threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Submission: On August 31 via api (August 31st 2020, 9:11:54 pm UTC) from US

Summary HTTP 269 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 58 IPs in 9 countries across 46 domains to perform 269 HTTP transactions. The main IP is 35.173.160.135, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is threatpost.com.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on June 10th 2020. Valid for: a year.

This is the only time threatpost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
18	35.173.160.135 35.173.160.135	14618 (AMAZON-AES) (AMAZON-AES)
11	143.204.201.95 143.204.201.95	16509 (AMAZON-02) (AMAZON-02)
6	2606:4700:e2:... 2606:4700:e2::ac40:861f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
8	2600:9000:215... 2600:9000:2156:1400:2:9275:3d40:93a1	16509 (AMAZON-02) (AMAZON-02)
10	2600:9000:20e... 2600:9000:20eb:2800:0:5c46:4f40:93a1	16509 (AMAZON-02) (AMAZON-02)
4 12	2a00:1450:400... 2a00:1450:4001:816::2004	15169 (GOOGLE) (GOOGLE)
24	185.220.204.220 185.220.204.220	41436 (CLOUDWEBM...) (CLOUDWEBMANAGE-EU)
8	172.217.18.162 172.217.18.162	15169 (GOOGLE) (GOOGLE)
5	99.86.5.213 99.86.5.213	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:81f::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81b::2003	15169 (GOOGLE) (GOOGLE)
1 3	2a00:1450:400... 2a00:1450:4001:825::200e	15169 (GOOGLE) (GOOGLE)
1 3	2620:116:800d... 2620:116:800d:21:36a9:ecb:e518:b308	16509 (AMAZON-02) (AMAZON-02)
1	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
1 1	2a00:1450:400... 2a00:1450:400c:c0c::9c	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:819::2003	15169 (GOOGLE) (GOOGLE)
2 8	37.252.172.38 37.252.172.38	29990 (ASN-APPNEX) (ASN-APPNEX)
1	52.212.5.193 52.212.5.193	16509 (AMAZON-02) (AMAZON-02)
1	34.237.157.170 34.237.157.170	14618 (AMAZON-AES) (AMAZON-AES)
1 2	178.128.135.80 178.128.135.80	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
9	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
4	69.173.144.140 69.173.144.140	26667 (RUBICONPR...) (RUBICONPROJECT)
1 8	104.111.215.135 104.111.215.135	16625 (AKAMAI-AS) (AKAMAI-AS)
3 5	72.251.249.14 72.251.249.14	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
2 9	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
1	18.157.242.30 18.157.242.30	16509 (AMAZON-02) (AMAZON-02)
10 15	2606:2800:233... 2606:2800:233:97b6:26be:138a:cba8:bb01	15133 (EDGECAST) (EDGECAST)
1	2600:9000:205... 2600:9000:2057:b200:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:821::200a	15169 (GOOGLE) (GOOGLE)
4	104.111.215.68 104.111.215.68	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	185.94.180.125 185.94.180.125	35220 (SPOTX-AMS) (SPOTX-AMS)
18	63.250.60.138 63.250.60.138	204548 (CLOUDWEBM...) (CLOUDWEBMANAGE-IL-FR)
1 2	35.156.223.207 35.156.223.207	16509 (AMAZON-02) (AMAZON-02)
1 1	195.201.246.119 195.201.246.119	24940 (HETZNER-AS) (HETZNER-AS)
1	104.244.42.69 104.244.42.69	13414 (TWITTER) (TWITTER)
1	2a00:1450:400... 2a00:1450:4001:81e::2003	15169 (GOOGLE) (GOOGLE)
4	52.28.38.201 52.28.38.201	16509 (AMAZON-02) (AMAZON-02)
1	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
1	2a03:2880:f02... 2a03:2880:f02d:e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	199.232.53.140 199.232.53.140	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:81f::2001	15169 (GOOGLE) (GOOGLE)
20	2a00:1450:400... 2a00:1450:4001:809::2001	15169 (GOOGLE) (GOOGLE)
4	3.120.9.189 3.120.9.189	16509 (AMAZON-02) (AMAZON-02)
8	13.224.193.4 13.224.193.4	16509 (AMAZON-02) (AMAZON-02)
17	2a00:1450:400... 2a00:1450:4001:824::2001	15169 (GOOGLE) (GOOGLE)
1 2	172.217.18.102 172.217.18.102	15169 (GOOGLE) (GOOGLE)
2	104.111.230.142 104.111.230.142	16625 (AKAMAI-AS) (AKAMAI-AS)
2	104.111.215.51 104.111.215.51	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	216.58.205.226 216.58.205.226	15169 (GOOGLE) (GOOGLE)
1 5	52.28.239.147 52.28.239.147	16509 (AMAZON-02) (AMAZON-02)
1 2	18.156.0.31 18.156.0.31	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1288:110... 2a00:1288:110:c305::8000	34010 (YAHOO-IRD) (YAHOO-IRD)
2 2	151.101.14.49 151.101.14.49	54113 (FASTLY) (FASTLY)
2 3	54.229.128.207 54.229.128.207	16509 (AMAZON-02) (AMAZON-02)
1 2	54.93.147.19 54.93.147.19	16509 (AMAZON-02) (AMAZON-02)
1	2620:1ec:bdf::10 2620:1ec:bdf::10	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	205.185.216.42 205.185.216.42	20446 (HIGHWINDS3) (HIGHWINDS3)
1 1	185.64.189.110 185.64.189.110	62713 (AS-PUBMATIC) (AS-PUBMATIC)
4	100.24.218.250 100.24.218.250	14618 (AMAZON-AES) (AMAZON-AES)
1	37.157.6.252 37.157.6.252	198622 (ADFORM) (ADFORM)
1	2a02:fa8:8806... 2a02:fa8:8806:13::1430	41041 (VCLK-EU-) (VCLK-EU-)
269	58

18 35.173.160.135 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-160-135.compute-1.amazonaws.com

threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
kasperskycontenthub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 143.204.201.95 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-201-95.fra53.r.cloudfront.net

tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:e2::ac40:861f (United States)

ASN13335 (CLOUDFLARENET, US)

qd.admetricspro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:2156:1400:2:9275:3d40:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2600:9000:20eb:2800:0:5c46:4f40:93a1 (United States)

ASN16509 (AMAZON-02, US)

media.threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:816::2004 (Frankfurt am Main, Germany) 4 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 185.220.204.220 (Amsterdam, Netherlands)

ASN41436 (CLOUDWEBMANAGE-EU, GB)

live.sekindo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 172.217.18.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s29-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 99.86.5.213 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-5-213.fra6.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:825::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:116:800d:21:36a9:ecb:e518:b308 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9c (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 37.252.172.38 (Ascension Island) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 690.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.212.5.193 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

ads.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.237.157.170 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-237-157-170.compute-1.amazonaws.com

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.128.135.80 (North Bergen, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

e.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 69.173.144.140 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 104.111.215.135 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-135.deploy.static.akamaitechnologies.com

as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 72.251.249.14 (Amsterdam, Netherlands) 3 redirects

ASN29791 (VOXEL-DOT-NET, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 34.98.64.218 (United States) 2 redirects

ASN15169 (GOOGLE, US)

teachingaids-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eu-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.157.242.30 (United States)

ASN16509 (AMAZON-02, US)

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2606:2800:233:97b6:26be:138a:cba8:bb01 (United States) 10 redirects

ASN15133 (EDGECAST, US)

adserver-us.adtech.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2057:b200:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.111.215.68 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-68.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.94.180.125 (Netherlands) 2 redirects

ASN35220 (SPOTX-AMS, NL)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 63.250.60.138 (United States)

ASN204548 (CLOUDWEBMANAGE-IL-FR, GB)

video.sekindo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.156.223.207 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 195.201.246.119 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)

csync.loopme.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.69 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.28.38.201 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

ads.adaptv.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f02d:e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.53.140 (United States)

ASN54113 (FASTLY, US)

www.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

54d623ab6ca75f98feb0b16010cc1ec0.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:1450:4001:809::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.120.9.189 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

prebid-server.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 13.224.193.4 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-193-4.fra2.r.cloudfront.net

math-aids-threatpost-tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:824::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.18.102 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s42-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.230.142 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-230-142.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.215.51 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-51.deploy.static.akamaitechnologies.com

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.205.226 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s24-in-f226.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 52.28.239.147 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.156.0.31 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:110:c305::8000 (United Kingdom)

ASN34010 (YAHOO-IRD, GB)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.14.49 (Frankfurt am Main, Germany) 2 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.229.128.207 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.93.147.19 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:bdf::10 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

public.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.216.42 (Phoenix, United States)

ASN20446 (HIGHWINDS3, US)
PTR: map2.hwcdn.net

serverbid-sync.nyc3.cdn.digitaloceanspaces.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.110 (United Kingdom) 1 redirects

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 100.24.218.250 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

aas.dc-1.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.6.252 (Denmark)

ASN198622 (ADFORM, DK)
PTR: s1.adform.net

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:13::1430 (Sweden)

ASN41041 (VCLK-EU-, SE)

aol-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
42	sekindo.com live.sekindo.com video.sekindo.com	3 MB
35	threatpost.com threatpost.com assets.threatpost.com media.threatpost.com	623 KB
26	googlesyndication.com 54d623ab6ca75f98feb0b16010cc1ec0.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	226 KB
24	advertising.com 11 redirects adserver-us.adtech.advertising.com ads.adaptv.advertising.com pixel.advertising.com	11 KB
19	adlightning.com tagan.adlightning.com math-aids-threatpost-tagan.adlightning.com	227 KB
17	ampproject.org cdn.ampproject.org	405 KB
15	doubleclick.net 3 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net ad.doubleclick.net cm.g.doubleclick.net	123 KB
14	pubmatic.com 1 redirects hbopenbid.pubmatic.com ads.pubmatic.com image2.pubmatic.com	1 KB
13	google.com 4 redirects www.google.com adservice.google.com	3 KB
10	rubiconproject.com fastlane.rubiconproject.com prebid-server.rubiconproject.com eus.rubiconproject.com	11 KB
10	adnxs.com 2 redirects ib.adnxs.com acdn.adnxs.com	6 KB
9	openx.net 2 redirects teachingaids-d.openx.net u.openx.net eu-u.openx.net	2 KB
6	casalemedia.com 1 redirects as-sec.casalemedia.com ssum.casalemedia.com	4 KB
6	admetricspro.com qd.admetricspro.com	221 KB
5	lijit.com 3 redirects ap.lijit.com	2 KB
5	amazon-adsystem.com c.amazon-adsystem.com	59 KB
4	dc-1.net aas.dc-1.net	777 B
3	adsrvr.org 2 redirects match.adsrvr.org	1 KB
3	yahoo.com 1 redirects ups.analytics.yahoo.com pr-bh.ybp.yahoo.com	2 KB
3	3lift.com 1 redirects tlx.3lift.com eb2.3lift.com	620 B
3	quantserve.com 1 redirects secure.quantserve.com pixel.quantserve.com	9 KB
3	google-analytics.com 1 redirects www.google-analytics.com	19 KB
3	gstatic.com www.gstatic.com fonts.gstatic.com	275 KB
2	everesttech.net 2 redirects sync-tm.everesttech.net	648 B
2	indexww.com js-sec.indexww.com
2	bidswitch.net 1 redirects x.bidswitch.net	1011 B
2	spotxchange.com 2 redirects sync.search.spotxchange.com	1 KB
2	serverbid.com 1 redirects e.serverbid.com sync.serverbid.com	267 B
2	servenobid.com ads.servenobid.com public.servenobid.com	3 KB
2	google.de www.google.de adservice.google.de	1 KB
1	dotomi.com aol-match.dotomi.com	104 B
1	adform.net c1.adform.net	187 B
1	digitaloceanspaces.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1	reddit.com www.reddit.com	1 KB
1	linkedin.com www.linkedin.com
1	facebook.com graph.facebook.com	490 B
1	twitter.com analytics.twitter.com	649 B
1	t.co t.co	448 B
1	loopme.me 1 redirects csync.loopme.me	225 B
1	googleapis.com fonts.googleapis.com	669 B
1	quantcount.com rules.quantcount.com	346 B
1	a-mo.net prebid.a-mo.net	804 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	googletagmanager.com www.googletagmanager.com	46 KB
1	kasperskycontenthub.com kasperskycontenthub.com	399 B
1	googletagservices.com www.googletagservices.com	19 KB
269	46

