 335ms
109ms XHR
application/json 34.204.38.77
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.artibot.ai/api/bots/021304d7-ea6f-4035-bec0-698b42ca0a81/version
Requested by: Host: app.artibot.ai
URL: https://app.artibot.ai/loader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.204.38.77 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-204-38-77.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: 215bc18f93d5ce559e953e942460a1996c3911b09dcea4d446f75a92e1bc7def

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Tue, 17 Nov 2020 09:13:48 GMT
server: Kestrel
access-control-allow-origin: *
content-type: application/json; charset=utf-8

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 79ms
25ms Script
application/x-javascript 72.247.226.64
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.226.64 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-226-64.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 09:13:48 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: C0B7E130097BC605
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=14420
accept-ranges: bytes
content-length: 948
x-amz-id-2: WMRpIO186SrpMgXAdDxxqtwuB/nVpPpDrif5aSQ8+ORAAGwczaqMUoDLYLjYQOU+EHP09vSgz8E=

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/ra-5e263a6ccdf8622d/ 1 KB
911 B 24ms
22ms Script
application/javascript 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/ra-5e263a6ccdf8622d/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-112.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ba804fd763c5bb7b453d45e8fe61afa5f2c8ee4bd0828dc4e50c8f86aaf07826

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 09:13:48 GMT
content-encoding: gzip
etag: 128670746--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
cache-control: public, max-age=35, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 736

GET
H2 200 300lo.json Show response
m.addthis.com/live/red_lojson/ 90 B
250 B 178ms
176ms Script
application/javascript 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://m.addthis.com/live/red_lojson/300lo.json?si=5fb3944c9d3fa6d1&bkl=0&bl=1&pdt=970&sid=5fb3944c9d3fa6d1&pub=ra-5e263a6ccdf8622d&rev=v8.28.8-wp&ln=en&pc=men&cb=0&ab=-&dp=www.cyber.nj.gov&fp=threat-center%2Fthreat-profiles%2Fmacos-malware-variants%2Fshlayer&fr=&of=1&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&colc=1605604428337&jsl=1&skipb=1&callback=addthis.cbs.jsonp__223868569701293650
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-112.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: a6d9a110cbc2be63945bb97e33dd698ed0270062b87e1816f4b6c9cd2a256fea

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Tue, 17 Nov 2020 09:13:48 GMT
cache-control: max-age=0, no-cache, no-store, no-transform
content-disposition: attachment; filename=1.txt
content-length: 90
content-type: application/javascript;charset=utf-8

GET sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame A1D3 0
0

GET
H2 200 sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 6EB1 0
0 44ms
44ms Document
text/html 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:method: GET
:authority: s7.addthis.com
:scheme: https
:path: /static/sh.f48a1a04fe8dbf021b4cda1d.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: nginx/1.15.8
content-type: text/html
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
etag: W/"5ed917ff-11adc"
timing-allow-origin: *
cache-control: public, max-age=86313600
p3p: CP="NON ADM OUR DEV IND COM STA"
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
content-length: 26421
date: Tue, 17 Nov 2020 09:13:48 GMT
vary: Accept-Encoding
x-host: s7.addthis.com

GET
H2 200 custom-messages.5799ddf75a30812a3d49.js Show response
s7.addthis.com/static/ 114 KB
28 KB 26ms
25ms Script
application/javascript 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/custom-messages.5799ddf75a30812a3d49.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

e08ee0a0555b2527719a5d5581fb11ae492e0a111be1f89ceedd3b51e995c7c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
server: nginx/1.15.8
etag: W/"5ed917ff-1c9fc"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86313600
date: Tue, 17 Nov 2020 09:13:48 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 28521

GET
H2 204 300vi.png
m.addthis.com/live/red_lojson/ 0
110 B 176ms
175ms Image
text/plain 104.75.88.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://m.addthis.com/live/red_lojson/300vi.png?cad=shba%3Duim1&positions=uim1%3Dbottom&goals=uim1%3Dshare&first=1&rv=0&uvs=5fb3944c8df661cf&pub=ra-5e263a6ccdf8622d&dp=www.cyber.nj.gov&rev=v8.28.8-wp
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.88.112 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-112.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Tue, 17 Nov 2020 09:13:48 GMT
cache-control: max-age=0, no-cache, no-store
expires: Tue, 17 Nov 2020 09:13:48 GMT

