www.intego.com Open in urlscan Pro
2606:4700::6812:6a Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Submission: On September 17 via api (September 17th 2024, 6:01:29 am UTC) from IN — Scanned from DE

Summary HTTP 111 Redirects Links 31 Behaviour Indicators

Summary

This website contacted 29 IPs in 6 countries across 26 domains to perform 111 HTTP transactions. The main IP is 2606:4700::6812:6a, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.intego.com.
TLS certificate: Issued by WE1 on July 22nd 2024. Valid for: 3 months.

This is the only time www.intego.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
54	2606:4700::68... 2606:4700::6812:6a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
4	192.0.77.2 192.0.77.2	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2606:4700::68... 2606:4700::6810:5049	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a01:4a0:1338... 2a01:4a0:1338:28::c38a:ff12	201011 (CORE-BACK...) (CORE-BACKBONE CORE-BACKBONE GMBH GLOBAL NETWORK)
1	104.75.90.86 104.75.90.86	16625 (AKAMAI-AS) (AKAMAI-AS)
3	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:810::2008	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f08... 2a03:2880:f084:10d:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
1	151.101.128.84 151.101.128.84	54113 (FASTLY) (FASTLY)
4	199.232.192.134 199.232.192.134	54113 (FASTLY) (FASTLY)
2	2606:2800:234... 2606:2800:234:46c:e8b:1e2f:2bd:694	15133 (EDGECAST) (EDGECAST)
2	2001:4860:480... 2001:4860:4802:32::178	15169 (GOOGLE) (GOOGLE)
3	2620:1ec:33::10 2620:1ec:33::10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a03:2880:f08... 2a03:2880:f084:105:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1 2	2620:116:800d... 2620:116:800d:21:7eb1:3826:be7e:d981	16509 (AMAZON-02) (AMAZON-02)
2	182.22.16.251 182.22.16.251	23816 (YAHOO Yah...) (YAHOO Yahoo Japan Corporation)
2	151.101.192.134 151.101.192.134	54113 (FASTLY) (FASTLY)
1	2600:9000:223... 2600:9000:223c:4e00:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:400c:c00::9a	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f17... 2a03:2880:f177:185:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	91.228.74.159 91.228.74.159	16509 (AMAZON-02) (AMAZON-02)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1288:80:... 2a00:1288:80:807::1	203220 (YAHOO-DEB) (YAHOO-DEB)
1	54.171.122.26 54.171.122.26	16509 (AMAZON-02) (AMAZON-02)
111	29

54 2606:4700::6812:6a (United States)

ASN13335 (CLOUDFLARENET, US)

www.intego.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

netdna.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i1.wp.com

i2.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5049 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a01:4a0:1338:28::c38a:ff12 (Germany)

ASN201011 (CORE-BACKBONE CORE-BACKBONE GMBH GLOBAL NETWORK, DE)

embed.podcasts.apple.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.75.90.86 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-75-90-86.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:810::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f084:10d:face:b00c:0:2 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.128.84 (San Francisco, United States)

ASN54113 (FASTLY, US)

widgets.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 199.232.192.134 (United States)

ASN54113 (FASTLY, US)

macsecurityblog.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
referrer.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:234:46c:e8b:1e2f:2bd:694 (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:33::10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f084:105:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:7eb1:3826:be7e:d981 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 182.22.16.251 (Japan)

ASN23816 (YAHOO Yahoo Japan Corporation, JP)

s.yimg.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.192.134 (San Francisco, United States)

ASN54113 (FASTLY, US)

disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223c:4e00:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f177:185:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.228.74.159 (United Kingdom)

ASN16509 (AMAZON-02, US)

pixel-ssn.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1288:80:807::1 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.171.122.26 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-171-122-26.eu-west-1.compute.amazonaws.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
54	intego.com www.intego.com	547 KB
7	wp.com i2.wp.com — Cisco Umbrella Rank: 8096 i0.wp.com — Cisco Umbrella Rank: 4113 stats.wp.com — Cisco Umbrella Rank: 3358 pixel.wp.com — Cisco Umbrella Rank: 3300	8 KB
6	disqus.com macsecurityblog.disqus.com disqus.com — Cisco Umbrella Rank: 1275 referrer.disqus.com — Cisco Umbrella Rank: 9577	50 KB
6	facebook.com graph.facebook.com — Cisco Umbrella Rank: 177 www.facebook.com — Cisco Umbrella Rank: 106	5 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 43	379 KB
3	quantserve.com 1 redirects secure.quantserve.com — Cisco Umbrella Rank: 1497 pixel.quantserve.com — Cisco Umbrella Rank: 1058 pixel-ssn.quantserve.com — Cisco Umbrella Rank: 50099	11 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 361	15 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 31	2 KB
2	yimg.com s.yimg.com — Cisco Umbrella Rank: 758	8 KB
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 130	392 B
2	yimg.jp s.yimg.jp — Cisco Umbrella Rank: 7350	2 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 178	72 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 33	21 KB
2	twitter.com platform.twitter.com — Cisco Umbrella Rank: 1491	28 KB
2	gstatic.com fonts.gstatic.com	44 KB
2	bootstrapcdn.com netdna.bootstrapcdn.com — Cisco Umbrella Rank: 3593	39 KB
1	yahoo.com sp.analytics.yahoo.com — Cisco Umbrella Rank: 1617	508 B
1	google.de www.google.de — Cisco Umbrella Rank: 10137	63 B
1	google.com region1.analytics.google.com — Cisco Umbrella Rank: 4054
1	quantcount.com rules.quantcount.com — Cisco Umbrella Rank: 1541	1 KB
1	pinterest.com widgets.pinterest.com — Cisco Umbrella Rank: 23941	415 B
1	addthis.com s7.addthis.com — Cisco Umbrella Rank: 4609	361 B
1	apple.com embed.podcasts.apple.com — Cisco Umbrella Rank: 60704
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 670	7 KB
0	yahoo.co.jp Failed b91.yahoo.co.jp Failed
0	linkedin.com Failed www.linkedin.com Failed
111	26

	Domain	Requested by
54	www.intego.com	www.intego.com static.cloudflareinsights.com
4	www.facebook.com
4	www.googletagmanager.com	www.intego.com www.googletagmanager.com www.google-analytics.com
3	bat.bing.com	www.intego.com bat.bing.com
3	macsecurityblog.disqus.com	www.intego.com macsecurityblog.disqus.com
3	i2.wp.com	www.intego.com
3	fonts.googleapis.com	www.intego.com
2	s.yimg.com	www.intego.com s.yimg.com
2	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
2	disqus.com	macsecurityblog.disqus.com
2	s.yimg.jp	www.googletagmanager.com
2	connect.facebook.net	www.intego.com connect.facebook.net
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	pixel.wp.com
2	platform.twitter.com	www.intego.com platform.twitter.com
2	graph.facebook.com	www.intego.com
2	fonts.gstatic.com	fonts.googleapis.com
2	netdna.bootstrapcdn.com	www.intego.com netdna.bootstrapcdn.com
1	sp.analytics.yahoo.com
1	referrer.disqus.com
1	www.google.de
1	region1.analytics.google.com	www.googletagmanager.com
1	pixel-ssn.quantserve.com
1	pixel.quantserve.com	1 redirects
1	rules.quantcount.com	secure.quantserve.com
1	secure.quantserve.com	www.intego.com
1	widgets.pinterest.com	www.intego.com
1	stats.wp.com	www.intego.com
1	s7.addthis.com	www.intego.com
1	embed.podcasts.apple.com	www.intego.com
1	static.cloudflareinsights.com	www.intego.com
1	i0.wp.com	www.intego.com
0	b91.yahoo.co.jp Failed	s.yimg.jp
0	www.linkedin.com Failed	www.intego.com
111	34

This site contains links to these domains. Also see Links.

Domain
support.intego.com
account.intego.com
www.facebook.com
twitter.com
www.linkedin.com
pinterest.com
en.wikipedia.org
offer.intego.com
securelist.com
podcast.intego.com
podcasts.apple.com
x.com
www.youtube.com
www.pinterest.com
www.instagram.com
security.thejoshmeister.com
infosec.exchange
www.studentappcentre.com
facebook.com
linkedin.com
youtube.com

Subject Issuer	Validity	Valid
intego.com WE1	`2024-07-22` - `2024-10-20`	3 months	crt.sh
bootstrapcdn.com WE1	`2024-07-23` - `2024-10-21`	3 months	crt.sh
upload.video.google.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2023-11-28` - `2024-12-28`	a year	crt.sh
cloudflareinsights.com WE1	`2024-09-03` - `2024-12-02`	3 months	crt.sh
beta.music.apple.com Apple Public Server RSA CA 11 - G1	`2024-08-11` - `2024-11-09`	3 months	crt.sh
odc-addthis-prod-01.oracle.com DigiCert TLS RSA SHA256 2020 CA1	`2023-12-09` - `2024-12-11`	a year	crt.sh
*.gstatic.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.google-analytics.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-06-26` - `2024-09-24`	3 months	crt.sh
*.pinterest.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-08-05` - `2025-08-07`	a year	crt.sh
*.disqus.com Sectigo RSA Domain Validation Secure Server CA	`2024-04-16` - `2025-04-16`	a year	crt.sh
*.twimg.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-08` - `2025-07-07`	a year	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
quantserve.com R11	`2024-08-23` - `2024-11-21`	3 months	crt.sh
edge01.yahoo.co.jp Cybertrust Japan SureServer CA G4	`2024-07-02` - `2025-08-01`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.google.de WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh
*.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2024-08-26` - `2024-10-16`	2 months	crt.sh
*.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2024-07-30` - `2025-01-22`	6 months	crt.sh

This page contains 5 frames:

Primary Page: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Frame ID: DB71631A24AC5165EA6B1F5E8F95A2CE
Requests: 113 HTTP requests in this frame

Frame: https://embed.podcasts.apple.com/us/podcast/intego-mac-podcast/id1293834627?itsct=podcast_box&itscg=30200
Frame ID: CD7F381F47C1E5C87FC8F9D67D8DBAA5
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.intego.com
Frame ID: ACEDA85DD22ADA4A08C6EF0F1A958210
Requests: 1 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=macsecurityblog&t_i=101625%20https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2F%3Fp%3D101625&t_u=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&t_e=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs&t_d=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs&t_t=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs&s_o=default
Frame ID: A310597157199503C438D04A865F4541
Requests: 1 HTTP requests in this frame

Frame: https://disqus.com/recommendations/?base=default&f=macsecurityblog&t_i=101625%20https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2F%3Fp%3D101625&t_u=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&t_e=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs&t_d=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs&t_t=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs
Frame ID: C0391E72F2CC3CC66BB5E5A6546F027E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

New macOS malware HZ RAT gives attackers backdoor access to Macs - The Mac Security Blog

Detected technologies

Drupal (CMS) Expand

Overall confidence: 100%
Detected patterns

<(?:link|style)[^>]+"/sites/(?:default|all)/(?:themes|modules)/

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/
wp-embed\.min\.js\?ver=([\d.]+)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AddThis (Widgets) Expand

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

111
Requests

97 %
HTTPS

68 %
IPv6

26
Domains

34
Subdomains

29
IPs

6
Countries

1248 kB
Transfer

3539 kB
Size

13
Cookies

31 Outgoing links

These are links going to different origins than the main page.

URL: https://support.intego.com/home
Title: Knowledge Base

Search URL Search Domain Scan URL

URL: https://support.intego.com/hc/requests/new
Title: Contact Support

Search URL Search Domain Scan URL

URL: https://support.intego.com/access/unauthenticated?return_to=http%3A%2F%2Fsupport.intego.com%2Frequests
Title: Check Your Requests

Search URL Search Domain Scan URL

URL: https://account.intego.com/
Title: My Account

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Title: Shares

Search URL Search Domain Scan URL

URL: https://twitter.com/share?url=https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Title: Tweets

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Title: Shares

Search URL Search Domain Scan URL

URL: https://pinterest.com/pin/create/button/?url=https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Title: Pins

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Watering_hole_attack
Title: watering-hole style attacks

Search URL Search Domain Scan URL

URL: https://offer.intego.com/BlogMACAV_lbmxlkchf
Title: Intego’s Mac Premium Bundle X9

Search URL Search Domain Scan URL

URL: https://support.intego.com/hc/en-us/articles/207114798-VirusBarrier-X9-How-to-Scan-iPhone-iPad-and-iPod-Touch
Title: scan for malicious files on an iPhone, iPad, or iPod touch

Search URL Search Domain Scan URL

URL: https://securelist.com/hz-rat-attacks-wechat-and-dingtalk/113513/
Title: report

Search URL Search Domain Scan URL

URL: https://podcast.intego.com/

Search URL Search Domain Scan URL

URL: https://podcasts.apple.com/us/podcast/intego-mac-podcast/id1293834627
Title: follow the podcast

Search URL Search Domain Scan URL

URL: https://x.com/IntegoSecurity

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Intego

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/IntegoVideo?sub_confirmation=1

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/intego/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/intego

Search URL Search Domain Scan URL

URL: https://www.instagram.com/intego_security/

Search URL Search Domain Scan URL

URL: https://twitter.com/theJoshMeister
Title: @theJoshMeister

Search URL Search Domain Scan URL

URL: https://security.thejoshmeister.com/
Title: security.thejoshmeister.com

Search URL Search Domain Scan URL

URL: https://x.com/theJoshMeister
Title: X/Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/in/theJoshMeister
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://infosec.exchange/@theJoshMeister
Title: Mastodon