	Domain	Requested by
24	live.sekindo.com	threatpost.com live.sekindo.com tagan.adlightning.com
20	tpc.googlesyndication.com	tagan.adlightning.com threatpost.com cdn.ampproject.org
18	video.sekindo.com	threatpost.com live.sekindo.com
17	cdn.ampproject.org	threatpost.com
17	threatpost.com	threatpost.com
15	adserver-us.adtech.advertising.com	10 redirects threatpost.com
12	www.google.com	4 redirects threatpost.com tagan.adlightning.com
11	tagan.adlightning.com	threatpost.com tagan.adlightning.com
10	media.threatpost.com	threatpost.com
9	hbopenbid.pubmatic.com	qd.admetricspro.com live.sekindo.com
8	math-aids-threatpost-tagan.adlightning.com	tagan.adlightning.com
8	ib.adnxs.com	2 redirects qd.admetricspro.com live.sekindo.com
8	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net threatpost.com
8	assets.threatpost.com	threatpost.com assets.threatpost.com
6	qd.admetricspro.com	threatpost.com qd.admetricspro.com
5	pagead2.googlesyndication.com	threatpost.com securepubads.g.doubleclick.net
5	pixel.advertising.com	1 redirects threatpost.com
5	teachingaids-d.openx.net	qd.admetricspro.com live.sekindo.com
5	ap.lijit.com	3 redirects qd.admetricspro.com
5	as-sec.casalemedia.com	qd.admetricspro.com live.sekindo.com
5	c.amazon-adsystem.com	qd.admetricspro.com c.amazon-adsystem.com live.sekindo.com
4	aas.dc-1.net	threatpost.com
4	prebid-server.rubiconproject.com	live.sekindo.com
4	ads.adaptv.advertising.com	live.sekindo.com
4	ads.pubmatic.com	tagan.adlightning.com live.sekindo.com qd.admetricspro.com
4	fastlane.rubiconproject.com	qd.admetricspro.com
3	match.adsrvr.org	2 redirects threatpost.com
3	googleads.g.doubleclick.net	threatpost.com
3	u.openx.net	2 redirects live.sekindo.com
3	www.google-analytics.com	1 redirects www.googletagmanager.com threatpost.com
2	eb2.3lift.com	1 redirects qd.admetricspro.com
2	sync-tm.everesttech.net	2 redirects
2	ups.analytics.yahoo.com	1 redirects threatpost.com
2	acdn.adnxs.com	live.sekindo.com qd.admetricspro.com
2	eus.rubiconproject.com	live.sekindo.com qd.admetricspro.com
2	js-sec.indexww.com	live.sekindo.com qd.admetricspro.com
2	ad.doubleclick.net	1 redirects threatpost.com
2	pixel.quantserve.com	1 redirects threatpost.com
2	x.bidswitch.net	1 redirects threatpost.com
2	sync.search.spotxchange.com	2 redirects
2	www.gstatic.com	www.google.com
1	ssum.casalemedia.com	1 redirects
1	aol-match.dotomi.com	threatpost.com
1	c1.adform.net	threatpost.com
1	image2.pubmatic.com	1 redirects
1	serverbid-sync.nyc3.cdn.digitaloceanspaces.com	qd.admetricspro.com
1	sync.serverbid.com	1 redirects
1	public.servenobid.com	qd.admetricspro.com
1	eu-u.openx.net	qd.admetricspro.com
1	pr-bh.ybp.yahoo.com	threatpost.com
1	cm.g.doubleclick.net	1 redirects
1	54d623ab6ca75f98feb0b16010cc1ec0.safeframe.googlesyndication.com	tagan.adlightning.com
1	adservice.google.com	tagan.adlightning.com
1	adservice.google.de	tagan.adlightning.com
1	www.reddit.com	threatpost.com
1	www.linkedin.com	threatpost.com
1	graph.facebook.com	threatpost.com
1	analytics.twitter.com	tagan.adlightning.com
1	fonts.gstatic.com	fonts.googleapis.com
1	t.co	threatpost.com
1	csync.loopme.me	1 redirects
1	fonts.googleapis.com	tagan.adlightning.com
1	rules.quantcount.com	secure.quantserve.com
1	tlx.3lift.com	qd.admetricspro.com
1	e.serverbid.com	qd.admetricspro.com
1	prebid.a-mo.net	qd.admetricspro.com
1	ads.servenobid.com	qd.admetricspro.com
1	www.google.de	threatpost.com
1	stats.g.doubleclick.net	1 redirects
1	static.ads-twitter.com	www.googletagmanager.com
1	secure.quantserve.com	www.googletagmanager.com
1	www.googletagmanager.com	threatpost.com
1	kasperskycontenthub.com	threatpost.com
1	www.googletagservices.com	threatpost.com
269	74

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
feedly.com
www.instagram.com
www.intego.com
attendee.gotowebinar.com
akismet.com
t.co
indd.adobe.com
spotlight.threatpost.com

Subject Issuer	Validity	Valid
threatpost.com DigiCert SHA2 Secure Server CA	`2020-06-10` - `2021-06-15`	a year	crt.sh
*.adlightning.com Amazon	`2020-07-22` - `2021-08-22`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-10` - `2021-08-10`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-08-11` - `2020-11-03`	3 months	crt.sh
assets.threatpost.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
media.threatpost.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-08-19` - `2020-11-11`	3 months	crt.sh
www.sekindo.com Go Daddy Secure Certificate Authority - G2	`2020-05-27` - `2022-06-18`	2 years	crt.sh
*.google.com GTS CA 1O1	`2020-08-19` - `2020-11-11`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2020-08-04` - `2021-08-02`	a year	crt.sh
kasperskycontenthub.com DigiCert SHA2 Secure Server CA	`2020-06-01` - `2021-06-09`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-08-11` - `2020-11-03`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-08-11` - `2020-11-03`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2019-10-04` - `2020-10-07`	a year	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
www.google.de GTS CA 1O1	`2020-08-11` - `2020-11-03`	3 months	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.servenobid.com Amazon	`2020-03-12` - `2021-04-12`	a year	crt.sh
*.a-mo.net Amazon	`2020-08-24` - `2021-09-24`	a year	crt.sh
e.serverbid.com Let's Encrypt Authority X3	`2020-06-22` - `2020-09-20`	3 months	crt.sh
*.pubmatic.com Sectigo RSA Organization Validation Secure Server CA	`2019-02-22` - `2021-02-21`	2 years	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2020-03-11` - `2021-05-10`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2020-06-18` - `2021-08-17`	a year	crt.sh
*.3lift.com Amazon	`2020-07-04` - `2021-08-05`	a year	crt.sh
*.adtech.advertising.com DigiCert SHA2 Secure Server CA	`2020-04-16` - `2022-04-21`	2 years	crt.sh
upload.video.google.com GTS CA 1O1	`2020-08-11` - `2020-11-03`	3 months	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2020-04-23` - `2022-05-04`	2 years	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.v.ssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-07-29` - `2021-01-25`	6 months	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-07-21` - `2020-10-12`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2020-05-01` - `2020-11-01`	6 months	crt.sh
*.reddit.com DigiCert SHA2 Secure Server CA	`2020-04-06` - `2020-10-03`	6 months	crt.sh
*.google.de GTS CA 1O1	`2020-08-11` - `2020-11-03`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-08-11` - `2020-11-03`	3 months	crt.sh
misc-sni.google.com GTS CA 1O1	`2020-08-11` - `2020-11-03`	3 months	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-08-11` - `2020-11-03`	3 months	crt.sh
cdn.adnxs.com GeoTrust RSA CA 2018	`2020-01-02` - `2021-04-02`	a year	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-05-27` - `2020-11-23`	6 months	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-06-02` - `2020-11-29`	6 months	crt.sh
pixel.advertising.com DigiCert SHA2 High Assurance Server CA	`2020-08-08` - `2020-11-03`	3 months	crt.sh
public.servenobid.com DigiCert SHA2 Secure Server CA	`2020-08-26` - `2021-08-25`	a year	crt.sh
*.nyc3.cdn.digitaloceanspaces.com DigiCert SHA2 Secure Server CA	`2020-03-11` - `2021-04-14`	a year	crt.sh
*.betrad.net Amazon	`2019-12-12` - `2021-01-12`	a year	crt.sh
track.adform.net DigiCert SHA2 Secure Server CA	`2019-09-16` - `2021-09-20`	2 years	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2019-06-19` - `2021-08-31`	2 years	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh

This page contains 29 frames:

Primary Page: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Frame ID: C3CB1C58F745F86AA7001805E3C88A40
Requests: 145 HTTP requests in this frame

Frame: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1598908283&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Frame ID: AE5F42882F1AFF92C26E29C7E8EC3C80
Requests: 45 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
Frame ID: 03B4A9F245506CABCB6646011F05DBEE
Requests: 1 HTTP requests in this frame

Frame: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=94&advUuid=86a0bbb4-ebce-11ea-a5cd-18969d310206
Frame ID: 029ADC858F11B90B9F3A817BC0BD107D
Requests: 1 HTTP requests in this frame

Frame: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=98&advUuid=1ecaedb5-13f4-4d01-aab5-2c2ad048cf05
Frame ID: 3424DD4745562B67B93C1B2B35F29902
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=QVh-Tz10ahidjrORgXOS1oB0&theme=standard&size=normal&cb=fyebhf3hepnn
Frame ID: 7C8038ADCE8DD7ED198BF3F0D5B39DC2
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=QVh-Tz10ahidjrORgXOS1oB0&theme=light&size=normal&cb=9tiqvomgd4jw
Frame ID: 98A24FED214ABB23DAC72F2B24B0D89A
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QVh-Tz10ahidjrORgXOS1oB0&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=x2kx8koqh6rk
Frame ID: 082C3CDE0CE377BD67051AA6C950600D
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=QVh-Tz10ahidjrORgXOS1oB0&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=d8k1antr32b2
Frame ID: 7AAD18DD6AE531575F2D339BF09CE6A1
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-9a4f7ce-c706c2eb.js
Frame ID: FDF9877CBB5296851A1EDF9648F22866
Requests: 17 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-9a4f7ce-c706c2eb.js
Frame ID: 78B8E617C1EBCE33B005422A7848B245
Requests: 18 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-9a4f7ce-c706c2eb.js
Frame ID: 48BA67DAE40C45DA05ABF8A5112A5682
Requests: 11 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-9a4f7ce-c706c2eb.js
Frame ID: 12BC7936DF124DF6A4BF2A6A3E4532A1
Requests: 14 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 2FBDF199E3BB7E1B0AE71071292B610F
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd?gdpr=1&gdpr_consent=
Frame ID: 7A60E4301D245CEA87A7654B5DD97F15
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: F1D7B71303B3FD7D138C4C35BC4E5A30
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?gdpr=1&gdpr_consent=
Frame ID: 57583A024269C81777301C601A5EF8FE
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 9222A2EA1723A555D6FA8A78A9B2D3D5
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: 209C6C846A3507FA524FD6311C073975
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 9B0EBD9680BA77714A782BABD555A498
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: 42F6A5410B2417DE47CA65304E45A55F
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: D93182CCA8B77196D34A8C868FA40C02
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Frame ID: C955815DF697AE2E1FCFB1976865DFFB
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 210EDB91A06338AF1C1E31A2F5C8E442
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 59F8A49BAC28193D47B83485A557A1C7
Requests: 1 HTTP requests in this frame