GET
H2 200 _ArtiBotLauncherCB_Manifest Show response
prod.artibotcdn.com/manifest/ 1 KB
1 KB 72ms
44ms Script
application/javascript 2606:4700:3032::6812:3770
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.artibotcdn.com/manifest/_ArtiBotLauncherCB_Manifest?_=_
Requested by: Host: app.artibot.ai
URL: https://app.artibot.ai/loader.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::6812:3770 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b7f23db44eff87a2e41aac89798c0031f3bfacae38eeacc489297b5e07c5809b

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 09:13:48 GMT
via: 1.1 90dd5141cd2d05c51d479a582cded281.cloudfront.net (CloudFront)
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
age: 255
x-cache: Hit from cloudfront
status: 200
content-encoding: br
content-type: application/javascript; charset=utf-8
cf-request-id: 06771463270000d6c9f81b2000000001
last-modified: Thu, 09 Jul 2020 18:41:20 GMT
server: cloudflare
etag: W/"10f7dba4b59666c1375e931a82d99285"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Uv%2BaOjpoOSvGVxr5658t2YHZS%2FSxv%2F2s%2BzYyNCtqSB7hUBI23F7hHTHkMefqfU1w5%2BVPLU7OIk9dmTBgPFf%2BFQIHzQP5ez69c8Jc2T1oGm5HJdXzTl2VkJ8y3634XKA%2B"}],"group":"cf-nel","max_age":604800}
x-amz-version-id: null
cache-control: public, max-age=900
x-amz-cf-pop: DUS51-C1
cf-ray: 5f38567eaf74d6c9-FRA
x-amz-cf-id: xOX6MpXpVsP0jC3FAIb18WX4LjmI-vPt8NXZMDFhBhSH6Cxc4jfjdQ==

GET
DATA 200
OK truncated
/ 98 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 02a3d2b1c51fa7c978d0ceeabb1253da4b02194d2f4e3c83ce840aa26306b242

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 launcher.4449.js Show response
prod.artibotcdn.com/ 287 KB
81 KB 35ms
35ms Script
application/javascript 2606:4700:3032::6812:3770
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.artibotcdn.com/launcher.4449.js
Requested by: Host: app.artibot.ai
URL: https://app.artibot.ai/loader.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::6812:3770 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1fe7d4f7f202f5218f44b4576266a20cb105b3cb3500a7ae69b8ac092a3f682e

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 09:13:48 GMT
via: 1.1 f2ee8ec5deee40e44013272a9c7aa35c.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 974387
x-cache: Hit from cloudfront
status: 200
content-encoding: br
content-type: application/javascript; charset=utf-8
cf-request-id: 06771463550000d6c9a338c000000001
last-modified: Thu, 09 Jul 2020 18:41:15 GMT
server: cloudflare
etag: W/"82d281dd05ae9a5476267c10f5640be2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ZOmZ3IQqQoOGqwBDXyoba2MPbhXwGPAvo8xcfKG5165ZXxPLCqiOGyfHelcLGUmQhHLlzc3vhcd0f6h0u1D%2FNCOfCLfBWibxfepPhk2EJzVHqzoj6umEjjAcam6IuAWX"}],"group":"cf-nel","max_age":604800}
x-amz-version-id: null
cache-control: public, max-age=31536000
x-amz-cf-pop: FRA6-C1
cf-ray: 5f38567ee809d6c9-FRA
x-amz-cf-id: ulfznQcPfQg0VTMVAQ6Fi5cu1F_VqoXaxuIm8f5HuNf4cx8HvjYryg==

GET
H/1.1 200
OK settings Show response
api-cdn.prod-aws.artibot.ai/api/bots/021304d7-ea6f-4035-bec0-698b42ca0a81/ 622 B
1 KB 60ms
15ms XHR
application/json 2600:9000:2093:9600:a:e02a:3080:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api-cdn.prod-aws.artibot.ai/api/bots/021304d7-ea6f-4035-bec0-698b42ca0a81/settings?settingsVersion=22&botVersionId=11044ade-a5c4-4aaf-b98e-4bcf9066cf0e
Requested by: Host: prod.artibotcdn.com
URL: https://prod.artibotcdn.com/launcher.4449.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2093:9600:a:e02a:3080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Kestrel /
Resource Hash: ee4f852015ea30eebc7adaa7f17f4fed4ea69c29d9b2cfba140768a66de05848