Search URL Search Domain Scan URL

URL: https://twitter.com/IntegoSecurity

Search URL Search Domain Scan URL

URL: https://www.studentappcentre.com/App/Internet_X9
Title: Student Discount

Search URL Search Domain Scan URL

URL: https://facebook.com/Intego
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/integosecurity
Title: Twitter

Search URL Search Domain Scan URL

URL: http://linkedin.com/company/intego
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://youtube.com/user/IntegoVideo
Title: YouTube

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 106

https://pixel.quantserve.com/pixel;r=381547214;labels=_fp.event.Default;rf=0;a=p-NVNd7-g373ynZ;url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F;uht=2;fpan=1;fpa=P0-351783850-1726552884682;pbc=;ns=0;ce=1;qjs=1;qv=15f23c9a-20240703164903;cm=;gdpr=0;ref=;d=intego.com;dst=1;et=1726552884785;tzo=-120;ogl=locale.en_US%2Ctype.article%2Ctitle.New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Secur%2Cdescription.HZ%20RAT%20is%20brand-new%20macOS%20malware%20that%20gives%20remote%20attackers%20complete%20control%20o%2Curl.https%3A%2F%2Fwww%252Eintego%252Ecom%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attacker%2Csite_name.The%20Mac%20Security%20Blog%2Cimage.https%3A%2F%2Fwww%252Eintego%252Ecom%2Fmac-security-blog%2Fwp-content%2Fuploads%2F2024%2F09%2Fevil-rat-mac%2Cimage%3Awidth.400%2Cimage%3Aheight.260;ses=02b6a8cc-eff0-4599-a99e-e974b8aa07a2;mdl= HTTP 302
https://pixel-ssn.quantserve.com/pixel;r=381547214;labels=_fp.event.Default;rf=0;a=p-NVNd7-g373ynZ;url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F;uht=2;fpan=1;fpa=P0-351783850-1726552884682;pbc=;ns=0;ce=1;qjs=1;qv=15f23c9a-20240703164903;cm=;gdpr=0;ref=;d=intego.com;dst=1;et=1726552884785;tzo=-120;ogl=locale.en_US%2Ctype.article%2Ctitle.New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Secur%2Cdescription.HZ%20RAT%20is%20brand-new%20macOS%20malware%20that%20gives%20remote%20attackers%20complete%20control%20o%2Curl.https%3A%2F%2Fwww%252Eintego%252Ecom%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attacker%2Csite_name.The%20Mac%20Security%20Blog%2Cimage.https%3A%2F%2Fwww%252Eintego%252Ecom%2Fmac-security-blog%2Fwp-content%2Fuploads%2F2024%2F09%2Fevil-rat-mac%2Cimage%3Awidth.400%2Cimage%3Aheight.260;ses=02b6a8cc-eff0-4599-a99e-e974b8aa07a2;mdl=;dip=8970115b-0461-4643-811a-169fec02535f

111 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request / Show response
www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/ 87 KB
22 KB 46ms
35ms Document
text/html 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c90d5a97ca0459269bc5bb673381b2aea352d5338a8b3b2a87670d11b8a4c46

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

age: 956
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-edge-cache: cache,platform=wordpress
cf-ray: 8c46e1a6598b8f41-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 17 Sep 2024 06:01:24 GMT
last-modified: Tue, 17 Sep 2024 05:45:28 GMT
link: <https://www.intego.com/mac-security-blog/wp-json/>; rel="https://api.w.org/" <https://www.intego.com/mac-security-blog/wp-json/wp/v2/posts/101625>; rel="alternate"; type="application/json" <https://wp.me/p4VAYd-qr7>; rel=shortlink
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H3 200 style.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/ 135 B
314 B 29ms
26ms Stylesheet
text/css 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9eeea020cc6ec6c8b66b20c48a9b69a5f14b8097bdb91c5420998eb842bcbae0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 724
cf-polished: origSize=512
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: W/"200-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a6a9e58f41-FRA
expires: Tue, 01 Oct 2024 05:49:20 GMT

GET
H3 200 font-awesome.css
netdna.bootstrapcdn.com/font-awesome/3.1.1/css/ 23 KB
5 KB 56ms
17ms Stylesheet
text/css 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://netdna.bootstrapcdn.com/font-awesome/3.1.1/css/font-awesome.css

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2d30057d0a8007fb75fb8a6e4f82f59d3858d29ea176db9c73f665209e86123

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 1053
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 1902194
cdn-cachedat: 08/17/2024 05:46:25
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:50 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: W/"bbd098fc6d8263878a58191b4b45e7a6"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 20b14b9dbf7f9c6d8464d373825dd085
timing-allow-origin: *
cdn-requestcountrycode: US
cdn-status: 200
cf-ray: 8c46e1a6eb8e3719-FRA
cdn-requestpullsuccess: True

GET
H2 200 css
fonts.googleapis.com/ 14 KB
1 KB 61ms
17ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:200,400,700,200italic,400italic,700italic

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

83212a7016848fb3c92281449aeb751aaaac914aa50a90f1b35998c8f2b19cdd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 17 Sep 2024 06:01:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 17 Sep 2024 06:01:24 GMT

GET
H3 200 style.min.css
www.intego.com/mac-security-blog/wp-includes/css/dist/block-library/ 79 KB
10 KB 29ms
26ms Stylesheet
text/css 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-includes/css/dist/block-library/style.min.css?ver=5.8.1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2788
alt-svc: h3=":443"; ma=86400
content-length: 10523
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "13abe-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a6a9e88f41-FRA
expires: Tue, 01 Oct 2024 05:14:56 GMT

GET
H3 200 mediaelementplayer-legacy.min.css
www.intego.com/mac-security-blog/wp-includes/js/mediaelement/ 11 KB
3 KB 27ms
24ms Stylesheet
text/css 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.16

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 724
alt-svc: h3=":443"; ma=86400
content-length: 2592
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "2bf8-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a6a9eb8f41-FRA
expires: Tue, 01 Oct 2024 05:49:20 GMT

GET
H3 200 wp-mediaelement.min.css
www.intego.com/mac-security-blog/wp-includes/js/mediaelement/ 4 KB
1 KB 31ms
28ms Stylesheet
text/css 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=5.8.1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2365
alt-svc: h3=":443"; ma=86400
content-length: 1156
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "105a-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a6a9ec8f41-FRA
expires: Tue, 01 Oct 2024 05:21:59 GMT

GET
H3 200 light_style.css
www.intego.com/mac-security-blog/wp-content/plugins/jquery-collapse-o-matic/ 884 B
601 B 30ms
28ms Stylesheet
text/css 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/plugins/jquery-collapse-o-matic/light_style.css?ver=1.6

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d077683ec63c7d44f473554e688628da6cfdf84c0f223b6be00f2476600433a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2511
cf-polished: origSize=1043
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:23 GMT
server: cloudflare
etag: W/"413-61ce448fe23c0-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a6a9ed8f41-FRA
expires: Tue, 01 Oct 2024 04:53:14 GMT

GET
H3 200 bootstrap.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 99 KB
17 KB 34ms
31ms Stylesheet
text/css 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/bootstrap.css?ver=1.0

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3fb4cab423b2441335fc682b79687d8eb806aceb384c937c9b28534580593fd4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2511
cf-polished: origSize=121622
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: W/"1db16-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a6a9ee8f41-FRA
expires: Tue, 01 Oct 2024 04:53:14 GMT

GET
H3 200 bootstrap-responsive.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 16 KB
4 KB 30ms
27ms Stylesheet
text/css 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/bootstrap-responsive.css?ver=1.0

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d2dcaca89ae344f9ba12d903385c7c7096fe869e8f12605e81d9b88078bef18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 724
cf-polished: origSize=21801
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: W/"5529-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a6a9ef8f41-FRA
expires: Tue, 01 Oct 2024 05:49:20 GMT

GET
H3 200 layout-responsive.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 2 KB
928 B 33ms
31ms Stylesheet
text/css 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout-responsive.css?ver=1.0

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

94562cfaffaf86145e9e271e11e2044a951dcf791bdf5769c3d58ba9acc44fdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2511
cf-polished: origSize=3429
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: W/"d65-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a6a9f08f41-FRA
expires: Tue, 01 Oct 2024 04:53:14 GMT

GET
H3 200 social-logos.min.css
www.intego.com/mac-security-blog/wp-content/plugins/jetpack/_inc/social-logos/ 12 KB
8 KB 33ms
31ms Stylesheet
text/css 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/plugins/jetpack/_inc/social-logos/social-logos.min.css?ver=10.2.1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b958e0f47861dde13a175cc69494bdb54f08e2b5e78cecf6abd16470d2085257

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 724
alt-svc: h3=":443"; ma=86400
content-length: 7898
last-modified: Wed, 10 Jul 2024 13:04:22 GMT
server: cloudflare
etag: "2f4a-61ce448eee180-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a6a9f28f41-FRA
expires: Tue, 01 Oct 2024 05:49:20 GMT

GET
H3 200 jetpack.css
www.intego.com/mac-security-blog/wp-content/plugins/jetpack/css/ 85 KB
17 KB 37ms
35ms Stylesheet
text/css 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/plugins/jetpack/css/jetpack.css?ver=10.2.1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a4f9c1995de9f92f05f1a5cd0c4987e359e1aa41613bb6a33f9c82837b29e6d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 844
cf-polished: origSize=87188
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:22 GMT
server: cloudflare
etag: W/"15494-61ce448eee180-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a6a9f38f41-FRA
expires: Tue, 01 Oct 2024 05:47:20 GMT

GET
H3 200 advanced-recent-posts-widget.css
www.intego.com/mac-security-blog/wp-content/plugins/advanced-recent-posts-widget/css/ 582 B
443 B 39ms
37ms Stylesheet
text/css 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/plugins/advanced-recent-posts-widget/css/advanced-recent-posts-widget.css?ver=5.8.1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f538d5803d00836b5f946264abb64976a6416ab4cc16f8f83455a025a08ad014

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2788
cf-polished: origSize=744
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:22 GMT
server: cloudflare
etag: W/"2e8-61ce448eee180-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a6a9f58f41-FRA
expires: Tue, 01 Oct 2024 05:14:56 GMT

GET
H3 200 rocket-loader.min.js Show response
www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 14ms
12ms Script
application/javascript 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 10 Sep 2024 18:11:43 GMT
server: cloudflare
etag: W/"66e08bdf-302c"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 8c46e1a6fa518f41-FRA
expires: Thu, 19 Sep 2024 06:01:24 GMT

GET
H3 200 btn_search.png
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/ 1 KB
1 KB 44ms
42ms Image
image/webp 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/btn_search.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

85c1eb2c2a173feceba14abe8344fe9c7cb12aa1353f083f28a62f1a366763b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 327
cf-polished: origFmt=png, origSize=2462
content-disposition: inline; filename="btn_search.webp"
alt-svc: h3=":443"; ma=86400
content-length: 1104
cf-bgj: imgq:85,h2pri
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "99e-61ce4490d6600"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a6a9f78f41-FRA
expires: Tue, 01 Oct 2024 05:55:57 GMT

GET
H3 200 intego-podcast-artwork-400.jpg
www.intego.com/mac-security-blog/wp-content/uploads/2021/04/ 7 KB
8 KB 39ms
37ms Image
image/webp 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2021/04/intego-podcast-artwork-400.jpg

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

903adc82f54bd61a22c1672000865fc19334735ba0ad395b361f67ccc2bdfd33

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 527
cf-polished: qual=85, origFmt=jpeg, origSize=18660
content-disposition: inline; filename="intego-podcast-artwork-400.webp"
alt-svc: h3=":443"; ma=86400
content-length: 7550
cf-bgj: imgq:85,h2pri
last-modified: Mon, 05 Apr 2021 14:37:57 GMT
server: cloudflare
etag: "48e4-5bf3aa4c61bdf"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a6a9fa8f41-FRA
expires: Tue, 01 Oct 2024 05:52:37 GMT

GET
H3 200 X-Twitter-logo-icon-225.gif
www.intego.com/mac-security-blog/wp-content/uploads/2024/03/ 1 KB
2 KB 23ms
23ms Image
image/webp 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2024/03/X-Twitter-logo-icon-225.gif

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3b302bf527209ab634a379dc27b9a22838e88001e24df759794f13f2810725e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1776
cf-polished: origFmt=gif, origSize=2235
content-disposition: inline; filename="X-Twitter-logo-icon-225.webp"
alt-svc: h3=":443"; ma=86400
content-length: 1338
cf-bgj: imgq:85,h2pri
last-modified: Sat, 23 Mar 2024 04:04:57 GMT
server: cloudflare
etag: "8bb-6144c0b25a6d8"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a6fa368f41-FRA
expires: Tue, 01 Oct 2024 05:21:59 GMT

GET
H3 200 Facebook-logo-icon-225.gif
www.intego.com/mac-security-blog/wp-content/uploads/2024/03/ 1 KB
2 KB 31ms
31ms Image
image/webp 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2024/03/Facebook-logo-icon-225.gif

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dd71e7bfa741c12ffde65deffbc1108ee85dfd3dfd200fb99c684c877fb364c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 327
cf-polished: origFmt=gif, origSize=3000
content-disposition: inline; filename="Facebook-logo-icon-225.webp"
alt-svc: h3=":443"; ma=86400
content-length: 1510
cf-bgj: imgq:85,h2pri
last-modified: Sat, 23 Mar 2024 04:31:47 GMT
server: cloudflare
etag: "bb8-6144c6b242fb9"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a6fa4b8f41-FRA
expires: Tue, 01 Oct 2024 05:55:57 GMT

GET
H3 200 YouTube-logo-icon-225.png
www.intego.com/mac-security-blog/wp-content/uploads/2024/03/ 8 KB
9 KB 32ms
31ms Image
image/webp 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2024/03/YouTube-logo-icon-225.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f453faccde456fd8b4f8abdda945eaea20b7fdebbff4fdb3ae03e7f75622972