Frame: https://ap.lijit.com/beacon?informer=13394437&dnr=1
Frame ID: 38182645E05BEB1809021A71DC40359E
Requests: 1 HTTP requests in this frame

Frame: https://public.servenobid.com/sync.html
Frame ID: 55E6C47D5DCB86BA11CE20178F8A3756
Requests: 1 HTTP requests in this frame

Frame: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Frame ID: 389580A19179D2052D7E823E4147E29F
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Frame ID: 897D6B04F009B8015C4BDFC7F9977CE7
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

269
Requests

100 %
HTTPS

37 %
IPv6

46
Domains

74
Subdomains

58
IPs

9
Countries

5162 kB
Transfer

9870 kB
Size

16
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/Threatpost/

Search URL Search Domain Scan URL

URL: https://twitter.com/threatpost/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/threatpost/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/threatpost

Search URL Search Domain Scan URL

URL: https://feedly.com/threatpost

Search URL Search Domain Scan URL

URL: https://www.instagram.com/Threatpost/

Search URL Search Domain Scan URL

URL: https://www.intego.com/mac-security-blog/new-mac-malware-reveals-google-searches-can-be-unsafe/
Title: a posting

Search URL Search Domain Scan URL

URL: https://attendee.gotowebinar.com/register/3265005683762389007?source=ART
Title: June 24 at 2 p.m. ET

Search URL Search Domain Scan URL

URL: https://akismet.com/privacy/
Title: Learn how your comment data is processed

Search URL Search Domain Scan URL

URL: http://twitter.com/search?q=%23WhatsApp
Title: #WhatsApp

Search URL Search Domain Scan URL

URL: http://twitter.com/search?q=%23LinkedIn
Title: #LinkedIn

Search URL Search Domain Scan URL

URL: https://t.co/r12qrAaKga
Title: https://t.co/r12qrAaKga

Search URL Search Domain Scan URL

URL: https://twitter.com/threatpost
Title: Follow @threatpost

Search URL Search Domain Scan URL

URL: https://indd.adobe.com/view/01579c19-a6ca-4cb0-8106-ed4d5d02a292
Title: Advertise With Us

Search URL Search Domain Scan URL

URL: https://spotlight.threatpost.com/
Title: HackerOne Spotlight

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 61

https://www.google-analytics.com/r/collect?v=1&_v=j83&aip=1&a=1250074073&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ul=en-us&de=UTF-8&dt=Shlayer%20Mac%20Malware%20Returns%20with%20Extra%20Sneakiness%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEAB~&jid=2042536896&gjid=775904314&cid=2075126819.1598908284&tid=UA-35676203-21&_gid=1575060101.1598908284&_r=1&gtm=2wg8j2PM29HLF&z=373430986 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-35676203-21&cid=2075126819.1598908284&jid=2042536896&_gid=1575060101.1598908284&gjid=775904314&_v=j83&z=373430986 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=2075126819.1598908284&jid=2042536896&_v=j83&z=373430986 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=2075126819.1598908284&jid=2042536896&_v=j83&z=373430986&slf_rd=1&random=3318310129

Request Chain 77

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=58b55fcd08676a1;misc=1598908284020; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=58b55fcd08676a1;misc=1598908284020 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A86a1e050-ebce-11ea-b7be-12dfe7d1818c;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=58b55fcd08676a1;misc=1598908284020

Request Chain 78

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=593a3fda4086741;misc=1598908284020; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=593a3fda4086741;misc=1598908284020 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A86a2099a-ebce-11ea-a61f-12c8450abec2;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=593a3fda4086741;misc=1598908284020

Request Chain 79

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=601995992deb93b;misc=1598908284020; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=601995992deb93b;misc=1598908284020 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A86a1fa90-ebce-11ea-af21-12062b57c7e0;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=601995992deb93b;misc=1598908284020

Request Chain 80

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=61c0d5fdc6ff5ef;misc=1598908284020; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=61c0d5fdc6ff5ef;misc=1598908284020 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A86a25274-ebce-11ea-a3d5-12bf237d14d4;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=61c0d5fdc6ff5ef;misc=1598908284020

Request Chain 81

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=620db50fa9ea0fa;misc=1598908284020; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=620db50fa9ea0fa;misc=1598908284020 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A86a23b40-ebce-11ea-984a-12dcd5311714;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=620db50fa9ea0fa;misc=1598908284020

Request Chain 88

https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D94%26advUuid%3D%24SPOTX_USER_ID HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D94%26advUuid%3D%24SPOTX_USER_ID&__user_check__=1&sync_id=86a0be91-ebce-11ea-a5cd-18969d310206 HTTP 302
https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=94&advUuid=86a0bbb4-ebce-11ea-a5cd-18969d310206

Request Chain 89

https://u.openx.net/w/1.0/cm?id=476b50d3-5ccf-49a1-89b8-1ddf8ea18042&r=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D98%26advUuid%3D HTTP 302
https://u.openx.net/w/1.0/cm?cc=1&id=476b50d3-5ccf-49a1-89b8-1ddf8ea18042&r=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D98%26advUuid%3D HTTP 302
https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=98&advUuid=1ecaedb5-13f4-4d01-aab5-2c2ad048cf05

Request Chain 100

https://x.bidswitch.net/sync?ssp=sekindo&user_id=5f4d677bccfc9&custom_data=5f4d677bccfc9&gdpr=1&gdpr_consent= HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=sekindo&user_id=5f4d677bccfc9&custom_data=5f4d677bccfc9&gdpr=1&gdpr_consent=

Request Chain 101

https://csync.loopme.me/?redirect=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D93%26advUuid%3D%7Bdevice_id%7D HTTP 307
https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=93&advUuid=9db49dab-ebc1-4b52-b778-b42ce70e9842

Request Chain 175

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 176

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 188

https://ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/B23768030.267046029;dc_trk_aid=461813821;dc_trk_cid=106332843;ord=530025646;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua= HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/B23768030.267046029;dc_pre=CJ3FqsOtxusCFcOt3god7D8Nuw;dc_trk_aid=461813821;dc_trk_cid=106332843;ord=530025646;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=

Request Chain 200

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc HTTP 302
https://pixel.advertising.com/ups/57304/sync?uid=CAESEFo0CyTVzOAJPuq0x33PyI8&google_cver=1 HTTP 302
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEFo0CyTVzOAJPuq0x33PyI8&google_cver=1&apid=1A86a23b40-ebce-11ea-984a-12dcd5311714 HTTP 302
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEFo0CyTVzOAJPuq0x33PyI8&google_cver=1&apid=1A86a23b40-ebce-11ea-984a-12dcd5311714&verify=true

Request Chain 202

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=1&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=1&gdpr_consent= HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=1&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=1&gdpr_consent=&_test=X01nfgAAAJpQvXfk HTTP 302
https://pixel.advertising.com/ups/55986/sync?uid=X01nfgAAAJpQvXfk&_origin=0&gdpr=1&gdpr_consent=&_test=X01nfgAAAJpQvXfk

Request Chain 203

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://pixel.advertising.com/ups/55953/sync?uid=2c6ce771-420d-48a2-ba21-ac2bb2c9e71d&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=2c6ce771-420d-48a2-ba21-ac2bb2c9e71d

Request Chain 206

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 213

https://eb2.3lift.com/sync HTTP 302
https://eb2.3lift.com/sync?&ld=1

Request Chain 217

https://ap.lijit.com/beacon?informer=13394437 HTTP 302
https://ap.lijit.com/beacon?informer=13394437&dnr=1

Request Chain 219

https://sync.serverbid.com/ss/2000891.html HTTP 302
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Request Chain 220

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent= HTTP 302
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=GfN0LhqidykB9nJ9T6FtfEigeXsB9Hh8HqJBJTS3

Request Chain 221

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Faas.dc-1.net%2Fsetuid%3FA%3Da7d145d5-2cde-47fd-85d7-2411a4822681%26D%3D%26bidder%3Dpubmatic%26uid%3D%23PM_USER_ID HTTP 302
https://aas.dc-1.net/setuid?A=a7d145d5-2cde-47fd-85d7-2411a4822681&D=&bidder=pubmatic&uid=CDBA1DFF-C06B-4BF1-9578-80470A06B1AA

Request Chain 224

https://ib.adnxs.com/getuid?https%3A%2F%2Faas.dc-1.net%2Fsetuid%3FA%3Da7d145d5-2cde-47fd-85d7-2411a4822681%26D%3D%26bidder%3Dappnexus%26uid%3D%24UID HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Faas.dc-1.net%252Fsetuid%253FA%253Da7d145d5-2cde-47fd-85d7-2411a4822681%2526D%253D%2526bidder%253Dappnexus%2526uid%253D%2524UID HTTP 302
https://aas.dc-1.net/setuid?A=a7d145d5-2cde-47fd-85d7-2411a4822681&D=&bidder=appnexus&uid=7637719079026289740

Request Chain 225

https://ap.lijit.com/pixel?redir=https%3A%2F%2Faas.dc-1.net%2Fsetuid%3FA%3Da7d145d5-2cde-47fd-85d7-2411a4822681%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID HTTP 307
https://ap.lijit.com/pixel?redir=https%3A%2F%2Faas.dc-1.net%2Fsetuid%3FA%3Da7d145d5-2cde-47fd-85d7-2411a4822681%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID&sovrn_retry=true HTTP 307
https://aas.dc-1.net/setuid?A=a7d145d5-2cde-47fd-85d7-2411a4822681&D=&bidder=sovrn&uid=78d1288ed99d8a8c2d1f5c16

Request Chain 228

https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Faas.dc-1.net%2Fsetuid%3FA%3Da7d145d5-2cde-47fd-85d7-2411a4822681%26D%3D%26bidder%3Dindex_rtb%26uid%3D HTTP 302
https://aas.dc-1.net/setuid?A=a7d145d5-2cde-47fd-85d7-2411a4822681&D=&bidder=index_rtb&uid=X01nflVbLiIAAHyI004AAAAW%26326

269 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/ 79 KB
20 KB 1067ms
764ms Document
text/html 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-160-135.compute-1.amazonaws.com

Software

nginx /

Resource Hash

60fc2b06c8d3b39cc64b9026ab51eec19367b60947732bfa4d0a8ce9237ec8f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Host: threatpost.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: nginx
Date: Mon, 31 Aug 2020 21:11:22 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Link: <https://threatpost.com/wp-json/>; rel="https://api.w.org/" <https://threatpost.com/?p=156669>; rel=shortlink
X-Frame-Options: SAMEORIGIN
X-Debug-Auth: off
X-Request-Host: threatpost.com
x-cache-hit: MISS
Content-Encoding: gzip

GET
H/1.1 200
OK main.css
threatpost.com/wp-content/themes/threatpost-2018/assets/css/ 253 KB
39 KB 305ms
103ms Stylesheet
text/css 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 41f3222c29889fb48f5dca1d481858e5339a759655510c256ef4edf56c80f7f5

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Mon, 31 Aug 2020 21:11:23 GMT
Content-Encoding: gzip
Last-Modified: Mon, 31 Aug 2020 14:26:42 GMT
Server: nginx
ETag: W/"5f4d08a2-3f2b8"
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=604800, public
Connection: close
Expires: Mon, 07 Sep 2020 21:11:23 GMT