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 08 Nov 2020 18:05:52 GMT
Via: 1.1 3bfd04a794dcee9eaf362ae07e8fbe20.cloudfront.net (CloudFront)
Connection: keep-alive
Server: Kestrel
Age: 745676
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=2147483647
X-Amz-Cf-Pop: HAM50-C1
X-Amz-Cf-Id: GRo9NhPuOZa2JjIor8o9VB4Xrh24YZt2kCm-41QVj1r_bY2goTO9LA==

GET
H/1.1 200
OK botImage
s3.amazonaws.com/artibot-account-files-prod/ed/ed970824-bdf0-4739-9bde-cec1af330a41/021304d7-ea6f-4035-bec0-698b42ca0a81/ 23 KB
23 KB 426ms
120ms Image
image/png 52.216.146.205
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/artibot-account-files-prod/ed/ed970824-bdf0-4739-9bde-cec1af330a41/021304d7-ea6f-4035-bec0-698b42ca0a81/botImage?v=637344160031844726
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.146.205 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 9bad9ac5e80d98acbb10f67395739bcfcf9141b1e23c4549f68f04e6358c8d27

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 17 Nov 2020 09:13:50 GMT
Last-Modified: Sun, 30 Aug 2020 20:26:44 GMT
Server: AmazonS3
x-amz-request-id: F9511C6A038B71B7
ETag: "2cf68ca7d0143e0cc480accf3541ebe1"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 23490
x-amz-id-2: h/Vbufa35dASPXJFWlguoPj8aWvZvSNU3JZakU1Zehkd5eBhdeL4Qagw8aHUQ52DN4eSACPM7+w=

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s7.addthis.com
URL: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

53 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.nj.gov/	1970-01-19 14:01:30	Name: _gid Value: GA1.2.1285864974.1605604428
.nj.gov/	1970-01-20 07:31:16	Name: _ga Value: GA1.2.1572203540.1605604428
.nj.gov/	1970-01-19 14:00:04	Name: _gat_gtag_UA_162455942_1 Value: 1
.cyber.nj.gov/	1969-12-31 23:59:59	Name: incap_ses_128_1613844 Value: SfhXadhpHQ0zRmwQer/GAUqUs18AAAAA4L69rZ8/huO+FyPrw06gXA==
.cyber.nj.gov/	1969-12-31 23:59:59	Name: nlbi_1613844 Value: UFXcMhby51EhtrCW3cr+KQAAAAAsuAQuh4SfGSE4DBWZlDfY
.cyber.nj.gov/	1970-01-19 22:45:35	Name: visid_incap_1613844 Value: NceSQXR0QwCNbd0gO4C8w0qUs18AAAAAQUIPAAAAAADLsLBp97isSb/0hOu1y1dv