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1776
cf-polished: origFmt=png, origSize=10479
content-disposition: inline; filename="YouTube-logo-icon-225.webp"
alt-svc: h3=":443"; ma=86400
content-length: 8526
cf-bgj: imgq:85,h2pri
last-modified: Sat, 23 Mar 2024 04:04:57 GMT
server: cloudflare
etag: "28ef-6144c0b2d8678"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a6fa4c8f41-FRA
expires: Tue, 01 Oct 2024 05:21:59 GMT

GET
H3 200 Pinterest-logo-icon-225.png
www.intego.com/mac-security-blog/wp-content/uploads/2024/03/ 10 KB
10 KB 34ms
32ms Image
image/webp 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2024/03/Pinterest-logo-icon-225.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4d3c6be580921c6b730a51242bbcedd60998424bb68a659b82a94b8839e63b92

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 327
cf-polished: origFmt=png, origSize=12807
content-disposition: inline; filename="Pinterest-logo-icon-225.webp"
alt-svc: h3=":443"; ma=86400
content-length: 9932
cf-bgj: imgq:85,h2pri
last-modified: Sat, 23 Mar 2024 04:04:56 GMT
server: cloudflare
etag: "3207-6144c0b1d7918"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a6fa528f41-FRA
expires: Tue, 01 Oct 2024 05:55:57 GMT

GET
H3 200 LinkedIn-logo-icon-225.gif
www.intego.com/mac-security-blog/wp-content/uploads/2024/03/ 2 KB
2 KB 37ms
35ms Image
image/webp 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2024/03/LinkedIn-logo-icon-225.gif

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

29c6beffd42fb25d6fe9ba5dd7c5a0262c9fab9e113de7c624e62fd3ed8ed41e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 327
cf-polished: origFmt=gif, origSize=4358
content-disposition: inline; filename="LinkedIn-logo-icon-225.webp"
alt-svc: h3=":443"; ma=86400
content-length: 2042
cf-bgj: imgq:85,h2pri
last-modified: Sat, 23 Mar 2024 04:04:55 GMT
server: cloudflare
etag: "1106-6144c0b10c718"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a6fa538f41-FRA
expires: Tue, 01 Oct 2024 05:55:57 GMT

GET
H3 200 Instagram-logo-icon-225.gif
www.intego.com/mac-security-blog/wp-content/uploads/2024/03/ 8 KB
8 KB 36ms
34ms Image
image/webp 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2024/03/Instagram-logo-icon-225.gif

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f9b05fa232d19f1752ceaea7eec0110daa8d4401caa7d415fb4e08a3db60df3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 327
cf-polished: origFmt=gif, origSize=14606
content-disposition: inline; filename="Instagram-logo-icon-225.webp"
alt-svc: h3=":443"; ma=86400
content-length: 8380
cf-bgj: imgq:85,h2pri
last-modified: Sat, 23 Mar 2024 04:31:48 GMT
server: cloudflare
etag: "390e-6144c6b2e517a"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a6fa558f41-FRA
expires: Tue, 01 Oct 2024 05:55:57 GMT

GET
H3 200 ios9-podcasts-app-tile.png
www.intego.com/mac-security-blog/wp-content/uploads/2017/10/ 38 KB
38 KB 29ms
28ms Image
image/webp 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2017/10/ios9-podcasts-app-tile.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8b0e8742416cb22d33029e1b4799431b847420b75c58f9eff600a2b15faa6e4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 526
cf-polished: origFmt=png, origSize=49061
content-disposition: inline; filename="ios9-podcasts-app-tile.webp"
alt-svc: h3=":443"; ma=86400
content-length: 38692
cf-bgj: imgq:85,h2pri
last-modified: Tue, 31 Oct 2017 12:56:45 GMT
server: cloudflare
etag: "bfa5-55cd749891d40"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a6fa568f41-FRA
expires: Tue, 01 Oct 2024 05:52:38 GMT

GET
H2 200 woman-with-worried-concerned-upset-face-looking-at-her-iPhone-400x260-1.jpg
i2.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2024/05/ 710 B
1 KB 23ms
7ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2024/05/woman-with-worried-concerned-upset-face-looking-at-her-iPhone-400x260-1.jpg?resize=40%2C40&ssl=1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

7963f87cb07f8a42a168d9cdcf2ed0cd45583291c011849a322a29002d38957f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
content-length: 710
x-nc: HIT hhn 1
last-modified: Mon, 29 Jul 2024 07:04:15 GMT
server: nginx
etag: "b454fd88095c8043"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://www.intego.com/mac-security-blog/wp-content/uploads/2024/05/woman-with-worried-concerned-upset-face-looking-at-her-iPhone-400x260-1.jpg>; rel="canonical"
expires: Wed, 29 Jul 2026 19:04:15 GMT

GET
H2 200 apple-watch-bands-hero-400.jpg
i2.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2024/09/ 622 B
1 KB 25ms
9ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2024/09/apple-watch-bands-hero-400.jpg?resize=40%2C40&ssl=1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

f1193951467f0698533ba8fd3e78c9cc9e8852b1f5e2ea2a54f05b46ddc8b275

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
content-length: 622
x-nc: HIT hhn 1
last-modified: Tue, 10 Sep 2024 15:04:03 GMT
server: nginx
etag: "dc382806b5af7611"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://www.intego.com/mac-security-blog/wp-content/uploads/2024/09/apple-watch-bands-hero-400.jpg>; rel="canonical"
expires: Fri, 11 Sep 2026 03:04:03 GMT

GET
H2 200 macOS-Sequoia-on-old-white-MacBook-2009-400x260-1.jpg
i2.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2024/08/ 514 B
946 B 24ms
8ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2024/08/macOS-Sequoia-on-old-white-MacBook-2009-400x260-1.jpg?resize=40%2C40&ssl=1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

42b34f0823b708cc37e194c980748a6cf9de5964e659c4c44d861dd02877fa50

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
content-length: 514
x-nc: HIT hhn 1
last-modified: Mon, 26 Aug 2024 07:07:33 GMT
server: nginx
etag: "5ad9c8208d37ff12"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://www.intego.com/mac-security-blog/wp-content/uploads/2024/08/macOS-Sequoia-on-old-white-MacBook-2009-400x260-1.jpg>; rel="canonical"
expires: Wed, 26 Aug 2026 19:07:33 GMT

GET
H2 200 sequoia-installer-400.png
i0.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2024/09/ 2 KB
2 KB 50ms
13ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2024/09/sequoia-installer-400.png?resize=40%2C40&ssl=1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

d8acb590859de744b30290b81039414fcc1f0ceb539cf8d29f8f8a0438cc935c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
content-length: 1750
x-nc: HIT ams 7
last-modified: Mon, 16 Sep 2024 23:52:16 GMT
server: nginx
etag: "d399018d2816efa6"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <https://www.intego.com/mac-security-blog/wp-content/uploads/2024/09/sequoia-installer-400.png>; rel="canonical"
expires: Thu, 17 Sep 2026 11:52:16 GMT

GET
H3 200 related.css
www.intego.com/mac-security-blog/wp-content/plugins/yet-another-related-posts-plugin/style/ 495 B
460 B 34ms
32ms Stylesheet
text/css 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/plugins/yet-another-related-posts-plugin/style/related.css?ver=5.27.6

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a48e3091c3e26309f1329bb7ee2812cf158deb93cd80fe6439e53e8d57e58d3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
age: 2511
etag: W/"1ef-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a6fa4f8f41-FRA
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 04:53:14 GMT

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ 19 KB
7 KB 68ms
46ms Script
text/javascript 2606:4700::6810:5049
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Origin: https://www.intego.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
server: cloudflare
etag: W/"2024.6.1"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 8c46e1a71a379be9-FRA

GET
H3 200 reset.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 773 B
658 B 34ms
33ms Stylesheet
text/css 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/reset.css

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

82f1278f66b192a223e306d884f8db595ef3b6d829cc1544807b9bf40019403e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 723
cf-polished: origSize=1184
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: W/"4a0-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a6fa3c8f41-FRA
expires: Tue, 01 Oct 2024 05:49:20 GMT

GET
H3 200 layout.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 24 KB
6 KB 29ms
29ms Stylesheet
text/css 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5f5f25721168edeb2b63229c2ab58e5d7f987ee5e8aced298e7445111badf09

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 723
cf-polished: origSize=30980
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: W/"7904-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a6fa3e8f41-FRA
expires: Tue, 01 Oct 2024 05:49:20 GMT

GET
H3 200 wrapper.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 256 KB
25 KB 30ms
29ms Stylesheet
text/css 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/wrapper.css

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50a82e0e3e97292e27f203cea4c71f3acaff073c1cfb1dc8cd63999efc9de72e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 723
cf-polished: origSize=291157
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: W/"47155-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a6fa418f41-FRA
expires: Tue, 01 Oct 2024 05:49:20 GMT

GET
H3 200 referrer-overrides.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 125 B
331 B 29ms
29ms Stylesheet
text/css 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/referrer-overrides.css

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aaffceab986a8d791cfef18d2d1e28fe2dcaf40a8bdfaf4fd393b1a91c6f072b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 723
cf-polished: origSize=141
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: W/"8d-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a6fa428f41-FRA
expires: Tue, 01 Oct 2024 05:49:20 GMT

GET
H3 200 print.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 2 KB
560 B 24ms
24ms Stylesheet
text/css 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/print.css

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

884a2330198f498e36d9e77bb5c7f4971b3d70c4411cf306a3afca8bb50bb94d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 723
cf-polished: origSize=3073
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: W/"c01-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=1209600
cf-ray: 8c46e1a6fa458f41-FRA
expires: Tue, 01 Oct 2024 05:49:20 GMT

GET
H2 200 id1293834627
embed.podcasts.apple.com/us/podcast/intego-mac-podcast/ Frame CD7F 0
0 49ms
12ms Document
text/html 2a01:4a0:1338:28::c38a:ff12
CORE-BACKBONE COR...

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.podcasts.apple.com/us/podcast/intego-mac-podcast/id1293834627?itsct=podcast_box&itscg=30200

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a01:4a0:1338:28::c38a:ff12 , Germany, ASN201011 (CORE-BACKBONE CORE-BACKBONE GMBH GLOBAL NETWORK, DE),

Reverse DNS

Software

daiquiri/5 /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-eval' 'unsafe-inline' blob: podcasts: com.apple.podcasts: itmss: itms-podcast: https://.apple.com; img-src 'self' data: https://.apple.com https://.mzstatic.com; media-src
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

apple-originating-system: UnknownOriginatingSystem
apple-seq: 0.0
apple-tk: false
cache-control: no-transform, max-age=46
content-encoding: gzip
content-length: 948
content-security-policy: default-src 'self' 'unsafe-eval' 'unsafe-inline' blob: podcasts: com.apple.podcasts: itmss: itms-podcast: https://*.apple.com; img-src 'self' data: https://*.apple.com https://*.mzstatic.com; media-src *
content-type: text/html
date: Tue, 17 Sep 2024 06:01:24 GMT
etag: "a181fb584d88698738b21347f0e95c68"
expect-ct: max-age=86400, enforce
last-modified: Mon, 17 Jun 2024 22:57:16 GMT
server: daiquiri/5
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-apple-jingle-correlation-key: RJGA2OQEUBC6ZONGRYISQV2FQ4
x-apple-request-uuid: 8a4c0d3a-04a0-45ec-b9a6-8e1128574587
x-apple-version-number: 2424.1.0
x-content-type-options: nosniff
x-daiquiri-instance: daiquiri:45887001:st44p00it-hyhk15124201:7987:24RELEASE186:daiquiri-amp-all-shared-int-001-st daiquiri:48493002:st44p00it-hyhk16134201:7987:24RELEASE186:daiquiri-amp-all-shared-ext-001-st daiquiri:42282004:st53p00it-qujn12050502:7987:24RELEASE186:daiquiri-amp-store-l7shared-ext-001-st
x-responding-instance: silverbullet-external:2032:st47p00it-qujn14040302:8301:24K1
x-xss-protection: 1; mode=block

GET
H2 200 css2
fonts.googleapis.com/ 3 KB
504 B 18ms
17ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Red+Hat+Display:wght@400;600;700;900&display=swap

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/wrapper.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

266fc6c7a849c593382767fc93937cd9fecf56a5c7abac6b938153f001a2359a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/wrapper.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 17 Sep 2024 06:01:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 17 Sep 2024 06:01:24 GMT

GET
H2 200 css2
fonts.googleapis.com/ 4 KB
540 B 19ms
19ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Red+Hat+Display:wght@300;400;500;600;700&display=swap

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/wrapper.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c3362186a709ce7cffcc17f7cbd317bddb60bd6409cc7b3d8c9f364f03152f6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/wrapper.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 17 Sep 2024 05:54:50 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 17 Sep 2024 06:01:24 GMT

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 56 B
361 B 45ms
21ms Script
text/javascript 104.75.90.86
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.90.86 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-90-86.deploy.static.akamaitechnologies.com

Software

Oracle API Gateway /

Resource Hash

f475c34186022ba531ebc8bba97fc10df7e4c3ea854f314a18ab0644c851620d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 17 Sep 2024 06:01:24 GMT
server: Oracle API Gateway
opc-request-id: /34C0B3DE5142B6D920B43AC39F80798B/3AE6B785CB6FA5B3A1C4D1E0E251CE25
x-frame-options: sameorigin
vary: Accept-Encoding
content-type: text/javascript
x-distribution: 99
x-host: s7.addthis.com
content-length: 76
x-xss-protection: 1; mode=block