GET
H2 200 op.js Show response
tagan.adlightning.com/math-aids-threatpost/ 37 KB
14 KB 70ms
23ms Script
application/javascript 143.204.201.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.201.95 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-201-95.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a01a07944c453db3669c07297d7b9a8680abef5ed9b457718a2c7fa3aa5342c9

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 20:47:00 GMT
content-encoding: gzip
age: 1463
x-cache: Hit from cloudfront
status: 200
content-length: 13411
x-amz-meta-git_commit: 9a4f7ce
last-modified: Mon, 31 Aug 2020 20:45:41 GMT
server: AmazonS3
etag: "b59a366b187790aab59f8f2bb7db24b1"
x-amz-version-id: ihmmOB5W0fBCHu8YCwum0Si13Q1YHHef
via: 1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: qRriw7q7s3U2BTQk0xmQTjiJ9rVYxvlSfIA0SEBy9L-j3AFmVLPyUg==

GET
H2 200 ros-layout.js Show response
qd.admetricspro.com/js/threatpost/ 22 KB
3 KB 48ms
23ms Script
application/javascript 2606:4700:e2::ac40:861f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:861f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e2b472509d9e149690aba45c5917ebdd2f52471b98d414c2726301b90e08f21

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:22 GMT
content-encoding: br
cf-cache-status: HIT
age: 42
status: 200
cf-request-id: 04e7f5504c000032409d19a200000001
last-modified: Thu, 06 Aug 2020 02:14:13 GMT
server: cloudflare
etag: W/"579e-5ac2c0b6aa2e7-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5cb9be607fac3240-FRA
expires: Mon, 31 Aug 2020 21:14:16 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 54 KB
19 KB 55ms
40ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0aa2fbae07f7af328f1e000c19a2068cc0eb0928acfe77241cfbc1390c86b956

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "619 / 145 of 1000 / last-modified: 1598888738"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 18683
x-xss-protection: 0
expires: Mon, 31 Aug 2020 21:11:22 GMT

GET
H2 200 cmp.js Show response
qd.admetricspro.com/js/threatpost/ 305 KB
82 KB 68ms
44ms Script
application/javascript 2606:4700:e2::ac40:861f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:861f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d89d98593ac65c9f002b856f3e22a1479f3aea866f7fd15c85903c0a6d66f0e3

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:22 GMT
content-encoding: br
cf-cache-status: HIT
age: 42
status: 200
cf-request-id: 04e7f5504c000032409d19b200000001
last-modified: Tue, 25 Aug 2020 22:57:08 GMT
server: cloudflare
etag: W/"4c455-5adbb9f62c25a-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5cb9be607faf3240-FRA
expires: Mon, 31 Aug 2020 21:14:29 GMT

GET
H2 200 targeting.js Show response
qd.admetricspro.com/js/threatpost/ 275 B
553 B 39ms
14ms Script
application/javascript 2606:4700:e2::ac40:861f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/targeting.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:861f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:22 GMT
content-encoding: br
cf-cache-status: HIT
age: 42
status: 200
cf-request-id: 04e7f5504c000032409d19c200000001
last-modified: Sat, 08 Feb 2020 20:49:18 GMT
server: cloudflare
etag: W/"113-59e16a3cfb471-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5cb9be607fb03240-FRA
expires: Mon, 31 Aug 2020 21:14:16 GMT

GET
H2 200 prebid.js Show response
qd.admetricspro.com/js/threatpost/ 384 KB
108 KB 75ms
51ms Script
application/javascript 2606:4700:e2::ac40:861f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:861f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed1bd9b5fc31e624bb0b3ca2c510546c8a1bb6b41923e06768a735c75a9c704c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:22 GMT
content-encoding: br
cf-cache-status: HIT
age: 42
status: 200
cf-request-id: 04e7f5504c000032409d19d200000001
last-modified: Wed, 22 Jul 2020 04:38:40 GMT
server: cloudflare
etag: W/"601dd-5ab005060aaae-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5cb9be607fb23240-FRA
expires: Mon, 31 Aug 2020 21:14:16 GMT

GET
H2 200 engine.js Show response
qd.admetricspro.com/js/threatpost/ 25 KB
7 KB 50ms
27ms Script
application/javascript 2606:4700:e2::ac40:861f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/engine.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:861f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa90c2d77583dd25e7fbdc1411c8d718f29d9665ab48f985ffe6f3a38b34b6a7

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:22 GMT
content-encoding: br
cf-cache-status: HIT
age: 42
status: 200
cf-request-id: 04e7f5504c000032409d19e200000001
last-modified: Wed, 26 Aug 2020 03:04:19 GMT
server: cloudflare
etag: W/"637a-5adbf1363c190-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5cb9be607fb33240-FRA
expires: Mon, 31 Aug 2020 21:14:16 GMT

GET
H2 200 /
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 89 KB
18 KB 499ms
463ms Stylesheet
text/css 2600:9000:2156:1400:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=8c4fcc0f

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:1400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

15e9840f31982980328598c38e5c60434072901f2c902713ef9c4d4900e05307

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 18049
x-cache-hit: HIT
last-modified: Mon, 31 Aug 2020 14:26:42 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 a1098f0eeab192209962e3a9d76d0339.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: mb5VVp4XrDSgQYxU6I3Nc3qPNcEuREMiOpba9PESDT7H3BJOmASOAw==
expires: Tue, 01 Sep 2020 19:47:25 GMT

GET
H/1.1 200
OK jquery.js Show response
threatpost.com/wp-includes/js/jquery/ 95 KB
37 KB 391ms
190ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Mon, 31 Aug 2020 21:11:23 GMT
Content-Encoding: gzip
Last-Modified: Wed, 10 Jun 2020 22:05:38 GMT
Server: nginx
ETag: W/"5ee15932-17a69"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Mon, 07 Sep 2020 21:11:23 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 177 KB
55 KB 501ms
465ms Script
application/x-javascript 2600:9000:2156:1400:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-cookies-notification/scripts/alert_text.js,wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js,wp-content/plugins/honeypot-comments/public/assets/js/public.js,wp-content/plugins/kspr_twitter_pullquote/js/kaspersky-twitter-pullquote.js,wp-content/themes/threatpost-2018/assets/js/main.js,wp-content/themes/threatpost-2018/assets/js/loadmore.js,wp-content/plugins/kaspersky-social-sharing/assets/js/social-share.js&ver=8c4fcc0f

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:1400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b0209d39595432d762f6ba2a81dc0bffa6a6e1ed9021ba24ffa06c3c7e4bcb02

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 56256
x-cache-hit: HIT
last-modified: Mon, 31 Aug 2020 14:26:42 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 a1098f0eeab192209962e3a9d76d0339.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: 0biAtB7oNvB4NhK9a_VSuGYy1BN4S_5yjNSReBLElVyKvzaS18uD_Q==
expires: Tue, 01 Sep 2020 19:47:41 GMT

GET
H2 200 trojan-malware.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/01/22100148/ 126 KB
126 KB 62ms
19ms Image
image/jpeg 2600:9000:20eb:2800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/01/22100148/trojan-malware.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:2800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4edf4e4d19fa8ec8abf42e728012fb704a7d8e49a25bbf778b77abd20d90b8ce

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 09:22:42 GMT
via: 1.1 9d27077cd67d98c0474b05ec9d68df4a.cloudfront.net (CloudFront), 1.1 3aed5a4f89d72775aaf2cc5a5f642386.cloudfront.net (CloudFront)
last-modified: Wed, 22 Jan 2020 15:01:49 GMT
server: AmazonS3
age: 1684121
etag: "3f035e1c9c491a99670f6755b2e8e29f"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, FRA2-C1
accept-ranges: bytes
content-length: 128905
x-amz-cf-id: yRv3CTYAXHop9A3-5TfN-zKutxZmblb1stL_aJhXNHXMwhdkcnmfig==
expires: Thu, 21 Jan 2021 15:01:48 GMT

GET
H2 200 Tara-headshot.jpg
media.threatpost.com/wp-content/uploads/sites/103/2018/08/15114841/ 13 KB
13 KB 56ms
14ms Image
image/jpeg 2600:9000:20eb:2800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2018/08/15114841/Tara-headshot.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:2800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 89ce08431545cd3c6d42419d99ee0152027a68c1d0c7c82838cc9a51d9d52451

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 21 Aug 2020 10:44:56 GMT
via: 1.1 89cb19c6f2c9ed0983294d3b12e80e43.cloudfront.net (CloudFront), 1.1 3aed5a4f89d72775aaf2cc5a5f642386.cloudfront.net (CloudFront)
last-modified: Fri, 17 Aug 2018 16:22:08 GMT
server: AmazonS3
age: 901588
etag: "dee18dfeea6de13bec60c1e5237eb723"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, FRA2-C1
accept-ranges: bytes
content-length: 13097
x-amz-cf-id: KzF5msLmKiBbKr_EntIbQ4vTpFQKN1SpsY5JisD_Y1vl0dQQ8IQnCA==
expires: Sat, 17 Aug 2019 16:22:07 GMT

GET
H2 200 subscribe2.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/ 8 KB
9 KB 58ms
16ms Image
image/jpeg 2600:9000:20eb:2800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:2800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 26 Aug 2020 07:33:37 GMT
via: 1.1 a32f966fc5896281eb3de44fd8f57d40.cloudfront.net (CloudFront), 1.1 3aed5a4f89d72775aaf2cc5a5f642386.cloudfront.net (CloudFront)
last-modified: Tue, 19 Feb 2019 20:14:58 GMT
server: AmazonS3
age: 481067
etag: "5ba45563f793f39ef6baf02645651654"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, FRA2-C1
accept-ranges: bytes
content-length: 8281
x-amz-cf-id: jo7SZeBwszbjjJRDCmhwByQ0VrNNitbDkP1RYr8pl10TZAV5d9HJRQ==
expires: Wed, 19 Feb 2020 20:14:57 GMT

GET
H2 200 apple-security-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/08/31142546/ 9 KB
10 KB 58ms
16ms Image
image/jpeg 2600:9000:20eb:2800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/08/31142546/apple-security-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:2800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 12c9acd2dd58cfe3cbab5c7be32c13431018977aafd9f03d3fe3cc05ee379f49

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 19:46:26 GMT
via: 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront), 1.1 3aed5a4f89d72775aaf2cc5a5f642386.cloudfront.net (CloudFront)
last-modified: Mon, 31 Aug 2020 18:25:50 GMT
server: AmazonS3
age: 5098
etag: "eb83ce7ad6a838839160ebb2d6ea2eb9"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, FRA2-C1
accept-ranges: bytes
content-length: 9552
x-amz-cf-id: syx62o6FkDFVh0HyDQlCrz7O7WHTQ6G4UtUEJNfCDrQUyU8GVGTK6A==
expires: Tue, 31 Aug 2021 18:25:49 GMT

GET
H2 200 Frog-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/08/19163742/ 18 KB
18 KB 72ms
30ms Image
image/jpeg 2600:9000:20eb:2800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/08/19163742/Frog-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:2800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 10a79d7840ab8c64ce17acb504c6b22935b02c47f1f0d67a38d77b1ea56af01b

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 22 Aug 2020 01:54:38 GMT
via: 1.1 ff2bcb2d3b4a3d9e0615ddd1033c38c4.cloudfront.net (CloudFront), 1.1 3aed5a4f89d72775aaf2cc5a5f642386.cloudfront.net (CloudFront)
last-modified: Wed, 19 Aug 2020 20:37:58 GMT
server: AmazonS3
age: 847006
etag: "273d93ecb5cc3ea9d99d50b7baec6523"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, FRA2-C1
accept-ranges: bytes
content-length: 18234
x-amz-cf-id: kWcDqzEXGJJBH6YYp-PpGkn-LzbAcov12pnC2XAjnhjF3f0S5kv-Wg==
expires: Thu, 19 Aug 2021 20:37:54 GMT