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js(Line 1) Message: OneSignal: Using fallback ES5 Stub for backwards compatibility.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api-cdn.prod-aws.artibot.ai
api.artibot.ai
app.artibot.ai
cdn.buttercms.com
cdn.jsdelivr.net
cdn.onesignal.com
cdn.polyfill.io
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
m.addthis.com
prod.artibotcdn.com
s3.amazonaws.com
s7.addthis.com
stackpath.bootstrapcdn.com
v1.addthisedge.com
www.cyber.nj.gov
www.google-analytics.com
www.googletagmanager.com
z.moatads.com
s7.addthis.com
104.75.88.112
13.226.132.107
2001:4de0:ac19::1:b:1b
2001:4de0:ac19::1:b:3a
2600:9000:2057:6000:17:108e:3bc0:93a1
2600:9000:2093:9600:a:e02a:3080:93a1
2606:4700:3032::6812:3770
2606:4700::6812:e234
2a00:1450:4001:802::200e
2a00:1450:4001:817::200a
2a00:1450:4001:820::2008
2a00:1450:4001:821::2003
2a04:4e42:1b::621
2a04:4e42:3::621
34.204.38.77
45.60.124.188
52.216.146.205
72.247.226.64
022278202b62f09d48ced661ad9d8116bf0bb72aecf1d4c06fc15377e8d99334
02a3d2b1c51fa7c978d0ceeabb1253da4b02194d2f4e3c83ce840aa26306b242
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
065051cc95fc5d960efb274da9f1b1b568a15ef570458b413898a8cb3c0621e8
0fae8b03858a764bad3e9af19bfc924ead5b9e25c760432c19e91cba3dff1cf3
1fe7d4f7f202f5218f44b4576266a20cb105b3cb3500a7ae69b8ac092a3f682e
215bc18f93d5ce559e953e942460a1996c3911b09dcea4d446f75a92e1bc7def
21b72673423cb72fd3bf711de76c6c08aa2d75f4c18ee916957d9f6482808acd
2a49c08c9a5a4e2636db8f1f3c11f7e49d177bb8be87a432414ea30e2ddb2802
38544024da1a0fc2f706be6582557b5722d17f48ad9a8073594a0cf928e2e3ff
39fc3cf190b011ab899a8f5d5ba9e2442dfebb1bcaf4c87289ca98c05cc29b63
40039ac50989592adc84ae5e6e9d321a3a74819ad1b8474785ab8f01b5b9fd6b
46b24625f14216fcbb72db91af1aec8cd72a69513dfa48d1cc8cd62c91435d1a
4cf982efdfd2736d811b145b4fb66ba250ab37a06bf501cd5a9bb140140055b7
4fd0a96efe47bae038a9186db469a80e781bb8d1858df5f0f1fba36df8a8a9d9
535b9c618dd16f350629d193c4cfd0611f6fdbea59a8afee5c166fa05f13f788
54e02c1aad708d776f8aa97405117122d1915765bcbe0e5a6a91bee43b64af89
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
6044ef62dfc421e8c26dace15cdae091c0fc60a3db811833233937d807888390
656d8f34a6bef92974e3d20349056a2e85f6a2e8ca11ed96c6162153c6964325
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c
6963af239ecfb1f9722ba86fe3456a19c1d64a995295b3f3b220f5c8c22ef13a
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
8204d955949011c5828e9abf4d8b96d072565c688aef0b35b502e5c41529a7aa
8c93c91a88cce024ff3ee16ff346aa8b4bbb401504162634dab00df69ca9af57
8fd07f4fb017b94b05684b6c36ec74d1a16528c8b473404a622e6a3d74018e59
99b054bbf28ebb11f60fba7fa59854d940564492598afdb0c28c7e9110580e51
9bad9ac5e80d98acbb10f67395739bcfcf9141b1e23c4549f68f04e6358c8d27
a0e636a68a658ecb12cc186d1f7f9eaf7d44c9ecf6b3daf9ea069ca0173e0e3f
a6d9a110cbc2be63945bb97e33dd698ed0270062b87e1816f4b6c9cd2a256fea
a6ea5009d0ef07479970cc3bf6e6012d876d3f35bd8b5102f801c0d4ca826b71
aaecd144d2b8763b2fa5c91f09778294363cef363c10504205f4203922644d11
ac8d961b3fc8abf1332f8d62410fe7a2aa211ce7aaf6c998e60971bdbd55620f
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
b31da6455e725fab3e9a95eeef26dd077d327824a00c28b797123096499c200d
b7f23db44eff87a2e41aac89798c0031f3bfacae38eeacc489297b5e07c5809b
b8e8a5e125fc685f61004c304e204222ed9f66b50eb663d812ebfb5ec0142f98
ba804fd763c5bb7b453d45e8fe61afa5f2c8ee4bd0828dc4e50c8f86aaf07826
ded984ad3aa0617a3ad1ee35e5d132434f76a461b7a6d5bc18f48c676ce1e9a3
e08ee0a0555b2527719a5d5581fb11ae492e0a111be1f89ceedd3b51e995c7c5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3dca5e33144f0b49b9181489acfa1e698c0b9efe319fc679a129b25190af685
e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
e49a0e35778bf081153a907f8c8b7284fa2cecf0e2aa0bb4fa29b1b39003ad9a
e800bcd0513a356d83750467536b76b377e1a3620c69a0f32b25355c8959dd50
ee4f852015ea30eebc7adaa7f17f4fed4ea69c29d9b2cfba140768a66de05848
f82c48dd8b366d212fc9ade2ecac2c47429d524017f6cce0b5379b78001db63a
fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f
ffb110318b55e8d7acaeaa7816d495e33a5000643327241099565537973ed051

www.cyber.nj.gov Open in urlscan Pro 45.60.124.188 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

55 Requests

98 %HTTPS

67 %IPv6

17 Domains

20 Subdomains

19 IPs

4 Countries

939 kBTransfer

2314 kBSize

6 Cookies

12 Outgoing links

Page URL History

Redirected requests

55 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.cyber.nj.gov Open in urlscan Pro
45.60.124.188 Public Scan

Screenshot
Live screenshot

Full Image

55
Requests

98 %
HTTPS

67 %
IPv6

17
Domains

20
Subdomains

19
IPs

4
Countries

939 kB
Transfer

2314 kB
Size

6
Cookies

55 HTTP transactions
1 data transactions