GET
H2 200 e-202438.js Show response
stats.wp.com/ 7 KB
3 KB 61ms
10ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202438.js
Requested by: Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 5badd609a51ede5bab5b89534fc3011a4dd1ab487cc7081d7cf38479bcbab855

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-minify-cache: hit
x-nc: HIT ams
date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
server: nginx
x-minify: t
etag: W/14421-1717166114261.106
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
alt-svc: h3=":443"; ma=86400
expires: Sat, 13 Sep 2025 16:06:01 GMT

GET
H3 200 sharing.min.js Show response
www.intego.com/mac-security-blog/wp-content/plugins/jetpack/_inc/build/sharedaddy/ 12 KB
4 KB 31ms
30ms Script
application/javascript 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/plugins/jetpack/_inc/build/sharedaddy/sharing.min.js?ver=10.2.1

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

80ee2d8ce5d2a3f78fc3b8eaa67bc266645c58b96d8a804556f1e6cb8737d0cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2511
alt-svc: h3=":443"; ma=86400
content-length: 3807
last-modified: Wed, 10 Jul 2024 13:04:22 GMT
server: cloudflare
etag: "2f6d-61ce448eee180-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a76abe8f41-FRA
expires: Tue, 01 Oct 2024 04:53:15 GMT

GET
H3 200 wp-embed.min.js Show response
www.intego.com/mac-security-blog/wp-includes/js/ 1 KB
983 B 48ms
47ms Script
application/javascript 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-includes/js/wp-embed.min.js?ver=5.8.1

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2364
alt-svc: h3=":443"; ma=86400
content-length: 765
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "592-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a76ac48f41-FRA
expires: Tue, 01 Oct 2024 05:22:00 GMT

GET
H3 200 collapse.js Show response
www.intego.com/mac-security-blog/wp-content/plugins/jquery-collapse-o-matic/js/ 15 KB
3 KB 31ms
30ms Script
application/javascript 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/plugins/jquery-collapse-o-matic/js/collapse.js?ver=1.6.23

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1711944c7b1540085ff5f7ee6cfa0e2fb504383825d4739ec799b4fd0dd69e7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2511
cf-polished: origSize=21298
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:23 GMT
server: cloudflare
etag: W/"5332-61ce448fe23c0-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
cf-ray: 8c46e1a76ac68f41-FRA
expires: Tue, 01 Oct 2024 04:53:14 GMT

GET
H3 200 comment_embed.js Show response
www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/ 878 B
586 B 32ms
31ms Script
application/javascript 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.22

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

60631ed8f1dfa6713ff9e30fec41786aadc477c0cac5a75dca66b5a49f76b901

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1056
cf-polished: origSize=1232
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:22 GMT
server: cloudflare
etag: W/"4d0-61ce448eee180-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
cf-ray: 8c46e1a76ac88f41-FRA
expires: Tue, 01 Oct 2024 05:43:48 GMT

GET
H3 200 comment_count.js Show response
www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/ 708 B
590 B 30ms
29ms Script
application/javascript 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.22

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b385fd0614f2927f0e7fdc03ccdb2428e3a93de0c7fe467149b34213cc32c0f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 228
cf-polished: origSize=889
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:22 GMT
server: cloudflare
etag: W/"379-61ce448eee180-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
cf-ray: 8c46e1a76ac98f41-FRA
expires: Tue, 01 Oct 2024 05:57:36 GMT

GET
H3 200 comment-reply.min.js Show response
www.intego.com/mac-security-blog/wp-includes/js/ 3 KB
2 KB 48ms
47ms Script
application/javascript 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-includes/js/comment-reply.min.js?ver=5.8.1

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2364
alt-svc: h3=":443"; ma=86400
content-length: 1346
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "ba8-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a76aca8f41-FRA
expires: Tue, 01 Oct 2024 05:22:00 GMT

GET
H3 200 tracking.js Show response
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/ 3 KB
1 KB 48ms
47ms Script
application/javascript 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/tracking.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ad480458e8c9c476d4bed65c1df11a68284c9244342d977064bf4a0efd9e3ff5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 228
cf-polished: origSize=4191
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: W/"105f-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
cf-ray: 8c46e1a76acb8f41-FRA
expires: Tue, 01 Oct 2024 05:57:36 GMT

GET
H3 200 scripts.js Show response
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/ 11 KB
4 KB 47ms
46ms Script
application/javascript 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/scripts.js?ver=5.8.1

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

39511dff8f9d64434df213852f4f6a8964847c8e086da423e336b10ae422b678

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2364
cf-polished: origSize=19243
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: W/"4b2b-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
cf-ray: 8c46e1a76acd8f41-FRA
expires: Tue, 01 Oct 2024 05:22:00 GMT

GET
H3 200 modernizr-1.6.min.js Show response
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/ 9 KB
4 KB 47ms
46ms Script
application/javascript 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/modernizr-1.6.min.js?ver=5.8.1

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0140ed5069f22e4aa8bb1a1fc615c39fc55d7d64e94be541615f1c5a30ae479b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2364
alt-svc: h3=":443"; ma=86400
content-length: 3717
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "255b-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a76acf8f41-FRA
expires: Tue, 01 Oct 2024 05:22:00 GMT

GET
H3 200 html5shiv.js Show response
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/ 2 KB
1 KB 38ms
37ms Script
application/javascript 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/html5shiv.js?ver=5.8.1

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b859cc611126401cdc38d803ac7c5967ee5da1a626e00318700ea88df55da1b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2511
cf-polished: origSize=2376
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: W/"948-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
cf-ray: 8c46e1a76ad08f41-FRA
expires: Tue, 01 Oct 2024 05:14:57 GMT

GET
H3 200 bootstrap.min.js Show response
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/ 25 KB
7 KB 32ms
31ms Script
application/javascript 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/bootstrap.min.js?ver=5.8.1

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7587369160233b751c90ccc2043b7fdfd7eb1f0d9aa610371b43f4b3419fa83f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2364
alt-svc: h3=":443"; ma=86400
content-length: 6816
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "648f-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a76ad18f41-FRA
expires: Tue, 01 Oct 2024 05:22:00 GMT

GET
H3 200 jquery-migrate.min.js Show response
www.intego.com/mac-security-blog/wp-includes/js/jquery/ 11 KB
4 KB 45ms
45ms Script
application/javascript 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2511
alt-svc: h3=":443"; ma=86400
content-length: 4169
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "2bd8-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a76ad38f41-FRA
expires: Tue, 01 Oct 2024 04:53:14 GMT

GET
H3 200 jquery.min.js Show response
www.intego.com/mac-security-blog/wp-includes/js/jquery/ 87 KB
30 KB 48ms
48ms Script
application/javascript 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Requested by

Host: www.intego.com
URL: https://www.intego.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 724
alt-svc: h3=":443"; ma=86400
content-length: 30908
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "15db1-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a76ad48f41-FRA
expires: Tue, 01 Oct 2024 05:49:20 GMT

GET
H3 200 logo2.png
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/ 3 KB
3 KB 27ms
27ms Image
image/webp 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/logo2.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/wrapper.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e3faa302181b852e63034b619d928577e5e641d8502b630dd654cc6f0aa18ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/wrapper.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 327
cf-polished: origFmt=png, origSize=3741
content-disposition: inline; filename="logo2.webp"
alt-svc: h3=":443"; ma=86400
content-length: 2892
cf-bgj: imgq:85,h2pri
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "e9d-61ce4490d6600"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a76ad58f41-FRA
expires: Tue, 01 Oct 2024 05:55:57 GMT

GET
H3 200 blog_header_bg.gif
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/ 3 KB
3 KB 40ms
40ms Image
image/webp 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/blog_header_bg.gif

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

17aebab8504111847bb14d190557397752564704ba02e65f98c5fde9995fc834

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 327
cf-polished: origFmt=gif, origSize=5992
content-disposition: inline; filename="blog_header_bg.webp"
alt-svc: h3=":443"; ma=86400
content-length: 3064
cf-bgj: imgq:85,h2pri
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "1768-61ce4490d6600"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a76ad68f41-FRA
expires: Tue, 01 Oct 2024 05:55:57 GMT

GET
H3 200 share_divider.png
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/ 166 B
458 B 39ms
39ms Image
image/webp 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/share_divider.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ffa8b5c0d78def1b71617c0ae00e01b295bc29e2e227ba0dc84469a9ba39259c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 228
cf-polished: origFmt=png, origSize=1219
content-disposition: inline; filename="share_divider.webp"
alt-svc: h3=":443"; ma=86400
content-length: 166
cf-bgj: imgq:85,h2pri
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "4c3-61ce4490d6600"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a76ad88f41-FRA
expires: Tue, 01 Oct 2024 05:57:36 GMT

GET
H3 200 sidebar_divider.jpg
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/ 154 B
456 B 40ms
39ms Image
image/webp 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/sidebar_divider.jpg

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

25b786ec50525130cddd67183bc696608e1fc88651fe5d1d953667e9f4643c4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 327
cf-polished: qual=85, origFmt=jpeg, origSize=1779
content-disposition: inline; filename="sidebar_divider.webp"
alt-svc: h3=":443"; ma=86400
content-length: 154
cf-bgj: imgq:85,h2pri
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "6f3-61ce4490d6600"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a77ad98f41-FRA
expires: Tue, 01 Oct 2024 05:55:57 GMT

GET
DATA 200
OK truncated
/ 529 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8ecf7fe958f132008eb2eaeda1a079451a62372838a6c18d9e1353f64e48172a

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 558 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 93b94b74b73c37bcb3e6d8cada57b5ce45d7bd3fe5e3b2b6194a702d1353e1a0

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 978 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 62d2cc93ab8f52afb7379b9fabdc6f383f7700367cda04191ad1a8158c449c23

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 746 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 114773206c8b1ef17f1865f1fd0acb5ee36aa4f666718144698063fd295a0f65

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 124d5d7d1a1e13e129ad8ffbba218f6fd857f706d9af89d05d2686a0627ce127

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 8vIQ7wUr0m80wwYf0QCXZzYzUoTg_T6h.woff2
fonts.gstatic.com/s/redhatdisplay/v19/ 28 KB
29 KB 47ms
6ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/redhatdisplay/v19/8vIQ7wUr0m80wwYf0QCXZzYzUoTg_T6h.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Red+Hat+Display:wght@400;600;700;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25ea6c91f8fbcbd412919dbb47da3e432622997eb37a3139fad5d21d59135962

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.intego.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 10 Sep 2024 12:00:59 GMT
x-content-type-options: nosniff
age: 583225
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29072
x-xss-protection: 0
last-modified: Thu, 24 Aug 2023 21:14:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 10 Sep 2025 12:00:59 GMT

GET
H3 200 DagnyWebPro.woff
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/ 39 KB
39 KB 40ms
39ms Font
font/woff 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/DagnyWebPro.woff

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

364c1179390530ea06c6636e2f314aa1091d460c4c6e369c6689a0fe31672054

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
Origin: https://www.intego.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2966
alt-svc: h3=":443"; ma=86400
content-length: 40116
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "9cb4-61ce4490d6600"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a78af48f41-FRA
expires: Tue, 01 Oct 2024 05:11:57 GMT

GET
H3 200 fontawesome-webfont.woff
netdna.bootstrapcdn.com/font-awesome/3.1.1/font/ 34 KB
34 KB 36ms
24ms Font
font/woff 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://netdna.bootstrapcdn.com/font-awesome/3.1.1/font/fontawesome-webfont.woff?v=3.1.0

Requested by

Host: netdna.bootstrapcdn.com
URL: https://netdna.bootstrapcdn.com/font-awesome/3.1.1/css/font-awesome.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4e58b78b5844a988d67532b4683a6e8b3235b3d56d319727e65f460805bbdec4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://netdna.bootstrapcdn.com/font-awesome/3.1.1/css/font-awesome.css
Origin: https://www.intego.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 1078
age: 1890640
cdn-cachedat: 06/15/2024 17:20:08
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 34420
last-modified: Mon, 25 Jan 2021 22:04:51 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: "9434b081ed2d237abfe96e832592ef15"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 6df70f3ea363dc023bbc9fd9ed21b922
accept-ranges: bytes
timing-allow-origin: *
cdn-requestcountrycode: US
cdn-status: 200
cf-ray: 8c46e1a7aa66d264-FRA
cdn-requestpullsuccess: True

GET
H3 200 DagnyWebPro-Bold.woff
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/ 40 KB
40 KB 41ms
40ms Font
font/woff 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/DagnyWebPro-Bold.woff

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

142bb04454d6124c28f12d43249615ae8903c9742ea86c024ef0602f4dd1446e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
Origin: https://www.intego.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2510
alt-svc: h3=":443"; ma=86400
content-length: 40940
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "9fec-61ce4490d6600"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a78af58f41-FRA
expires: Tue, 01 Oct 2024 05:19:34 GMT

GET
DATA 200
OK truncated
/ 7 KB
7 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5e7d52bf5f53348ca036d8381f04bb01c93b3110ccac87ca3cb75fd1ce0a92c6

Request headers

Referer
Origin: https://www.intego.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ 15 KB
15 KB 44ms
4ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:200,400,700,200italic,400italic,700italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.intego.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sat, 14 Sep 2024 01:33:44 GMT
x-content-type-options: nosniff
age: 275260
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 14 Sep 2025 01:33:44 GMT

GET
H3 200 btn_search.png
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/ 1 KB
0 0ms
0ms Image
image/webp 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/btn_search.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