GET
H2 200 backdoor-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/06/03123154/ 8 KB
9 KB 71ms
30ms Image
image/jpeg 2600:9000:20eb:2800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/06/03123154/backdoor-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:2800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 20b94b09df137bfa328a0ae017dc43cd17ce5e9190ab9155802245d833fc2ee8

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 25 Aug 2020 02:34:03 GMT
via: 1.1 e5b93012e2bfb81dc9846f43efd610a6.cloudfront.net (CloudFront), 1.1 3aed5a4f89d72775aaf2cc5a5f642386.cloudfront.net (CloudFront)
last-modified: Wed, 03 Jun 2020 16:31:58 GMT
server: AmazonS3
age: 585440
etag: "a971f4e62cbb078e207918d4ce35eaa8"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, FRA2-C1
accept-ranges: bytes
content-length: 8591
x-amz-cf-id: t-Vk6PuRAOdiY4Zo2mgVTR-GqmuDFV_3FdYX8l3zP-xVMPZSI6pPYQ==
expires: Thu, 03 Jun 2021 16:31:57 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 674 B
900 B 34ms
16ms Script
text/javascript 2a00:1450:4001:816::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

4128d163becca8bccabd6a9f8fe8e603e630432f133fe67fd779cc64534bca27

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 443
x-xss-protection: 1; mode=block
expires: Mon, 31 Aug 2020 21:11:23 GMT

GET
H2 200 work-from-home-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/03/13163335/ 2 KB
2 KB 38ms
37ms Image
image/jpeg 2600:9000:20eb:2800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/03/13163335/work-from-home-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:2800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3435531b595fb1b2b529346e1df8c979a1fd727f56ea8c0d792316035440cac5

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 30 Aug 2020 12:28:15 GMT
via: 1.1 b073c20359d711b751afd124dda34076.cloudfront.net (CloudFront), 1.1 3aed5a4f89d72775aaf2cc5a5f642386.cloudfront.net (CloudFront)
last-modified: Fri, 13 Mar 2020 20:33:52 GMT
server: AmazonS3
age: 117789
etag: "fd4942a0704785b24b44d177f4a57d86"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, FRA2-C1
accept-ranges: bytes
content-length: 2098
x-amz-cf-id: BmPJTrlli_R2PvkxGb1PiPbaScv0PkpfjJlnx-aJABL1lepebwMjLQ==
expires: Sat, 13 Mar 2021 20:33:49 GMT

GET
H2 200 slideshow-1-64x64.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2018/12/21160507/ 1 KB
2 KB 32ms
31ms Image
image/jpeg 2600:9000:20eb:2800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2018/12/21160507/slideshow-1-64x64.jpeg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:2800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 39f437357a2ffa0d788c9fc8563f3af59d73d529060cb407ac639513df958597

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 24 Aug 2020 12:00:44 GMT
via: 1.1 2395e6175733260a159a0b484ed8febd.cloudfront.net (CloudFront), 1.1 3aed5a4f89d72775aaf2cc5a5f642386.cloudfront.net (CloudFront)
last-modified: Fri, 21 Dec 2018 21:05:10 GMT
server: AmazonS3
age: 637840
etag: "dec760c6e408812ae4334b4890452c65"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1, FRA2-C1
accept-ranges: bytes
content-length: 1270
x-amz-cf-id: tWgX9p8s6Xel1TvWD7vnjQHmO1UyJMMvBWAdrnLjMti2aQWy5Ipn8g==
expires: Sat, 21 Dec 2019 21:05:07 GMT

GET
H2 200 data-leak-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/10/21145020/ 2 KB
2 KB 32ms
32ms Image
image/jpeg 2600:9000:20eb:2800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/10/21145020/data-leak-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:2800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7517792de8d4a1319afd85d8c3dcffe799ba5545129a650182e6c4b055302852

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 22 Aug 2020 00:36:18 GMT
via: 1.1 2f194b62c8c43859cbf5af8e53a8d2a7.cloudfront.net (CloudFront), 1.1 3aed5a4f89d72775aaf2cc5a5f642386.cloudfront.net (CloudFront)
last-modified: Mon, 21 Oct 2019 18:50:23 GMT
server: AmazonS3
age: 851706
etag: "12bb1aa91531788d81a1791bcbb631f9"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, FRA2-C1
accept-ranges: bytes
content-length: 2106
x-amz-cf-id: cbFCOg1aG849m1TzDQ6MmAxx6vj821WyAOVtKrYNEKPNBAU7zeMmpQ==
expires: Tue, 20 Oct 2020 18:50:20 GMT

GET
H2 200 36c3-fake-emails-featured-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/01/31170549/ 2 KB
2 KB 33ms
32ms Image
image/jpeg 2600:9000:20eb:2800:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/01/31170549/36c3-fake-emails-featured-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:2800:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1f152c8879492dd153cf7a47ad195151e20491e60985d86f9ef7a7ddc85062f6

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 21 Aug 2020 10:25:42 GMT
via: 1.1 e56e6732f380db727425bac2d6158761.cloudfront.net (CloudFront), 1.1 3aed5a4f89d72775aaf2cc5a5f642386.cloudfront.net (CloudFront)
last-modified: Fri, 31 Jan 2020 22:05:52 GMT
server: AmazonS3
age: 902742
etag: "62a0a00cafda215547f47f6b6f52bdce"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, FRA2-C1
accept-ranges: bytes
content-length: 1665
x-amz-cf-id: hsiLvPEU44HiqTpzuONhIXLzjct9xCEt2ZcqdSdprWE6V8dsKARtvg==
expires: Sat, 30 Jan 2021 22:05:49 GMT

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ 30 KB
9 KB 62ms
22ms Script
text/javascript 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 7f8e1d0f78514ed9b034cbece69dd86d8733ee2bf4d45ca79e1363c1893508ab

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/javascript; charset=utf-8

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 2 KB
1 KB 282ms
275ms Script
application/x-javascript 2600:9000:2156:1400:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/jquery.json.min.js&ver=8c4fcc0f

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:1400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 926
x-cache-hit: HIT
last-modified: Mon, 31 Aug 2020 14:26:40 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 a1098f0eeab192209962e3a9d76d0339.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: BXRjMPXZneE8FuZrwjbYgfxKt6epbC7WX97yd-zj5zT1L17qxyKWPw==
expires: Tue, 01 Sep 2020 19:47:42 GMT

GET
H/1.1 200
OK gravityforms.min.js Show response
threatpost.com/wp-content/plugins/gravityforms/js/ 34 KB
12 KB 735ms
103ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.4.17.15
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Mon, 31 Aug 2020 21:11:24 GMT
Content-Encoding: gzip
Last-Modified: Mon, 31 Aug 2020 14:26:39 GMT
Server: nginx
ETag: W/"5f4d089f-88c2"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Mon, 07 Sep 2020 21:11:24 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 7 KB
3 KB 283ms
276ms Script
application/x-javascript 2600:9000:2156:1400:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/conditional_logic.min.js&ver=8c4fcc0f

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:1400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 2685
x-cache-hit: HIT
last-modified: Mon, 31 Aug 2020 14:26:39 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 a1098f0eeab192209962e3a9d76d0339.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: X3TvuujxhCZwIHb5gUsOXhRfRjNwBByLt53X86dplZQ3liTA73HLxw==
expires: Tue, 01 Sep 2020 19:47:18 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 5 KB
2 KB 290ms
283ms Script
application/x-javascript 2600:9000:2156:1400:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/placeholders.jquery.min.js&ver=8c4fcc0f

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:1400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 1747
x-cache-hit: HIT
last-modified: Mon, 31 Aug 2020 14:26:39 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 a1098f0eeab192209962e3a9d76d0339.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: KEb4mWZ5nnEv9jJVffUjsRm9TTZNyoJGHfnU7Vhb0NU4U26YySsl0w==
expires: Tue, 01 Sep 2020 19:47:28 GMT

GET
H3-Q050 200 api.js Show response
www.google.com/recaptcha/ 676 B
879 B 45ms
23ms Script
text/javascript 2a00:1450:4001:816::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en&render=explicit&ver=5.4.2

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:816::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

f2a4f376e4a84ff665f3d62282b266ca53e6e5aa28a899e0b896a5ec8a8f4fb3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 444
x-xss-protection: 1; mode=block
expires: Mon, 31 Aug 2020 21:11:23 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 2 KB
1 KB 289ms
283ms Script
application/x-javascript 2600:9000:2156:1400:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/js/wp-embed.min.js,wp-content/plugins/akismet/_inc/form.js&ver=8c4fcc0f

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:1400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

21e46fe44c6929876f5a413c843ae516c0ddfd1aad3e8e33446b7bc0a6781b08

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 973
x-cache-hit: HIT
last-modified: Wed, 10 Jun 2020 22:05:38 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 a1098f0eeab192209962e3a9d76d0339.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: 0lCgECLTYKxpYm-ZSTLNJKWmsLkT0LM1QFNExh8tEGawXLOuIB5_mw==
expires: Tue, 01 Sep 2020 19:47:26 GMT

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ 61 KB
21 KB 30ms
26ms Script
application/javascript 143.204.201.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.201.95 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-201-95.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 18 Aug 2020 17:46:30 GMT
content-encoding: gzip
age: 1135494
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: rHVlTFe897dinwATBo-fc8_C9LN1tgwwZ1gTxXzdVCfrsD2MvmnO_g==

GET
H2 200 bl-9a4f7ce-c706c2eb.js Show response
tagan.adlightning.com/math-aids-threatpost/ 74 KB
21 KB 38ms
35ms Script
application/javascript 143.204.201.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-9a4f7ce-c706c2eb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.201.95 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-201-95.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2568034b9d66c093730623e756fb7be1e3382eda3ea7f521188d0390bb61b07a

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 20:47:04 GMT
content-encoding: gzip
age: 1460
x-cache: Hit from cloudfront
status: 200
content-length: 21305
x-amz-meta-git_commit: 9a4f7ce
last-modified: Mon, 31 Aug 2020 20:45:21 GMT
server: AmazonS3
etag: "2635bfe525e35422f9b20c75390f3e25"
x-amz-version-id: tZyo2bsqyZxiTa8olUgtXvuXBT9w5Mhi
via: 1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: 6NnlgUIcQ5RB6dyPv5XT9QmdrDnY-UyC8lLhCMvAhNQWl1KlZEomqA==

GET
H2 200 pubads_impl_2020082701.js Show response
securepubads.g.doubleclick.net/gpt/ 262 KB
92 KB 105ms
56ms Script
text/javascript 172.217.18.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020082701.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s29-in-f2.1e100.net

Software

sffe /

Resource Hash

c0159d71bfd21f50878f12b283950402c6364354bcd559af9accc22191dddb5b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 27 Aug 2020 08:39:44 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 93876
x-xss-protection: 0
expires: Mon, 31 Aug 2020 21:11:23 GMT

GET
H2 200 vendor-list.json Show response
qd.admetricspro.com/js/cmp2/ 199 KB
21 KB 192ms
177ms XHR
application/json 2606:4700:e2::ac40:861f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/cmp2/vendor-list.json
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:861f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 29257e6f0eaa20a411d881c29d9fdd181a811ec32b5fdd1cb46ec4bd4719861f