85c1eb2c2a173feceba14abe8344fe9c7cb12aa1353f083f28a62f1a366763b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 327
cf-polished: origFmt=png, origSize=2462
content-disposition: inline; filename="btn_search.webp"
alt-svc: h3=":443"; ma=86400
content-length: 1104
cf-bgj: imgq:85,h2pri
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "99e-61ce4490d6600"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a6a9f78f41-FRA
expires: Tue, 01 Oct 2024 05:55:57 GMT

GET
H3 200 evil-rat-macos-malware-emerging-jumping-from-apple-macbook-pro-600x400-1.jpg
www.intego.com/mac-security-blog/wp-content/uploads/2024/09/ 39 KB
40 KB 36ms
34ms Image
image/jpeg 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2024/09/evil-rat-macos-malware-emerging-jumping-from-apple-macbook-pro-600x400-1.jpg

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

86a9de4e1dd6d002b1f6adb84200766b15f0fac31f6b5b49907b6f71af061c11

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 0
cf-polished: degrade=85, origSize=101605, status=webp_bigger
alt-svc: h3=":443"; ma=86400
content-length: 40381
cf-bgj: imgq:85,h2pri
last-modified: Thu, 05 Sep 2024 15:48:49 GMT
server: cloudflare
etag: "18ce5-621613a05bef2"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a78af08f41-FRA
expires: Tue, 01 Oct 2024 06:01:24 GMT

GET
H3 200 X9-Mac-Antivirus-Launch-300x150.png
www.intego.com/mac-security-blog/wp-content/uploads/2016/06/ 27 KB
28 KB 38ms
37ms Image
image/webp 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2016/06/X9-Mac-Antivirus-Launch-300x150.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

25aa0b7b8ad904efa464dc2b11da0975d77ef2ba0eb747b06b72c738b95e581d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 0
cf-polished: origFmt=png, origSize=47876
content-disposition: inline; filename="X9-Mac-Antivirus-Launch-300x150.webp"
alt-svc: h3=":443"; ma=86400
content-length: 27938
cf-bgj: imgq:85,h2pri
last-modified: Mon, 20 Jun 2016 03:34:07 GMT
server: cloudflare
etag: "bb04-535ad606e29c0"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a78af28f41-FRA
expires: Tue, 01 Oct 2024 06:01:23 GMT

GET
H3 200 wp-emoji-release.min.js Show response
www.intego.com/mac-security-blog/wp-includes/js/ 18 KB
5 KB 25ms
24ms Script
application/javascript 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/mac-security-blog/wp-includes/js/wp-emoji-release.min.js?ver=5.8.1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2510
alt-svc: h3=":443"; ma=86400
content-length: 4930
last-modified: Wed, 10 Jul 2024 13:04:24 GMT
server: cloudflare
etag: "4705-61ce4490d6600-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a81b6b8f41-FRA
expires: Tue, 01 Oct 2024 05:19:34 GMT

GET
H3 200 favicon.ico
www.intego.com/sites/all/themes/intego_3/dist/favicons/ 401 KB
89 KB 30ms
30ms Other
image/vnd.microsoft.icon 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/sites/all/themes/intego_3/dist/favicons/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

04f5e859d2634d401e0b1e6f9a8d3abab7a5d10919e4a3aee96b7d5b90c25aec

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 10 Jul 2024 13:04:27 GMT
server: cloudflare
age: 327
etag: W/"643e6-61ce4493b2cc0"
vary: Accept-Encoding
content-type: image/vnd.microsoft.icon
cache-control: max-age=1209600
cf-ray: 8c46e1a81b728f41-FRA
alt-svc: h3=":443"; ma=86400
expires: Tue, 01 Oct 2024 05:55:57 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 345 KB
110 KB 72ms
39ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-9WJ8

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2ccb4781d7fc97c3eabcbe62d9e8238f553d53f2fa1670e635d334639e1dda44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 112079
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 17 Sep 2024 06:01:24 GMT

GET
H3 400 / Show response
graph.facebook.com/ 202 B
319 B 117ms
106ms XHR
application/json 2a03:2880:f084:10d:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?id=https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:10d:face:b00c:0:2 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d90f7e2ab58fab474b8e48abd530efbef986c5653a21885837ab8298667aff0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
date: Tue, 17 Sep 2024 06:01:24 GMT
www-authenticate: OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
x-fb-rev: 1016547595
alt-svc: h3=":443"; ma=86400
content-length: 202
proxy-status: http_request_error; e_proxy="AcIGhH805J4x6RPPHzZqYdIiwq1MWsxmN_7_p_sgb0GRxYJPSM7nKSeTejMwJc9oNr5sxxhSAjXGJgMyso4"; e_fb_binaryversion="AcLFMH9nAhCBQhb00YCZYXvxeRLbXGllCeRa0neHLyAuK3Dxvaarl2ySeF5f6J_fdQm2N3fzF1FK4AxzAVo1VQAp27i4CtNCjgA"; e_fb_httpversion="AcL4aiEEY6AIkCz_pXEC0OgcxBJembDH0sSsUaVaCVmjTDZ6byyPTdYbdbDq"; e_fb_responsebytes="AcKSSCUZ-hU-mtvQNh2wXaEpU_oht920joiXdXokrki5pIGArEM7Uk_Aaf6S"; e_fb_requesttime="AcIJheMaGO2YfA7-FiBHW3pXAopWiMI9QubEs5MFP0I8ZNUdlnayBTJxndn8DcDWnPpSFRVahg"; e_fb_requesthandler="AcKB9SSSpva8uKqHUjFjm17ZAU11u1kHGB1-mVHLkCpnBkkfmBIlcMnI42XwX_vrBm4qfjQwFDk"; e_fb_hostheader="AcLzwjIQMtZ5CMBwK6EweNLv5mAiu6E0eYLq_zTAkZU-U9ifB3BOG0LfXy3q_h-7NHPgq5d3MYGRPwCQ"; e_fb_requestsequencenumber="AcLCqG4M0zzZ3QgnwBY3Ekacnco9qDoLahr6R3Od5l2q3i8gTs6xcS89tgaZ"; e_upip="AcKt_4BFttASE9iwsn84OXshdCx8_ZQf5mEPGDoE-RgfYoiPtcUYdHiV9Yn4dgnkaKGxU3YjgeVkTzFzv5qqzaLIaZ9qJfdxYYxUj54"; e_fb_builduser="AcJzXUunLGVEqCHenM6-AgDByZ8yAQcJAqlE-Q6MLMMCaP_h63tntlang4M-B8hdtVM"; e_fb_vipport="AcIhq7KgseLuGRh50xBAB-60b7OjDV8WAEqnGy2OQbvPVRcYTHamapxQIuOO"; e_clientaddr="AcI0gnzQD1EVMQd1G0uL_cYQISlZnnHTXb6UhFNxrXyZ0jNEtOBqZjEm1-DVp60TQgEFefFD61S_Il_SYJ14vBUNw5fXSguBwvn-eKePjKwV2SENZA"; e_fb_vipaddr="AcKSb_aS0zuMHjIqYMWC5fqlChOJgsDIa9hredwBDaIXSTOCYHs3mb1mB9_iw4VHNJlotnJMgH_5GTxueRoiwYJqxp9WbltRLQ"; e_fb_configversion="AcK_8dQO_WLETpCLuAheVHOfr8hcPoCJAQ-BmRy5ZaJB7vhk0zyR6i0ItFv7Qw", http_request_error; e_proxy="AcKejDx5ATnr9Mo9wBuT_zxaUSMB6nE7nOIOJOElsg1dDpQQTtx_CdCVci4XHBB4QwXzxmcHiaJXS7c"; e_fb_binaryversion="AcL6HSjNPHMV8RkUhJnAoumw8Zn8ledZBRyC8TJzVg7-DjMr_FuoFZyPB7enkZGmtRpfz0oRII__0Z7YowOeaRXN4Y_o4_zVoKU"; e_fb_httpversion="AcJuPK0nJJ13zvpz0x9NM0M6FrwwL-ikXQ97aPJdbcdA0ZPLmCnKCjxPJrMb"; e_fb_responsebytes="AcJx9u2RdWgcKYsHSyv0JwpgIO_Z3gDgjFXqW1S5iWGoSc9M5OQOMx0ae9ay"; e_fb_requesttime="AcL_R6TeujzD5JqGv7iDgazPGGjCdHP4CLIeBImpaWnK4cxrVgy12jgVHGA6sHVHQQSHUpj6Ag"; e_fb_requesthandler="AcIqVvPjLjmHdGLQQFeo9uKkosdIXo_sQkBdjWpk7rBYD3r5sHY4zON_o6XLzA83DFxQtIe-peE"; e_fb_hostheader="AcLV7id_GgpMqMQuPkhPTT-qq01_zEzsQF5Ryx-RRthb5NYBcQPkO4nE6NNEQgWs_BsHqZsEWahMxsj3"; e_fb_requestsequencenumber="AcLYPzD_vPq9UUjNF7uOb3RQeIBHvlKT4XRpS7XpKL0c8VPzP3jTUuu2ZA"; e_upip="AcJgdvN74aUXqODsaLPKhS_MHP5mnqxO2HJ_KyAAOLumOOruRIsTgf5D3vdO7oHkV3VvL5-yKHee2Q-bcBO01MhOvOBYgR2FSQ"; e_fb_builduser="AcJDa4ByO9O6asMGFbYhHVDjRV1siGaIkzx8ss71iBE4hvb_CR0XLKLPrEPAH6Ku-Uo"; e_fb_vipport="AcJdCBtFy2UVekFL7VJokDRaCitKjvhStPDXWLHTFS8QPXRNiwapKk-RyXD_"; e_clientaddr="AcLFGUzsLsi-Y17iZg_QjS8pULOGJVz0jCa54D4IstFQW0NHX_wx_UoKM2XRWjCFMdFdZeAnLCnzuQMpAcDXt_YJpPRFbbV7zxozBGS2gUBgUml2XQ"; e_fb_vipaddr="AcK7KMO3iOaY1zfVLco-i0GI_yDTbVr2xgTpTHg1h-rWyGiQP-7-kyd9JdB1RRwJYO3MkNJp2Gpj5s5ibtXzKBloQHJmkxFY_rQ"; e_fb_configversion="AcL5hDsrn7LDA3cIbbsqmLOCrxEAC_CcP-5OouO33YN9wOj8L-RiOHKlTvqfLA"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=23, mss=1232, tbw=4743, tp=11, tpl=0, uplat=98, ullat=0
pragma: no-cache
x-fb-debug: NJaGObOTSyvIcmO1GEXU/7Rg0ok2SYTFLyF4H3u0YqfCxBVrWskCCsQH/N2IhiEam3VZQCqtQlld81Fq7EEMZA==
x-fb-trace-id: HjCLntlKAD5
vary: Origin
content-type: application/json
access-control-allow-origin: *
x-fb-request-id: AtVQY7D9HlsDUo5j2FLO7Ns
cache-control: no-store
facebook-api-version: v14.0
priority: u=1,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET share
www.linkedin.com/countserv/count/ 0
0

GET
H2 200 count.json Show response
widgets.pinterest.com/v1/urls/ 169 B
415 B 141ms
111ms Script
application/javascript 151.101.128.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://widgets.pinterest.com/v1/urls/count.json?source=6&url=https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/&callback=jQuery360031834296895894654_1726552884494&_=1726552884495

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.128.84 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

59009a0ebea68200d54d87920329794d3b3f0babc949985aba45d97892f66cf2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
x-content-type-options: nosniff
x-pinterest-rid-128bit: 819f856b0167ff3acfe7e89c1e53b539
age: 0
vary: accept-encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: must-revalidate, max-age=887
x-envoy-upstream-service-time: 1
accept-ranges: none
x-pinterest-rid: 1498119844269258
expires: Tue, 17 Sep 2024 06:16:24 GMT

GET
H/1.1 200
OK count.js Show response
macsecurityblog.disqus.com/ 1 KB
2 KB 34ms
6ms Script
application/javascript 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://macsecurityblog.disqus.com/count.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.22

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Tue, 17 Sep 2024 06:01:24 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=300; includeSubdomains
X-Amz-Cf-Pop: SFO53-P1
Age: 294
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 871
X-XSS-Protection: 1; mode=block
Last-Modified: Thu, 12 Sep 2024 22:00:42 GMT
Server: nginx
ETag: "66e3648a-367"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=300
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
X-Amz-Cf-Id: cWLDBMdeexwwP4APPZBbjSirWQ8jbQmHI9rKbws6W1KQwD9VikbCUA==

GET
H/1.1 200
OK embed.js Show response
macsecurityblog.disqus.com/ 80 KB
26 KB 36ms
8ms Script
application/javascript 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://macsecurityblog.disqus.com/embed.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.22

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

290856b9bc3e0cf50e6f630c7416dc3bc3caef40679ea07d4e6e2b1c2bf9edce

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
Strict-Transport-Security: max-age=300; includeSubdomains
server: openresty
Age: 0
Vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
Cache-Control: private, max-age=60
x-service: router
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 26332

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 91 KB
28 KB 61ms
15ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6BC5) /
Resource Hash: 173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Tue, 17 Sep 2024 06:01:24 GMT
Content-Encoding: gzip
Age: 1394
x-amz-server-side-encryption: AES256
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length: 27597
Last-Modified: Mon, 11 Dec 2023 17:20:28 GMT
Server: ECS (amb/6BC5)
Etag: "824beb891744db98ccbd3a456e59e0f7+gzip"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
x-tw-cdn: VZ
Cache-Control: public, max-age=1800
Vary: Accept-Encoding

GET
H2 200 g.gif
pixel.wp.com/ 50 B
177 B 18ms
14ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A10.2.1&blog=72832157&post=101625&tz=-7&srv=www.intego.com&host=www.intego.com&ref=&fcp=251&rand=0.6583757405875263
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 17 Sep 2024 06:01:24 GMT
cache-control: no-cache
server: nginx
alt-svc: h3=":443"; ma=86400
content-length: 50
content-type: image/gif

GET
H3 200 / Show response
graph.facebook.com/ 244 B
359 B 111ms
103ms Script
text/javascript 2a03:2880:f084:10d:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/plugins/jetpack/_inc/build/sharedaddy/sharing.min.js?ver=10.2.1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:10d:face:b00c:0:2 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

97b796342ac8ee4b187d88096c3f5f8b79cd306392e13280978ab9296104c2db

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
date: Tue, 17 Sep 2024 06:01:24 GMT
www-authenticate: OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
x-fb-rev: 1016547595
alt-svc: h3=":443"; ma=86400
content-length: 244
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=5, rtx=0, c=23, mss=1232, tbw=4446, tp=9, tpl=0, uplat=96, ullat=0
pragma: no-cache
x-fb-debug: Sy9e/xUJVVJ9eamA/WYGo37v/BwsPJP3tamK7WTwSQgiIw5NCyEYVI0Eb1StXWcDvBhBZiTR26FT0MLJEZU5GQ==
x-fb-trace-id: GNezYRiAQI3
vary: Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: AZMbDYwxRGE6txJkWQXOmCk
cache-control: no-store
facebook-api-version: v14.0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 pici.png
www.intego.com/mac-security-blog/wp-content/uploads/2021/05/ 35 KB
35 KB 25ms
23ms Image
image/webp 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/mac-security-blog/wp-content/uploads/2021/05/pici.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0590a5e32234930923f899ff7d662b436300c40ff463dba142b7984ad16c987f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1773
cf-polished: origFmt=png, origSize=58478
content-disposition: inline; filename="pici.webp"
alt-svc: h3=":443"; ma=86400
content-length: 35876
cf-bgj: imgq:85,h2pri
last-modified: Mon, 24 May 2021 09:25:34 GMT
server: cloudflare
etag: "e46e-5c30ffddbf057"
vary: Accept
content-type: image/webp
cache-control: max-age=1209600
accept-ranges: bytes
cf-ray: 8c46e1a84b998f41-FRA
expires: Tue, 01 Oct 2024 04:53:17 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
177 B 16ms
13ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.6516246950829876
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 17 Sep 2024 06:01:24 GMT
cache-control: no-cache
server: nginx
alt-svc: h3=":443"; ma=86400
content-length: 50
content-type: image/gif

POST
H3 204 rum Show response
www.intego.com/cdn-cgi/ 0
140 B 17ms
16ms XHR
text/plain 2606:4700::6812:6a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.intego.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:6a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
content-type: application/json

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://www.intego.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 8c46e1a84b9a8f41-FRA

GET
H/1.1 200
OK recommendations.js Show response
macsecurityblog.disqus.com/ 64 KB
22 KB 9ms
8ms Script
application/javascript 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://macsecurityblog.disqus.com/recommendations.js

Requested by

Host: macsecurityblog.disqus.com
URL: https://macsecurityblog.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

083bc6f464e7b0a1e4ac7aa3efe3e0239129289effb2c4706b289e7eb79d9018

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
Strict-Transport-Security: max-age=300; includeSubdomains
server: openresty
Age: 0
Vary: Accept-Encoding, Accept, Accept-Encoding, X-Forwarded-Proto, X-Disqus-Shortname, X-Disqus-Device, X-Disqus-Experiment, X-Disqus-Is-Private, X-Disqus-Development-Base
content-type: application/javascript; charset=utf-8
cache-control: stale-while-revalidate=60, public, stale-if-error=86400, max-age=60
x-service: router
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 21419

GET
H/1.1 200
OK widget_iframe.2f70fb173b9000da126c79afe2098f02.html
platform.twitter.com/widgets/ Frame ACED 0
0 55ms
15ms Document
text/html 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2f70fb173b9000da126c79afe2098f02.html?origin=https%3A%2F%2Fwww.intego.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6BB1) /
Resource Hash

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 15204507
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 105429
Content-Type: text/html; charset=utf-8
Date: Tue, 17 Sep 2024 06:01:24 GMT
Etag: "81267302efdfb3e4524a22631a8fc99e+gzip"
Last-Modified: Mon, 11 Dec 2023 17:19:49 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (amb/6BB1)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary: Accept-Encoding
X-Cache: HIT
x-amz-server-side-encryption: AES256
x-tw-cdn: VZ

GET
H2 200 destination Show response
www.googletagmanager.com/gtag/ 242 KB
86 KB 25ms
25ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-1060047950&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-9WJ8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

50f38616fc1300ec75c4b1f0abc85269c53e47f22e4c5ba7ef674398a12d6e21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 88054
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 17 Sep 2024 06:01:24 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 37ms
11ms Script
text/javascript 2001:4860:4802:32::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-9WJ8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 17 Sep 2024 05:20:02 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 2482
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Tue, 17 Sep 2024 07:20:02 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 49 KB
14 KB 66ms
30ms Script
application/javascript 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

60ed45fe20ede817f77c4e774e77fd9a9a4f4046c67456f1442eac2095918438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Tue, 17 Sep 2024 06:01:24 GMT
last-modified: Fri, 06 Sep 2024 21:17:16 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C2ED70652B064902BA83781F4D93DF7B Ref B: FRAEDGE1617 Ref C: 2024-09-17T06:01:24Z
etag: "016326a20db1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 14305

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 225 KB
58 KB 17ms
8ms Script
application/x-javascript 2a03:2880:f084:105:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0055aa18da3581f4a468aaa7257d84f798e0fc070899c8008d9b321b76b98096

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 17 Sep 2024 06:01:24 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 58953
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=23, mss=1232, tbw=4444, tp=9, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: D5KxyhoSWQdoeGWnhdP2lDcv1wIIRXZ2vearzPMvDlbu+oh6gvofTU7dGcbEnUJaHVnsgz2c49Paw9U2GYnYWA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
x-fb-optimizer: 0
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 aquant.js Show response
secure.quantserve.com/ 23 KB
10 KB 35ms
11ms Script
application/javascript 2620:116:800d:21:7eb1:3826:be7e:d981
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/aquant.js?a=p-NVNd7-g373ynZ
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:7eb1:3826:be7e:d981 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 76c46df9a6ba94318fafe8023e3f52e28b1b9a1eaf16dcd4d7ce95ab6942859b

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
etag: "tIg8n6xaLBY4WwNLLw9OGA=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Tue, 24 Sep 2024 06:01:24 GMT

GET
H2 200 conversion.js Show response
s.yimg.jp/images/listing/tool/cv/ 6 KB
2 KB 771ms
256ms Script
application/javascript 182.22.16.251
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.yimg.jp/images/listing/tool/cv/conversion.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-9WJ8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 182.22.16.251 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: nghttpx /
Resource Hash: 9e3a9103c80346b1b39bea3de46f44a462b3f594fa45e7206252bc41d7e3e855

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Tue, 17 Sep 2024 05:55:58 GMT
content-encoding: gzip
last-modified: Tue, 25 Jan 2022 16:25:04 GMT
server: nghttpx
accept-ch: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch
age: 327
vary: Accept-Encoding
content-type: application/javascript
x-z-chihaya: r=1
x-ntap-sg-trace-id: 93caf17fd5d21a39
cache-control: public, max-age=600
permissions-policy: ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform-version=*, ch-ua-arch=*
content-length: 2140

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 242 KB
86 KB 24ms
23ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1060047950

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-9WJ8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b0df50ee2718ec324a762d8ba95e644a2768c4d0a6cd66ee7f248659a1472ee5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 87954
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 17 Sep 2024 06:01:24 GMT

GET
H/1.1 200
OK /
disqus.com/embed/comments/ Frame A310 0
0 143ms
95ms Document
text/html 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/embed/comments/?base=default&f=macsecurityblog&t_i=101625%20https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2F%3Fp%3D101625&t_u=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&t_e=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs&t_d=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs&t_t=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs&s_o=default

Requested by

Host: macsecurityblog.disqus.com
URL: https://macsecurityblog.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.192.134 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Age: 0
Cache-Control: stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 2971
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Content-Type: text/html; charset=utf-8
Cross-Origin-Resource-Policy: cross-origin
Date: Tue, 17 Sep 2024 06:01:24 GMT
ETag: W/"lounge:view:10310437447.5b26dd663183accb3ee3a883a3254b53.2"
Last-Modified: Thu, 05 Sep 2024 17:14:48 GMT
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Referrer-Policy: no-referrer-when-downgrade
Server: nginx
Strict-Transport-Security: max-age=300; includeSubdomains
Timing-Allow-Origin: *
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"

GET
H2 200 rules-p-NVNd7-g373ynZ.js Show response
rules.quantcount.com/ 1 KB
1 KB 83ms
14ms Script
application/javascript 2600:9000:223c:4e00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-NVNd7-g373ynZ.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/aquant.js?a=p-NVNd7-g373ynZ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:4e00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: dfc988a3bfd2d7c74069ed4414fb522a7f9b6536767f897ab15773772f517d17

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: gzip
via: 1.1 666eddda46892ed48d8d771b6142ac24.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 965
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
last-modified: Thu, 13 Oct 2022 16:28:24 GMT
server: AmazonS3
etag: W/"4395cced20ab623d7e83cebf7caf109d"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
x-amz-cf-id: f2vR5NR_MAxOC4Z0zzaQOGLe4lU0Gi36R_9TednG8IbZv_XUKwZ2RA==

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
220 B 18ms
16ms XHR
text/plain 2001:4860:4802:32::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1472648342&t=pageview&_s=1&dl=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&ul=de-de&de=UTF-8&dt=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Security%20Blog&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAiAABDAAAAC~&jid=15352702&gjid=1570556908&cid=1931877227.1726552885&tid=UA-1724183-7&_gid=1878595979.1726552885&_slc=1&gtm=45He4990n519WJ8v564007za200&cg3=&cd3=!!!!&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=0&npa=1&z=491184604

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

4ba8349bee5aa103d984f9ca66a1c4e268c7fba177b94909e3b5ba91895ead83

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.intego.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
345 B 89ms
27ms XHR
text/plain 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-1724183-7&cid=1931877227.1726552885&jid=15352702&gjid=1570556908&_gid=1878595979.1726552885&npa=1&_u=YGBAiAABDAAAAG~&z=1439642129

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.intego.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 731235797425639 Show response
connect.facebook.net/signals/config/ 73 KB
15 KB 16ms
11ms Script
application/x-javascript 2a03:2880:f084:105:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/731235797425639?v=2.9.167&r=stable&domain=www.intego.com&hme=da9a399065fb1c492026018b9e54864148adfb49d800f41752428fb7b59190f8&ex_m=69%2C118%2C104%2C108%2C60%2C4%2C97%2C68%2C16%2C94%2C86%2C50%2C53%2C168%2C171%2C183%2C179%2C180%2C182%2C29%2C98%2C52%2C75%2C181%2C163%2C166%2C176%2C177%2C184%2C127%2C40%2C34%2C139%2C15%2C49%2C190%2C189%2C129%2C18%2C39%2C1%2C42%2C64%2C65%2C66%2C70%2C90%2C17%2C14%2C93%2C89%2C88%2C105%2C51%2C107%2C38%2C106%2C30%2C91%2C26%2C164%2C167%2C136%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C56%2C61%2C63%2C73%2C99%2C27%2C74%2C9%2C8%2C78%2C47%2C21%2C101%2C100%2C102%2C95%2C10%2C20%2C3%2C19%2C83%2C55%2C81%2C33%2C72%2C0%2C92%2C32%2C80%2C85%2C46%2C45%2C84%2C37%2C5%2C87%2C79%2C43%2C35%2C82%2C2%2C36%2C62%2C41%2C103%2C44%2C77%2C67%2C109%2C59%2C58%2C31%2C96%2C57%2C54%2C48%2C76%2C71%2C24%2C110

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f4ff93db88831a4ecb9f857317c4fce2b24c426788a094c84787526c6c183950

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 17 Sep 2024 06:01:24 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 14742
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=74, mss=1232, tbw=67084, tp=62, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: fw/iAAarAPNiOnQoWwjAwxxko3cCjC3KOi9QxvdkieWJSDEgqXpCB+nf7UgpROUoYs/peG+HxhqqoKTVzaCqhw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK /
disqus.com/recommendations/ Frame C039 0
0 141ms
111ms Document
text/html 151.101.192.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/recommendations/?base=default&f=macsecurityblog&t_i=101625%20https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2F%3Fp%3D101625&t_u=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&t_e=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs&t_d=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs&t_t=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs

Requested by

Host: macsecurityblog.disqus.com
URL: https://macsecurityblog.disqus.com/recommendations.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

151.101.192.134 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Age: 0
Cache-Control: stale-while-revalidate=30, no-cache, must-revalidate, stale-if-error=3600, public
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 2381
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Content-Type: text/html; charset=utf-8
Cross-Origin-Resource-Policy: cross-origin
Date: Tue, 17 Sep 2024 06:01:24 GMT
Last-Modified: Thu, 03 Nov 2022 16:35:53 GMT
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Server: nginx
Strict-Transport-Security: max-age=300; includeSubdomains
Timing-Allow-Origin: *
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 296 KB
98 KB 61ms
58ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-QWFMBN7P7H&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

98a147e6c25bb2d177fca65de16003a57ab9c859402790bfa54e6b8ef86662fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Tue, 17 Sep 2024 06:01:24 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 99832
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 17 Sep 2024 06:01:24 GMT

GET
H2 200 4033358.js Show response
bat.bing.com/p/action/ 369 B
424 B 32ms
30ms Script
application/javascript 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/4033358.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