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Wed, 26 Aug 2020 22:56:36 GMT
server: cloudflare
etag: W/"31bad-5adcfbb507100"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=600
cf-ray: 5cb9be646a0d073e-FRA
cf-request-id: 04e7f552bc0000073e9f0e9200000001
expires: Mon, 31 Aug 2020 21:21:23 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 102 KB
26 KB 75ms
23ms Script
application/javascript 99.86.5.213
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/engine.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.5.213 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-5-213.fra6.r.cloudfront.net
Software: Server /
Resource Hash: 8c665507e16736e1323acf89104e508e8cac863d30e8ca5ff5d6ac5303b25277

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 20:57:25 GMT
content-encoding: gzip
server: Server
age: 837
etag: 5a34c79c51b93c8b4601b1808cbdbd04
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=900
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: 1COrCAwlEBnvMZXrcrzsdJekUIwC_Nrawz0yZEqg0qwm0_ssGDcIjA==
via: 1.1 c05282a87474a55ae2a8dd2aa77d1233.cloudfront.net (CloudFront)
nncoection: close

GET
H/1.1 200
OK / Show response
kasperskycontenthub.com/ 0
399 B 469ms
163ms Script
application/javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://kasperskycontenthub.com/?dm=ed1f9e435dc885292eab65620c51f3fb&action=load&blogid=103&siteid=1&t=1634521117&back=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-160-135.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 31 Aug 2020 21:11:24 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: SAMEORIGIN
Connection: close
Content-Type: application/javascript
x-cache-hit: MISS
Transfer-Encoding: chunked
X-Debug-Auth: off
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Request-Host: kasperskycontenthub.com
X-XSS-Protection: 1; mode=block

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 146 KB
46 KB 22ms
21ms Script
application/javascript 2a00:1450:4001:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

12771abe4371a61f019993da9d82819c5c68e8360220b062b467b253c1991be1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47181
x-xss-protection: 0
expires: Mon, 31 Aug 2020 21:11:23 GMT

GET
H/1.1 200
OK icons.svg
threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/ 13 KB
5 KB 312ms
106ms Other
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/icons.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Mon, 31 Aug 2020 21:11:24 GMT
Content-Encoding: gzip
Last-Modified: Mon, 31 Aug 2020 14:26:42 GMT
Server: nginx
ETag: W/"5f4d08a2-3496"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Mon, 07 Sep 2020 21:11:24 GMT

GET
H/1.1 200
OK icons.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/ 13 KB
5 KB 311ms
105ms Other
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Mon, 31 Aug 2020 21:11:24 GMT
Content-Encoding: gzip
Last-Modified: Mon, 31 Aug 2020 14:26:42 GMT
Server: nginx
ETag: W/"5f4d08a2-3496"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Mon, 07 Sep 2020 21:11:24 GMT

GET
H/1.1 200
OK logo.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 19 KB
19 KB 641ms
189ms Image
image/png 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Mon, 31 Aug 2020 21:11:24 GMT
Last-Modified: Mon, 31 Aug 2020 14:26:42 GMT
Server: nginx
ETag: "5f4d08a2-4a32"
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 18994
Expires: Mon, 07 Sep 2020 21:11:24 GMT

GET
H/1.1 200
OK museosans-700-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 356ms
189ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Mon, 31 Aug 2020 21:11:23 GMT
Last-Modified: Mon, 31 Aug 2020 14:26:42 GMT
Server: nginx
ETag: "5f4d08a2-51a4"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20900
Expires: Tue, 31 Aug 2021 21:11:23 GMT

GET
H/1.1 200
OK museosans-100-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 303ms
102ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Mon, 31 Aug 2020 21:11:23 GMT
Last-Modified: Mon, 31 Aug 2020 14:26:42 GMT
Server: nginx
ETag: "5f4d08a2-50c8"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20680
Expires: Tue, 31 Aug 2021 21:11:23 GMT

GET
H/1.1 200
OK museosans-300-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 390ms
189ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Mon, 31 Aug 2020 21:11:23 GMT
Last-Modified: Mon, 31 Aug 2020 14:26:42 GMT
Server: nginx
ETag: "5f4d08a2-51b8"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20920
Expires: Tue, 31 Aug 2021 21:11:23 GMT

GET
H/1.1 200
OK museosans-500-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 389ms
187ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Mon, 31 Aug 2020 21:11:23 GMT
Last-Modified: Mon, 31 Aug 2020 14:26:42 GMT
Server: nginx
ETag: "5f4d08a2-5194"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20884
Expires: Tue, 31 Aug 2021 21:11:23 GMT

GET
H/1.1 200
OK museosans-700italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 15 KB
16 KB 389ms
188ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Mon, 31 Aug 2020 21:11:23 GMT
Last-Modified: Mon, 31 Aug 2020 14:26:42 GMT
Server: nginx
ETag: "5f4d08a2-3dcc"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 15820
Expires: Tue, 31 Aug 2021 21:11:23 GMT

GET
H/1.1 200
OK museosans-300italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 23 KB
23 KB 328ms
189ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300italic-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Mon, 31 Aug 2020 21:11:23 GMT
Last-Modified: Mon, 31 Aug 2020 14:26:42 GMT
Server: nginx
ETag: "5f4d08a2-5bac"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 23468
Expires: Tue, 31 Aug 2021 21:11:23 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/QVh-Tz10ahidjrORgXOS1oB0/ 337 KB
132 KB 19ms
6ms Script
text/javascript 2a00:1450:4001:81b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/QVh-Tz10ahidjrORgXOS1oB0/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

919ce225464d5e8d79944356fcaa74323a12f8fc847eec6c7a877f9e752f7fb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 24 Aug 2020 21:36:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 24 Aug 2020 04:38:28 GMT
server: sffe
age: 603266
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 135073
x-xss-protection: 0
expires: Tue, 24 Aug 2021 21:36:57 GMT

GET
H/1.1 200
OK mail-plane-light.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 828 B
722 B 566ms
100ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-light.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Mon, 31 Aug 2020 21:11:24 GMT
Content-Encoding: gzip
Last-Modified: Mon, 31 Aug 2020 14:26:42 GMT
Server: nginx
ETag: W/"5f4d08a2-33c"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Mon, 07 Sep 2020 21:11:24 GMT

GET
H/1.1 200
OK twitter-blue.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 868 B
847 B 567ms
101ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/twitter-blue.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Mon, 31 Aug 2020 21:11:24 GMT
Content-Encoding: gzip
Last-Modified: Mon, 31 Aug 2020 14:26:42 GMT
Server: nginx
ETag: W/"5f4d08a2-364"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Mon, 07 Sep 2020 21:11:24 GMT

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame AE5F 2 KB
1 KB 25ms
24ms Script
text/javascript 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1598908283&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 673cc0ffa51cb60a5636bc1c2a53b8d2f1e4f4e334504aa8c56a7212d2dfee49

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/javascript; charset=utf-8

GET
H/1.1 200
OK mail-plane-large-dark.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 812 B
722 B 303ms
102ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-large-dark.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Mon, 31 Aug 2020 21:11:24 GMT
Content-Encoding: gzip
Last-Modified: Mon, 31 Aug 2020 14:26:42 GMT
Server: nginx
ETag: W/"5f4d08a2-32c"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Mon, 07 Sep 2020 21:11:24 GMT

GET
H/1.1 200
OK logo-white.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 10 KB
10 KB 1306ms
101ms Image
image/png 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo-white.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1598884002
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Mon, 31 Aug 2020 21:11:25 GMT
Last-Modified: Mon, 31 Aug 2020 14:26:42 GMT
Server: nginx
ETag: "5f4d08a2-260a"
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 9738
Expires: Mon, 07 Sep 2020 21:11:25 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 66ms
24ms XHR
application/javascript 99.86.5.213
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.5.213 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-5-213.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 05:02:12 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin
age: 58152
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Thu, 20 Aug 2020 07:51:21 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: Mc-KnL1_JzrEmVuHB9gBsj2COo8GLbgXY3cNxtOOwOr6rcobDQaH9A==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:825::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 04 Jun 2020 23:38:14 GMT
server: Golfe2
age: 6943
date: Mon, 31 Aug 2020 19:15:40 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18469
expires: Mon, 31 Aug 2020 21:15:40 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 22 KB
8 KB 25ms
8ms Script
application/x-javascript 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.quantserve.com/quant.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

8130c2c72afad9d94581ef93aaa00524093103c47c71fce52f606d5ff693c3ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: gzip
last-modified: Mon, 31-Aug-2020 21:11:23 GMT
etag: M0-2a172724
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: private, no-transform, max-age=604800
strict-transport-security: max-age=86400
content-length: 8060
expires: Mon, 07 Sep 2020 21:11:23 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 78ms
26ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:24 GMT
content-encoding: gzip
age: 76047
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1958
x-served-by: cache-fra19143-FRA
last-modified: Mon, 10 Aug 2020 18:10:59 GMT
x-timer: S1598908284.002184,VS0,VE0
etag: "a4cc3f907681b24a3efd540acd5d2996+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H/1.1 200
OK iab_consent_sdk.v1.0.js Show response
live.sekindo.com/content/ClientDetections/ Frame AE5F 19 KB
6 KB 24ms
21ms Script
application/javascript 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/ClientDetections/iab_consent_sdk.v1.0.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1598908283&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: gzip
last-modified: Wed, 12 Feb 2020 15:01:36 GMT
server: nginx
etag: W/"5e441350-4be0"
transfer-encoding: chunked
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Tue, 31 Aug 2021 21:11:23 GMT

GET
H/1.1 200
OK DetectGDPR2.v1.1.js Show response
live.sekindo.com/content/ClientDetections/ Frame AE5F 9 KB
3 KB 44ms
19ms Script
application/javascript 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/ClientDetections/DetectGDPR2.v1.1.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1598908283&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 0cf25abe73b03e246c0a820c825a1f433e36949c2cf456ce889d86e8dd9ec427

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: gzip
last-modified: Wed, 08 Jul 2020 16:36:53 GMT
server: nginx
etag: W/"5f05f625-225b"
transfer-encoding: chunked
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Tue, 31 Aug 2021 21:11:23 GMT

GET
H/1.1 200
OK DetectGDPR.v1.1.js Show response
live.sekindo.com/content/ClientDetections/ Frame AE5F 8 KB
3 KB 55ms
17ms Script
application/javascript 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/ClientDetections/DetectGDPR.v1.1.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1598908283&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: f40e3d5b91387e92272b6d46fc83ce21041f130a29316d7216d3a1793d46c4f3

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: gzip
last-modified: Wed, 08 Jul 2020 16:36:53 GMT
server: nginx
etag: W/"5f05f625-1ec4"
transfer-encoding: chunked
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Tue, 31 Aug 2021 21:11:23 GMT

GET
H/1.1 200
OK hls.0.12.4_2.min.js Show response
live.sekindo.com/content/video/hls/ Frame AE5F 256 KB
86 KB 64ms
25ms Script
application/javascript 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1598908283&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 13ab06913444b6e3b4139e5487813073f11e082878ae8a5bf5213fdc6f95f5e0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: gzip
last-modified: Thu, 13 Aug 2020 08:36:05 GMT
server: nginx
etag: W/"5f34fb75-3ff27"
transfer-encoding: chunked
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Tue, 31 Aug 2021 21:11:23 GMT

GET
H/1.1 200
OK prebidVid.3.19.0_9.min.js Show response
live.sekindo.com/content/prebid/ Frame AE5F 296 KB
109 KB 67ms
27ms Script
application/javascript 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1598908283&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 7860ef37e85676dcb81a99d7e5d6453bdacdf9d35aa45517a9ba9ea25bbd4c85

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: gzip
last-modified: Thu, 16 Jul 2020 14:28:49 GMT
server: nginx
etag: W/"5f106421-4a003"
transfer-encoding: chunked
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Tue, 31 Aug 2021 21:11:23 GMT