1436939ed29c528098b948903ff835b1f1066a45afc277c43053a25964d1761c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
date: Tue, 17 Sep 2024 06:01:24 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 724C1CDC89CC455BAF4C1EE1520C8A2F Ref B: FRAEDGE1617 Ref C: 2024-09-17T06:01:24Z
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
cache-control: private,max-age=1800

GET
H2 200 /
www.facebook.com/tr/ 0
273 B 49ms
6ms Image
text/plain 2a03:2880:f177:185:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=731235797425639&ev=ViewContent&dl=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&rl=&if=false&ts=1726552884742&sw=1600&sh=1200&v=2.9.167&r=stable&ec=1&o=12318&fbp=fb.1.1726552884740.970741619406293489&cs_est=true&est_source=757774251754991&ler=empty&cdl=API_unavailable&it=1726552884703&coo=false&es=automatic&tm=3&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=5, rtx=0, c=10, mss=1328, tbw=2822, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 17 Sep 2024 06:01:24 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 191ms
148ms Image
image/png 2a03:2880:f177:185:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=731235797425639&ev=ViewContent&dl=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&rl=&if=false&ts=1726552884742&sw=1600&sh=1200&v=2.9.167&r=stable&ec=1&o=12318&fbp=fb.1.1726552884740.970741619406293489&cs_est=true&est_source=757774251754991&ler=empty&cdl=API_unavailable&it=1726552884703&coo=false&es=automatic&tm=3&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com:* wss://.fbcdn.net attachment.fbsbx.com blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ .fbsbx.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: .oculuscdn.com https://paywithmybank.com/ https://.paywithmybank.com/;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data:;frame-src .facebook.com .fbsbx.com fbsbx.com data: .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: zstd
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; preload
date: Tue, 17 Sep 2024 06:01:24 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7415488172972051278", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=10, mss=1328, tbw=3171, tp=-1, tpl=-1, uplat=143, ullat=0
pragma: no-cache
x-fb-debug: 97j/0SHNJ8MJR2IQW45+LLIqVFwFWL3miDMr45f7TerfewES2a5RGXq0wAyuOJ5B9yz0vFxZqlpU4D7DlceLJQ==
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7415488172972051278"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/png
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: private, no-store, no-cache, must-revalidate
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
32 B 49ms
5ms Image
text/plain 2a03:2880:f177:185:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=731235797425639&ev=PageView&dl=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&rl=&if=false&ts=1726552884743&sw=1600&sh=1200&v=2.9.167&r=stable&ec=0&o=12318&fbp=fb.1.1726552884740.970741619406293489&cs_est=true&ler=empty&cdl=API_unavailable&it=1726552884703&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-fb-connection-quality: EXCELLENT; q=0.9, rtt=5, rtx=0, c=10, mss=1328, tbw=2822, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 17 Sep 2024 06:01:24 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
1 KB 201ms
158ms Image
image/png 2a03:2880:f177:185:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=731235797425639&ev=PageView&dl=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&rl=&if=false&ts=1726552884743&sw=1600&sh=1200&v=2.9.167&r=stable&ec=0&o=12318&fbp=fb.1.1726552884740.970741619406293489&cs_est=true&ler=empty&cdl=API_unavailable&it=1726552884703&coo=false&rqm=FGET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com:* wss://.fbcdn.net attachment.fbsbx.com blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ .fbsbx.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: .oculuscdn.com https://paywithmybank.com/ https://.paywithmybank.com/;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data:;frame-src .facebook.com .fbsbx.com fbsbx.com data: .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0x09080ad7e78acc20","source_keys":["1"]}],"aggregatable_values":{"1":10922},"filters":{"2":["24:3656702261062735","7830:3656702261062735","10853:3656702261062735","41:3656702261062735","8046:3656702261062735"]},"debug_reporting":true,"debug_key":"3942574353269549349"}
content-encoding: zstd
x-content-type-options: nosniff
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
strict-transport-security: max-age=15552000; preload
document-policy: force-load-at-top
date: Tue, 17 Sep 2024 06:01:24 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7415488173590816487", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=10, mss=1328, tbw=5987, tp=-1, tpl=-1, uplat=151, ullat=0
pragma: no-cache
x-fb-debug: 7ie8yxRqnaA71+E8c0F1Fv4Cd1GuMbg7tQtrFeNmH8dPPohJeyG/Q1TLc9jqW4DLIQneTmly3cTbNLc0OpD93Q==
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7415488173590816487"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: image/png
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: private, no-store, no-cache, must-revalidate
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
177 B 48ms
26ms Image
text/plain 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=4033358&Ver=2&mid=bb83f35f-b9a0-41b3-b10a-23fbdca05079&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Security%20Blog&p=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&r=&lt=290&evt=pageLoad&sv=1&asc=D&cdb=AQAY&rn=663346

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 17 Sep 2024 06:01:24 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: BF0071D7ACE54654B254BEF26C022380 Ref B: FRAEDGE1617 Ref C: 2024-09-17T06:01:24Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel;r=381547214;labels=_fp.event.Default;rf=0;a=p-NVNd7-g373ynZ;url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F;uht=2;fp...
pixel-ssn.quantserve.com/
Redirect Chain

https://pixel.quantserve.com/pixel;r=381547214;labels=_fp.event.Default;rf=0;a=p-NVNd7-g373ynZ;url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdo...
https://pixel-ssn.quantserve.com/pixel;r=381547214;labels=_fp.event.Default;rf=0;a=p-NVNd7-g373ynZ;url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-ba...

35 B
356 B

32ms
10ms

Image
image/gif

91.228.74.159
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel-ssn.quantserve.com/pixel;r=381547214;labels=_fp.event.Default;rf=0;a=p-NVNd7-g373ynZ;url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F;uht=2;fpan=1;fpa=P0-351783850-1726552884682;pbc=;ns=0;ce=1;qjs=1;qv=15f23c9a-20240703164903;cm=;gdpr=0;ref=;d=intego.com;dst=1;et=1726552884785;tzo=-120;ogl=locale.en_US%2Ctype.article%2Ctitle.New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Secur%2Cdescription.HZ%20RAT%20is%20brand-new%20macOS%20malware%20that%20gives%20remote%20attackers%20complete%20control%20o%2Curl.https%3A%2F%2Fwww%252Eintego%252Ecom%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attacker%2Csite_name.The%20Mac%20Security%20Blog%2Cimage.https%3A%2F%2Fwww%252Eintego%252Ecom%2Fmac-security-blog%2Fwp-content%2Fuploads%2F2024%2F09%2Fevil-rat-mac%2Cimage%3Awidth.400%2Cimage%3Aheight.260;ses=02b6a8cc-eff0-4599-a99e-e974b8aa07a2;mdl=;dip=8970115b-0461-4643-811a-169fec02535f

Protocol

Server

91.228.74.159 , United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Sep 2024 06:01:24 GMT
attribution-reporting-register-trigger: {"event_trigger_data":[{"filters":[{"label":["XIs9cXuHhiR3L4rY6hRZdQ=="],"pcode":["p-NVNd7-g373ynZ"]}],"trigger_data":"1"}]}
strict-transport-security: max-age=86400
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Sep 2024 06:01:24 GMT
attribution-reporting-register-trigger: {"event_trigger_data":[{"filters":[{"label":["XIs9cXuHhiR3L4rY6hRZdQ=="],"pcode":["p-NVNd7-g373ynZ"]}],"trigger_data":"1"}]}
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://pixel-ssn.quantserve.com/pixel;r=381547214;labels=_fp.event.Default;rf=0;a=p-NVNd7-g373ynZ;url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F;uht=2;fpan=1;fpa=P0-351783850-1726552884682;pbc=;ns=0;ce=1;qjs=1;qv=15f23c9a-20240703164903;cm=;gdpr=0;ref=;d=intego.com;dst=1;et=1726552884785;tzo=-120;ogl=locale.en_US%2Ctype.article%2Ctitle.New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Secur%2Cdescription.HZ%20RAT%20is%20brand-new%20macOS%20malware%20that%20gives%20remote%20attackers%20complete%20control%20o%2Curl.https%3A%2F%2Fwww%252Eintego%252Ecom%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attacker%2Csite_name.The%20Mac%20Security%20Blog%2Cimage.https%3A%2F%2Fwww%252Eintego%252Ecom%2Fmac-security-blog%2Fwp-content%2Fuploads%2F2024%2F09%2Fevil-rat-mac%2Cimage%3Awidth.400%2Cimage%3Aheight.260;ses=02b6a8cc-eff0-4599-a99e-e974b8aa07a2;mdl=;dip=8970115b-0461-4643-811a-169fec02535f
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 52ms
12ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-QWFMBN7P7H&gtm=45je4990v9117895345za200&_p=1726552884510&_gaz=1&gcd=13l3l3l2l3l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=0&ul=de-de&sr=1600x1200&cid=1931877227.1726552885&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=ABAI&_s=1&dl=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&dt=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Security%20Blog&sid=1726552884&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&ep.ua_dimension_3=!!!!&tfd=654
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-QWFMBN7P7H&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Sep 2024 06:01:24 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.intego.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
47 B 30ms
28ms Ping
text/plain 2a00:1450:400c:c00::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-QWFMBN7P7H&cid=1931877227.1726552885&gtm=45je4990v9117895345za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l3l1&npa=1&frm=0&tag_exp=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-QWFMBN7P7H&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Sep 2024 06:01:24 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.intego.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 45ms
21ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-QWFMBN7P7H&cid=1931877227.1726552885&gtm=45je4990v9117895345za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l3l1&npa=1&frm=0&tag_exp=0&tag_exp=0&z=79411849

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Sep 2024 06:01:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK stat.gif
referrer.disqus.com/juggler/ 43 B
339 B 117ms
100ms Image
image/gif 199.232.192.134
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://referrer.disqus.com/juggler/stat.gif?event=failed_recommendations.server.undefined

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.232.192.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date: Tue, 17 Sep 2024 06:01:25 GMT
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
content-type: image/gif
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Content-Length: 43
x-xss-protection: 1; mode=block

GET conversion_async.js
b91.yahoo.co.jp/pagead/ 0
0

GET
H2 200 conversion.js Show response
s.yimg.jp/images/listing/tool/cv/ 6 KB
0 0ms
0ms Script
application/javascript 182.22.16.251
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.yimg.jp/images/listing/tool/cv/conversion.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-9WJ8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 182.22.16.251 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: nghttpx /
Resource Hash: 9e3a9103c80346b1b39bea3de46f44a462b3f594fa45e7206252bc41d7e3e855

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Tue, 17 Sep 2024 05:55:58 GMT
content-encoding: gzip
last-modified: Tue, 25 Jan 2022 16:25:04 GMT
server: nghttpx
accept-ch: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch
age: 327
vary: Accept-Encoding
content-type: application/javascript
x-z-chihaya: r=1
x-ntap-sg-trace-id: 93caf17fd5d21a39
cache-control: public, max-age=600
permissions-policy: ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform-version=*, ch-ua-arch=*
content-length: 2140

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 19 KB
7 KB 41ms
13ms Script
application/javascript 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

aebe8df81ee2ba5bc51e3abc322910ee5122a0ac06edfbcf7a04e1659d17dc9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

ats-carp-promotion: 1, 1
date: Tue, 17 Sep 2024 05:06:58 GMT
x-amz-version-id: JRuD6BVFDpXh1T7iUrCVWNpcX_ACBwVG
content-encoding: gzip
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-amz-request-id: WGX4E8A41J9XMSE8
age: 3268
x-amz-server-side-encryption: AES256
content-length: 6826
x-amz-id-2: 4R+nOkb+H6goPl3seenPlbjg+bAwNSnN48nT6vyQJra3pTEc9D58lDCZEK5GoKs2nEQmj16abJUmAoZ7HRHRt3aolzzi2DOE
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Fri, 03 Oct 2025 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Wed, 28 Aug 2024 12:33:10 GMT
server: ATS
etag: "bc033c3a83e1880e480086bf11ac0b0a-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=3600
accept-ranges: bytes

GET
H2 200 10013026.json Show response
s.yimg.com/wi/config/ 2 B
469 B 43ms
17ms XHR
application/json 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10013026.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Tue, 17 Sep 2024 05:50:33 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-amz-request-id: WJTVR6PBZRQD1NZ8
age: 652
content-length: 2
x-amz-id-2: WkGu3lmXSxiW0qrHZ5VCqLXHh4tMNedYz8FwLnIpgUJNvoZEXdyYokbhwUS0Wy+wVNhEZsXmQyM=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
cache-control: public,max-age=3600

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
508 B 105ms
34ms Image
image/gif 54.171.122.26
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Tue%2C%2017%20Sep%202024%2006%3A01%3A25%20GMT&n=-2d&b=New%20macOS%20malware%20HZ%20RAT%20gives%20attackers%20backdoor%20access%20to%20Macs%20-%20The%20Mac%20Security%20Blog&.yp=10013026&f=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fnew-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs%2F&enc=UTF-8&yv=1.16.5&tagmgr=gtm

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.171.122.26 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-171-122-26.eu-west-1.compute.amazonaws.com

Software

ATS/9.1.10.134 /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Sep 2024 06:01:25 GMT
via: http/1.1 traffic_server (ApacheTrafficServer/9.1.10.134)
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS/9.1.10.134
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Tue, 17 Sep 2024 06:01:25 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.linkedin.com
URL: https://www.linkedin.com/countserv/count/share?url=https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/&callback=jQuery360031834296895894654_1726552884492&_=1726552884493

Domain: b91.yahoo.co.jp
URL: https://b91.yahoo.co.jp/pagead/conversion_async.js

Verdicts & Comments Add Verdict or Comment

88 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

13 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.intego.com/	1970-01-20 23:35:54	Name: __cf_bm Value: D_.4aWSlgF5tWzg2BAxmnQcJnquIZ_oPfiiUvVfycPY-1726552884-1.0.1.1-fadrx6GVQG1k7aHoFb9.t7UcYEWbUM0P13.v6OHtYXFFxgDOi7jFxjzDOA.yoyVa915SXnxsD_DCNR7jOhED7g
.intego.com/	1970-01-21 01:45:28	Name: _gcl_au Value: 1.1.590235720.1726552885
.intego.com/	1970-01-21 09:11:52	Name: _ga Value: GA1.2.1931877227.1726552885
.intego.com/	1970-01-20 23:37:19	Name: _gid Value: GA1.2.1878595979.1726552885
.intego.com/	1970-01-20 23:35:52	Name: _dc_gtm_UA-1724183-7 Value: 1
.linkedin.com/	1970-01-21 08:21:28	Name: bcookie Value: "v=2&cea8f6ed-0bb5-4736-8e57-f9e267a21c01"
.www.linkedin.com/	1970-01-21 08:21:28	Name: bscookie Value: "v=1&20240917060124f31b2db3-e10c-4b83-8783-1394d94c4e51AQFssZCESfz_hCKbEJ09Knzo2ImChqc6"
.linkedin.com/	1970-01-21 03:55:04	Name: li_gc Value: MTswOzE3MjY1NTI4ODQ7MjswMjG4YuRm/1ZarFSaQvVkByxybnsYzVdZs6QTh/WxRETpwQ==
.linkedin.com/	1970-01-20 23:37:19	Name: lidc Value: "b=TGST05:s=T:r=T:a=T:p=T:g=3124:u=1:x=1:i=1726552884:t=1726639284:v=2:sig=AQFlXNJjRbxoIBhbHfxY0eADBKhfy-7l"
.intego.com/	1970-01-21 01:45:28	Name: _fbp Value: fb.1.1726552884740.970741619406293489
.quantserve.com/	1970-01-21 09:06:07	Name: mc Value: 66e91b34-c30c1-05ef6-464e7
.intego.com/	1970-01-21 09:11:52	Name: _ga_QWFMBN7P7H Value: GS1.2.1726552884.1.0.1726552884.60.0.0
.intego.com/	1970-01-21 09:00:21	Name: __qca Value: P0-351783850-1726552884682

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://graph.facebook.com/?id=https://www.intego.com/mac-security-blog/new-macos-malware-hz-rat-gives-attackers-backdoor-access-to-macs/ Message: Failed to load resource: the server responded with a status of 400 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

b91.yahoo.co.jp
bat.bing.com
connect.facebook.net
disqus.com
embed.podcasts.apple.com
fonts.googleapis.com
fonts.gstatic.com
graph.facebook.com
i0.wp.com
i2.wp.com
macsecurityblog.disqus.com
netdna.bootstrapcdn.com
pixel-ssn.quantserve.com
pixel.quantserve.com
pixel.wp.com
platform.twitter.com
referrer.disqus.com
region1.analytics.google.com
rules.quantcount.com
s.yimg.com
s.yimg.jp
s7.addthis.com
secure.quantserve.com
sp.analytics.yahoo.com
static.cloudflareinsights.com
stats.g.doubleclick.net
stats.wp.com
widgets.pinterest.com
www.facebook.com
www.google-analytics.com
www.google.de
www.googletagmanager.com
www.intego.com
www.linkedin.com
b91.yahoo.co.jp
www.linkedin.com
104.75.90.86
151.101.128.84
151.101.192.134
182.22.16.251
192.0.76.3
192.0.77.2
199.232.192.134
2001:4860:4802:32::178
2001:4860:4802:34::36
2600:9000:223c:4e00:6:44e3:f8c0:93a1
2606:2800:234:46c:e8b:1e2f:2bd:694
2606:4700::6810:5049
2606:4700::6812:6a
2606:4700::6812:bcf
2620:116:800d:21:7eb1:3826:be7e:d981
2620:1ec:33::10
2a00:1288:80:807::1
2a00:1450:4001:810::2008
2a00:1450:4001:827::200a
2a00:1450:4001:829::2003
2a00:1450:4001:82b::2003
2a00:1450:400c:c00::9a
2a01:4a0:1338:28::c38a:ff12
2a03:2880:f084:105:face:b00c:0:3
2a03:2880:f084:10d:face:b00c:0:2
2a03:2880:f177:185:face:b00c:0:25de
54.171.122.26
91.228.74.159
0055aa18da3581f4a468aaa7257d84f798e0fc070899c8008d9b321b76b98096
0140ed5069f22e4aa8bb1a1fc615c39fc55d7d64e94be541615f1c5a30ae479b
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
04f5e859d2634d401e0b1e6f9a8d3abab7a5d10919e4a3aee96b7d5b90c25aec
0590a5e32234930923f899ff7d662b436300c40ff463dba142b7984ad16c987f
083bc6f464e7b0a1e4ac7aa3efe3e0239129289effb2c4706b289e7eb79d9018
0e3faa302181b852e63034b619d928577e5e641d8502b630dd654cc6f0aa18ce
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
114773206c8b1ef17f1865f1fd0acb5ee36aa4f666718144698063fd295a0f65
124d5d7d1a1e13e129ad8ffbba218f6fd857f706d9af89d05d2686a0627ce127
142bb04454d6124c28f12d43249615ae8903c9742ea86c024ef0602f4dd1446e
1436939ed29c528098b948903ff835b1f1066a45afc277c43053a25964d1761c
143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103
1711944c7b1540085ff5f7ee6cfa0e2fb504383825d4739ec799b4fd0dd69e7d
173460e89e6a7244218badae2016f65c48a3eae9d400802273eeca18b07336f1
17aebab8504111847bb14d190557397752564704ba02e65f98c5fde9995fc834
25aa0b7b8ad904efa464dc2b11da0975d77ef2ba0eb747b06b72c738b95e581d
25b786ec50525130cddd67183bc696608e1fc88651fe5d1d953667e9f4643c4d
25ea6c91f8fbcbd412919dbb47da3e432622997eb37a3139fad5d21d59135962
266fc6c7a849c593382767fc93937cd9fecf56a5c7abac6b938153f001a2359a
290856b9bc3e0cf50e6f630c7416dc3bc3caef40679ea07d4e6e2b1c2bf9edce
29c6beffd42fb25d6fe9ba5dd7c5a0262c9fab9e113de7c624e62fd3ed8ed41e
2ccb4781d7fc97c3eabcbe62d9e8238f553d53f2fa1670e635d334639e1dda44
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
364c1179390530ea06c6636e2f314aa1091d460c4c6e369c6689a0fe31672054
39511dff8f9d64434df213852f4f6a8964847c8e086da423e336b10ae422b678
3b302bf527209ab634a379dc27b9a22838e88001e24df759794f13f2810725e6
3fb4cab423b2441335fc682b79687d8eb806aceb384c937c9b28534580593fd4
42b34f0823b708cc37e194c980748a6cf9de5964e659c4c44d861dd02877fa50
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4ba8349bee5aa103d984f9ca66a1c4e268c7fba177b94909e3b5ba91895ead83
4d3c6be580921c6b730a51242bbcedd60998424bb68a659b82a94b8839e63b92
4e58b78b5844a988d67532b4683a6e8b3235b3d56d319727e65f460805bbdec4
50a82e0e3e97292e27f203cea4c71f3acaff073c1cfb1dc8cd63999efc9de72e
50f38616fc1300ec75c4b1f0abc85269c53e47f22e4c5ba7ef674398a12d6e21
59009a0ebea68200d54d87920329794d3b3f0babc949985aba45d97892f66cf2
5badd609a51ede5bab5b89534fc3011a4dd1ab487cc7081d7cf38479bcbab855
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5e7d52bf5f53348ca036d8381f04bb01c93b3110ccac87ca3cb75fd1ce0a92c6
60631ed8f1dfa6713ff9e30fec41786aadc477c0cac5a75dca66b5a49f76b901
60ed45fe20ede817f77c4e774e77fd9a9a4f4046c67456f1442eac2095918438
62d2cc93ab8f52afb7379b9fabdc6f383f7700367cda04191ad1a8158c449c23
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7587369160233b751c90ccc2043b7fdfd7eb1f0d9aa610371b43f4b3419fa83f
76c46df9a6ba94318fafe8023e3f52e28b1b9a1eaf16dcd4d7ce95ab6942859b
7963f87cb07f8a42a168d9cdcf2ed0cd45583291c011849a322a29002d38957f
7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762
80ee2d8ce5d2a3f78fc3b8eaa67bc266645c58b96d8a804556f1e6cb8737d0cf
82f1278f66b192a223e306d884f8db595ef3b6d829cc1544807b9bf40019403e
83212a7016848fb3c92281449aeb751aaaac914aa50a90f1b35998c8f2b19cdd
85c1eb2c2a173feceba14abe8344fe9c7cb12aa1353f083f28a62f1a366763b9
86a9de4e1dd6d002b1f6adb84200766b15f0fac31f6b5b49907b6f71af061c11
884a2330198f498e36d9e77bb5c7f4971b3d70c4411cf306a3afca8bb50bb94d
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
8b0e8742416cb22d33029e1b4799431b847420b75c58f9eff600a2b15faa6e4a
8c90d5a97ca0459269bc5bb673381b2aea352d5338a8b3b2a87670d11b8a4c46
8ecf7fe958f132008eb2eaeda1a079451a62372838a6c18d9e1353f64e48172a
903adc82f54bd61a22c1672000865fc19334735ba0ad395b361f67ccc2bdfd33
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
93b94b74b73c37bcb3e6d8cada57b5ce45d7bd3fe5e3b2b6194a702d1353e1a0
94562cfaffaf86145e9e271e11e2044a951dcf791bdf5769c3d58ba9acc44fdc
97b796342ac8ee4b187d88096c3f5f8b79cd306392e13280978ab9296104c2db
98a147e6c25bb2d177fca65de16003a57ab9c859402790bfa54e6b8ef86662fc
9e3a9103c80346b1b39bea3de46f44a462b3f594fa45e7206252bc41d7e3e855
9eeea020cc6ec6c8b66b20c48a9b69a5f14b8097bdb91c5420998eb842bcbae0
9f453faccde456fd8b4f8abdda945eaea20b7fdebbff4fdb3ae03e7f75622972
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a2d30057d0a8007fb75fb8a6e4f82f59d3858d29ea176db9c73f665209e86123
a48e3091c3e26309f1329bb7ee2812cf158deb93cd80fe6439e53e8d57e58d3d
a4f9c1995de9f92f05f1a5cd0c4987e359e1aa41613bb6a33f9c82837b29e6d8
a5f5f25721168edeb2b63229c2ab58e5d7f987ee5e8aced298e7445111badf09
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
aaffceab986a8d791cfef18d2d1e28fe2dcaf40a8bdfaf4fd393b1a91c6f072b
ad480458e8c9c476d4bed65c1df11a68284c9244342d977064bf4a0efd9e3ff5
aebe8df81ee2ba5bc51e3abc322910ee5122a0ac06edfbcf7a04e1659d17dc9c
b0df50ee2718ec324a762d8ba95e644a2768c4d0a6cd66ee7f248659a1472ee5
b385fd0614f2927f0e7fdc03ccdb2428e3a93de0c7fe467149b34213cc32c0f6
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
b859cc611126401cdc38d803ac7c5967ee5da1a626e00318700ea88df55da1b9
b958e0f47861dde13a175cc69494bdb54f08e2b5e78cecf6abd16470d2085257
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c3362186a709ce7cffcc17f7cbd317bddb60bd6409cc7b3d8c9f364f03152f6f
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d077683ec63c7d44f473554e688628da6cfdf84c0f223b6be00f2476600433a5
d2dcaca89ae344f9ba12d903385c7c7096fe869e8f12605e81d9b88078bef18f
d8acb590859de744b30290b81039414fcc1f0ceb539cf8d29f8f8a0438cc935c
d90f7e2ab58fab474b8e48abd530efbef986c5653a21885837ab8298667aff0b
dd71e7bfa741c12ffde65deffbc1108ee85dfd3dfd200fb99c684c877fb364c4
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
dfc988a3bfd2d7c74069ed4414fb522a7f9b6536767f897ab15773772f517d17
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1193951467f0698533ba8fd3e78c9cc9e8852b1f5e2ea2a54f05b46ddc8b275
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f475c34186022ba531ebc8bba97fc10df7e4c3ea854f314a18ab0644c851620d
f4ff93db88831a4ecb9f857317c4fce2b24c426788a094c84787526c6c183950
f538d5803d00836b5f946264abb64976a6416ab4cc16f8f83455a025a08ad014
f9b05fa232d19f1752ceaea7eec0110daa8d4401caa7d415fb4e08a3db60df3f
ffa8b5c0d78def1b71617c0ae00e01b295bc29e2e227ba0dc84469a9ba39259c

www.intego.com Open in urlscan Pro 2606:4700::6812:6a Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

111 Requests

97 %HTTPS

68 %IPv6

26 Domains

34 Subdomains

29 IPs

6 Countries

1248 kBTransfer

3539 kBSize

13 Cookies

31 Outgoing links

Redirected requests

111 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.intego.com Open in urlscan Pro
2606:4700::6812:6a Public Scan

Screenshot
Live screenshot

Full Image

111
Requests

97 %
HTTPS

68 %
IPv6

26
Domains

34
Subdomains

29
IPs

6
Countries

1248 kB
Transfer

3539 kB
Size

13
Cookies

111 HTTP transactions
6 data transactions