GET
H/1.1 200
OK liveVideo.php Show response
live.sekindo.com/live/ Frame AE5F 449 KB
127 KB 77ms
36ms Script
text/html 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30392D30315F30307D7B7331323334383830387D7B4338357D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B7251554A554943386752486C755957317059305A7362323979494338674D6941764945466A64476C325A513D3D7D7B4C363631357DFEFE&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F83.0.4103.61+Safari%2F537.36&fpl=-1&debugInformation=ABT+%2F+DynamicFloor+%2F+2+%2F+Active&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=30&c2pWaitTime=10&csuuid=5f4d677bccfc9&debugInfo=12348808_ABT+%2F+DynamicFloor+%2F+2+%2F+Active&debugPlayerSession=&pubUrlDEMO=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.8847&geoLong=4.5049&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1598908283&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 6386762d086f1e6df4264ceed5479375126ada582a59ac90437d646d417a140c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: gzip
server: nginx
transfer-encoding: chunked
content-type: text/html; charset=UTF-8

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j83&aip=1&a=1250074073&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ul=en-u...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-35676203-21&cid=2075126819.1598908284&jid=2042536896&_gid=1575060101.1598908284&gjid=775904314&_v=j83&z=373430986
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=2075126819.1598908284&jid=2042536896&_v=j83&z=373430986
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=2075126819.1598908284&jid=2042536896&_v=j83&z=373430986&slf_rd=1&random=3318310129

42 B
513 B

30ms
18ms

Image
image/gif

2a00:1450:4001:819::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=2075126819.1598908284&jid=2042536896&_v=j83&z=373430986&slf_rd=1&random=3318310129

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:24 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:24 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-21&cid=2075126819.1598908284&jid=2042536896&_v=j83&z=373430986&slf_rd=1&random=3318310129
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
393 B 26ms
12ms Image
image/gif 2a00:1450:4001:825::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j83&aip=1&a=1250074073&t=event&ni=0&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ul=en-us&de=UTF-8&dt=Shlayer%20Mac%20Malware%20Returns%20with%20Extra%20Sneakiness%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=VISIBILITY&ea=elementVisibility%20%2F%20%5BHeader%5D%20%2F%20Social%20Networks%20View&_u=YEDAAEAB~&jid=&gjid=&cid=2075126819.1598908284&tid=UA-35676203-21&_gid=1575060101.1598908284&gtm=2wg8j2PM29HLF&z=156240634

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 08 Aug 2020 04:34:40 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 2047004
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
710 B 77ms
25ms XHR
application/json 37.252.172.38
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.38 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

690.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 31 Aug 2020 21:11:24 GMT
X-Proxy-Origin: 82.102.19.136; 82.102.19.136; 690.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.110:80
AN-X-Request-Uuid: 26379a80-e0ab-46ac-984f-fafe6e99f370
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 adreq Show response
ads.servenobid.com/ 5 KB
3 KB 102ms
34ms XHR
application/json 52.212.5.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=10027
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.212.5.193 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 011abf54e8eab6a7f72d61611287e7262133d36be666a2483fe27ce1dac2d222

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 31 Aug 2020 21:11:24 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
status: 200
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
access-control-allow-credentials: true

POST
H2 200 c Show response
prebid.a-mo.net/a/ 768 B
804 B 455ms
248ms XHR
application/json 34.237.157.170
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.237.157.170 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-237-157-170.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: 29980e248847fcc1f63b5e609b5ea0e02117834d55489c30694e5ae18b91da6e

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 31 Aug 2020 21:11:24 GMT
content-encoding: gzip
server: Cowboy
status: 200
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://threatpost.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 338

POST
H2 200 v2 Show response
e.serverbid.com/api/ 16 B
168 B 300ms
101ms XHR
application/json 178.128.135.80
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://e.serverbid.com/api/v2
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 178.128.135.80 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 200
date: Mon, 31 Aug 2020 21:11:23 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com
content-length: 16
vary: Origin
content-type: application/json

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
115 B 106ms
68ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Mon, 31 Aug 2020 21:11:24 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
709 B 74ms
26ms XHR
application/json 37.252.172.38
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.38 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

690.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 31 Aug 2020 21:11:24 GMT
X-Proxy-Origin: 82.102.19.136; 82.102.19.136; 690.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.50:80
AN-X-Request-Uuid: 00dafd3c-a321-4e38-a0fb-43ac65240c1b
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 263 B
2 KB 277ms
203ms XHR
application/json 69.173.144.140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=2&alt_size_ids=55%2C57&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&tk_flint=pbjs_lite_v3.26.0&x_source.tid=8f2e7c81-b4ce-4fb2-95ad-08ec3dc2af10&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.33759245021774165
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: d364e2aba777f75da1784ca6db6dd7515dd43bc82a490545896c57dfc5a2f01f

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 31 Aug 2020 21:11:24 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 263
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 5 KB
4 KB 156ms
82ms XHR
application/json 69.173.144.140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=16&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&tk_flint=pbjs_lite_v3.26.0&x_source.tid=6a8b321f-44c7-4fb8-bb1e-c9a5ffcff80a&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.8895692064158878
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: b37ebb4e83fa3916e2884835f4948a981b8faf9863703f30a840d7b290533745

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 31 Aug 2020 21:11:24 GMT
Content-Encoding: gzip
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 2543
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 148ms
72ms XHR
application/json 69.173.144.140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509506&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&tk_flint=pbjs_lite_v3.26.0&x_source.tid=bc843b0f-0d30-4e84-b965-c0603d3c3959&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.10870023724628375
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 7ae5a850970a16eb3d4487568a5823f41c7f8b32a41851255a674c7f14794d0e

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 31 Aug 2020 21:11:24 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 140ms
57ms XHR
application/json 69.173.144.140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&tk_flint=pbjs_lite_v3.26.0&x_source.tid=bc843b0f-0d30-4e84-b965-c0603d3c3959&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.6183968066001533
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 03b306d39df447da9c6c78f918b64a454ebc20d242dc457c61289bc1640c31eb

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 31 Aug 2020 21:11:24 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 25 B
673 B 375ms
323ms XHR
application/json 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=438654&v=7.2&r=%7B%22id%22%3A%2231a0a6120996ee1%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2232dce99a3e4dfa%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22332ddf86a32061%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2234f931da100f7c3%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2232dce99a3e4dfa%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2232dce99a3e4dfa%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22332ddf86a32061%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22336x280%22%7D%2C%22banner%22%3A%7B%22w%22%3A336%2C%22h%22%3A280%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2234f931da100f7c3%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22sid%22%3A%221005%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d5d0c35ba6c0f00e4a21d2c462c057ef34f20742942a4cbc2217883f09771923

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 31 Aug 2020 21:11:24 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 45
Expires: Mon, 31 Aug 2020 21:11:24 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 47 B
723 B 177ms
136ms XHR
application/json 72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_3.26.0
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx /
Resource Hash: 6d0a7e3c202fab883daa1728bee7f5edd21bc3895f7e535cf0c2bd751e78757d

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 31 Aug 2020 21:11:24 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 65

GET
H2 200 arj Show response
teachingaids-d.openx.net/w/1.0/ 173 B
559 B 163ms
114ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=8f2e7c81-b4ce-4fb2-95ad-08ec3dc2af10%2C8f2e7c81-b4ce-4fb2-95ad-08ec3dc2af10%2C6a8b321f-44c7-4fb8-bb1e-c9a5ffcff80a%2Cbc843b0f-0d30-4e84-b965-c0603d3c3959%2Cbc843b0f-0d30-4e84-b965-c0603d3c3959&nocache=1598908284017&gdpr=0&x_gdpr_f=1&pubcid=71ac31f4-c876-4bb4-acce-2999bf1edc0e&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&aus=728x90%2C970x250%2C970x90%7C728x90%2C970x250%2C970x90%7C300x250%2C336x280%7C300x250%2C300x600%7C300x250%2C300x600&divIds=div-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-3%2Cdiv-gpt-ad-6794670-5%2Cdiv-gpt-ad-6794670-5&auid=540932704%2C540932709%2C540932713%2C540932715%2C540932720
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: OXGW/16.192.1 /
Resource Hash: 3af0a9272dae9060f2f7341372cb9b5a3ce1ad579a31c094ac5d499362bbff0e

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:24 GMT
content-encoding: gzip
server: OXGW/16.192.1
status: 200
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 164
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
310 B 86ms
38ms XHR
application/json 18.157.242.30
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=3.26.0&referrer=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&tmax=1200&gdpr=false

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.157.242.30 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:24 GMT
x-auction-status: 12, 12, 12
status: 200
content-type: application/json; charset=utf-8
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H2

200

ADTECH;apid=1A86a1e050-ebce-11ea-b7be-12dfe7d1818c;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=58b55fcd08676a1;misc=1598908284020 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=58b55fcd08676a1;misc=1598908284020;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=58b55fcd08676a1;misc=1598908284020
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A86a1e050-ebce-11ea-b7be-12dfe7d1818c;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=58b55fcd08676a1;misc=15...

1 KB
1 KB

153ms
152ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A86a1e050-ebce-11ea-b7be-12dfe7d1818c;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=58b55fcd08676a1;misc=1598908284020
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 18b962cde0d4113b8e26e2492d0b9cbb6b47007d7b192080102dd084ed60a16e

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:24 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1225
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:24 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A86a1e050-ebce-11ea-b7be-12dfe7d1818c;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=58b55fcd08676a1;misc=1598908284020
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A86a2099a-ebce-11ea-a61f-12c8450abec2;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=593a3fda4086741;misc=1598908284020 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=593a3fda4086741;misc=1598908284020;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=593a3fda4086741;misc=1598908284020
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A86a2099a-ebce-11ea-a61f-12c8450abec2;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=593a3fda4086741;misc=15...

1 KB
1 KB

173ms
172ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A86a2099a-ebce-11ea-a61f-12c8450abec2;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=593a3fda4086741;misc=1598908284020
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 7f1e08ac6923a0556e71798833aef7b749fb608eeb8668739b690af04fe335a4

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:24 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1224
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:24 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A86a2099a-ebce-11ea-a61f-12c8450abec2;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=593a3fda4086741;misc=1598908284020
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A86a1fa90-ebce-11ea-af21-12062b57c7e0;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=601995992deb93b;misc=1598908284020 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=601995992deb93b;misc=1598908284020;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=601995992deb93b;misc=1598908284020
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A86a1fa90-ebce-11ea-af21-12062b57c7e0;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=601995992deb93b;misc=15...

1 KB
1 KB

215ms
214ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A86a1fa90-ebce-11ea-af21-12062b57c7e0;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=601995992deb93b;misc=1598908284020
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: ca52910307046d9132e3004d3b113d9e31601c2bc1c457bd3d7d02a2d468a091

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:24 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
accept-ranges: bytes
content-type: application/json
content-length: 1225
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:24 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A86a1fa90-ebce-11ea-af21-12062b57c7e0;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=601995992deb93b;misc=1598908284020
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A86a25274-ebce-11ea-a3d5-12bf237d14d4;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=61c0d5fdc6ff5ef;misc=1598908284020 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=61c0d5fdc6ff5ef;misc=1598908284020;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=61c0d5fdc6ff5ef;misc=1598908284020
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A86a25274-ebce-11ea-a3d5-12bf237d14d4;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=61c0d5fdc6ff5ef;misc=15...

1 KB
1 KB

186ms
185ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A86a25274-ebce-11ea-a3d5-12bf237d14d4;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=61c0d5fdc6ff5ef;misc=1598908284020
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 4b4d0717f8a966c6a6e30520057816bd8898e5a585d306fb9aba9f1b7ad0d7c2

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:24 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1225
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:24 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A86a25274-ebce-11ea-a3d5-12bf237d14d4;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=61c0d5fdc6ff5ef;misc=1598908284020
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A86a23b40-ebce-11ea-984a-12dcd5311714;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=620db50fa9ea0fa;misc=1598908284020 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=620db50fa9ea0fa;misc=1598908284020;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=620db50fa9ea0fa;misc=1598908284020
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A86a23b40-ebce-11ea-984a-12dcd5311714;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=620db50fa9ea0fa;misc=15...

1 KB
1 KB

168ms
168ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A86a23b40-ebce-11ea-984a-12dcd5311714;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=620db50fa9ea0fa;misc=1598908284020
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: ffa5d8fba25133fa1d5b7f4cb92f0e5daf9ec169103cfb23b7a7798fcaa10d36

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:24 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1225
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:24 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A86a23b40-ebce-11ea-984a-12dcd5311714;cfp=1;rndc=1598908283;v=2;cmd=bid;cors=yes;alias=620db50fa9ea0fa;misc=1598908284020
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
369 B 67ms
65ms XHR
text/javascript 99.86.5.213
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&pid=GaLi6lBuSvacJ&cb=0&ws=1600x1200&v=7.53.01&t=1200&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-970x250-ATF%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-300x250-ATF%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-300x600-ATF%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%222x2%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-2x2-Skin%22%7D%5D&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.5.213 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-5-213.fra6.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:24 GMT
via: 1.1 c05282a87474a55ae2a8dd2aa77d1233.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA6-C1
status: 200
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: KB5SUzRyFYfgESQPY8BNGNg9dvHLhdeA3WK01OTOR7bHGw1tjPuXyQ==

GET
H2 200 rules-p-_7kVx0t9Jqj90.js Show response
rules.quantcount.com/ 3 B
346 B 389ms
374ms Script
application/x-javascript 2600:9000:2057:b200:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-_7kVx0t9Jqj90.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:b200:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:07:23 GMT
via: 1.1 d8e97d2c28917e4c41ab79bb1e94b845.cloudfront.net (CloudFront)
last-modified: Fri, 03 Mar 2017 23:52:35 GMT
server: AmazonS3
age: 241
etag: "8a80554c91d9fca8acb82f023de02f11"
x-cache: Error from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=300
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-length: 3
x-amz-cf-id: S2lm4yjF1nExgtcP5BrjSQEhbTEnVDqAltzTO4bEdEc1Zp81Dus7jg==

GET
H/1.1 200
OK primisslate.css
live.sekindo.com/content/video/css/ 17 KB
5 KB 19ms
19ms Stylesheet
text/css 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/video/css/primisslate.css
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 4f7cd55655bafca4db9b67255125ed52cd91d21b1727e9f28f71219aa1341de5

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: gzip
last-modified: Tue, 18 Aug 2020 10:07:25 GMT
server: nginx
etag: W/"5f3ba85d-45c8"
transfer-encoding: chunked
content-type: text/css

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ Frame AE5F 102 KB
26 KB 27ms
26ms Script
application/javascript 99.86.5.213
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30392D30315F30307D7B7331323334383830387D7B4338357D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B7251554A554943386752486C755957317059305A7362323979494338674D6941764945466A64476C325A513D3D7D7B4C363631357DFEFE&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F83.0.4103.61+Safari%2F537.36&fpl=-1&debugInformation=ABT+%2F+DynamicFloor+%2F+2+%2F+Active&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=30&c2pWaitTime=10&csuuid=5f4d677bccfc9&debugInfo=12348808_ABT+%2F+DynamicFloor+%2F+2+%2F+Active&debugPlayerSession=&pubUrlDEMO=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.8847&geoLong=4.5049&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.5.213 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-5-213.fra6.r.cloudfront.net
Software: Server /
Resource Hash: 8c665507e16736e1323acf89104e508e8cac863d30e8ca5ff5d6ac5303b25277

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 20:57:25 GMT
content-encoding: gzip
server: Server
age: 838
etag: 5a34c79c51b93c8b4601b1808cbdbd04
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=900
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: mjBPpLZuiLG5ErVd0Cz1x4d6O0mnAhwT_ARDRQM7s4nkq6bXPCj8_g==
via: 1.1 c05282a87474a55ae2a8dd2aa77d1233.cloudfront.net (CloudFront)
nncoection: close

GET
H2 200 css
fonts.googleapis.com/ 2 KB
669 B 14ms
14ms Stylesheet
text/css 2a00:1450:4001:821::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=swap

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

00d4fbacbadc6ecbd73be323ec77febf3d856ce00dc5334d06462a315c7da8e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 20:50:52 GMT
server: ESF
date: Mon, 31 Aug 2020 21:11:24 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 31 Aug 2020 21:11:24 GMT

GET
H/1.1 200
OK user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 03B4 0
0 97ms
36ms Document
text/html 104.111.215.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.68 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-68.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Last-Modified: Sat, 01 Aug 2020 14:58:40 GMT
ETag: "1300708-1f7d-5abd2241d66f9"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 2655
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=53128
Expires: Tue, 01 Sep 2020 11:56:52 GMT
Date: Mon, 31 Aug 2020 21:11:24 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1

200
OK

liveCS.php
live.sekindo.com/live/ Frame 029A
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D94%26advUuid%3D%24SPOTX_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D94%26advUuid%3D%24SPOTX_USER_ID&__user_chec...
https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=94&advUuid=86a0bbb4-ebce-11ea-a5cd-18969d310206

0
0

21ms
21ms

Document
text/html

185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=94&advUuid=86a0bbb4-ebce-11ea-a5cd-18969d310206
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Host: live.sekindo.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

server: nginx
date: Mon, 31 Aug 2020 21:11:24 GMT
content-type: text/html; charset=utf-8
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
pragma: no-cache
age: 0
content-encoding: gzip

Redirect headers

Server: nginx
Date: Mon, 31 Aug 2020 21:11:24 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Set-Cookie: audience=86a0bbb4-ebce-11ea-a5cd-18969d310206; expires=Tue, 31-Aug-2021 22:18:04 GMT; path=/; domain=.spotxchange.com; SameSite=none; Secure
Location: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=94&advUuid=86a0bbb4-ebce-11ea-a5cd-18969d310206
X-fe: 129
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0

GET
H/1.1

200
OK

liveCS.php
live.sekindo.com/live/ Frame 3424
Redirect Chain

https://u.openx.net/w/1.0/cm?id=476b50d3-5ccf-49a1-89b8-1ddf8ea18042&r=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D98%26advUuid%3D
https://u.openx.net/w/1.0/cm?cc=1&id=476b50d3-5ccf-49a1-89b8-1ddf8ea18042&r=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D98%26advUuid%3D
https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=98&advUuid=1ecaedb5-13f4-4d01-aab5-2c2ad048cf05

0
0

21ms
21ms

Document
text/html

185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=98&advUuid=1ecaedb5-13f4-4d01-aab5-2c2ad048cf05
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Host: live.sekindo.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

server: nginx
date: Mon, 31 Aug 2020 21:11:23 GMT
content-type: text/html; charset=utf-8
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
pragma: no-cache
age: 0
content-encoding: gzip

Redirect headers

status: 302
vary: Accept, Accept-Encoding
set-cookie: i=3ac3345c-f635-4a05-b406-72e15827bfed|1598908284; Version=1; Expires=Tue, 31-Aug-2021 21:11:24 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.192.1
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=98&advUuid=1ecaedb5-13f4-4d01-aab5-2c2ad048cf05
date: Mon, 31 Aug 2020 21:11:24 GMT
content-type: text/html
content-length: 0
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK placeHolder.png
live.sekindo.com/content/video/splayer/assets/ 23 KB
24 KB 22ms
18ms Image
image/png 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/content/video/splayer/assets/placeHolder.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 76102878c1198de858725194952ba1c6b35bdee0f870cc6a124e93d17385e64e

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:23 GMT
last-modified: Sun, 11 Jun 2017 08:04:06 GMT
server: nginx
etag: "593cf976-5dbf"
content-type: image/png
cache-control: no-cache, private
accept-ranges: bytes
content-length: 23999
expires: Mon, 31 Aug 2020 21:11:22 GMT

GET
H/1.1 200
OK vid5f453c65006a7774132681.jpg
video.sekindo.com/uploads/cn16/video/users/converted/24485/video1523972806/ 20 KB
21 KB 1151ms
40ms Image
image/jpeg 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn16/video/users/converted/24485/video1523972806/vid5f453c65006a7774132681.jpg?cbuster=1598372966

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

475129044e4b86e3cf9a942e7798a96c1eb24ee04a9b755f4a7bf2ebcc324310

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 31 Aug 2020 21:11:05 GMT
last-modified: Tue, 25 Aug 2020 16:37:42 GMT
Server: Tengine
etag: "5f453e56-510d"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
cache-control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 20749
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5f46e84b61cae208337383.jpg
video.sekindo.com/uploads/cn20/video/users/converted/24485/video1523972806/ 16 KB
16 KB 1151ms
40ms Image
image/jpeg 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn20/video/users/converted/24485/video1523972806/vid5f46e84b61cae208337383.jpg?cbuster=1598482508

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

f891dac9017293579371cac81121c94a351bb090213c4609b8879465c498e3b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 31 Aug 2020 21:11:05 GMT
last-modified: Wed, 26 Aug 2020 22:58:46 GMT
Server: Tengine
etag: "5f46e926-3f23"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
cache-control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 16163
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5f4462b9b5ed8027665015.jpg
video.sekindo.com/uploads/cn18/video/users/converted/24485/video1523972806/ 13 KB
13 KB 1146ms
25ms Image
image/jpeg 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn18/video/users/converted/24485/video1523972806/vid5f4462b9b5ed8027665015.jpg?cbuster=1598317243

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

98e43f2d7eb5341dfc6654d24c0a6adb0ae5dc2c3ae65557cc5a2af0229cbfb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 31 Aug 2020 21:11:05 GMT
last-modified: Tue, 25 Aug 2020 01:12:23 GMT
Server: Tengine
etag: "5f446577-3432"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
cache-control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 13362
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5f47357c97cc3540700977.jpg
video.sekindo.com/uploads/cn20/video/users/converted/24485/video_5c74e337b0b1c456249184/ 13 KB
14 KB 1146ms
26ms Image
image/jpeg 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn20/video/users/converted/24485/video_5c74e337b0b1c456249184/vid5f47357c97cc3540700977.jpg?cbuster=1598502269

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

c80559d376a1d8e7e34807fb0fc827fa1c461121f55107100fe14c2c6560b6cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 31 Aug 2020 21:11:05 GMT
last-modified: Thu, 27 Aug 2020 04:28:22 GMT
Server: Tengine
etag: "5f473666-3521"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
cache-control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 13601
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5f48167841a5f799885416.jpg
video.sekindo.com/uploads/cn22/video/users/converted/28530/video_5d5baf9fe4c32389620327/ 14 KB
14 KB 1146ms
25ms Image
image/jpeg 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn22/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5f48167841a5f799885416.jpg?cbuster=1598559872

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

d2e5434d730440add973e3d2c835b65c44e5be6f59180398b4ba620698085ace

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 31 Aug 2020 21:11:05 GMT
last-modified: Thu, 27 Aug 2020 20:29:18 GMT
Server: Tengine
etag: "5f48179e-3605"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
cache-control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 13829
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5f49b1ad84b42137594170.jpg
video.sekindo.com/uploads/cn22/video/users/converted/24485/video_5c74e337b0b1c456249184/ 4 KB
4 KB 1145ms
24ms Image
image/jpeg 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn22/video/users/converted/24485/video_5c74e337b0b1c456249184/vid5f49b1ad84b42137594170.jpg?cbuster=1598665134

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

462b8152ba87fb0dcd4edd139611c1a42dc3eb3f29bdf729621399d70c9eb7a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 31 Aug 2020 21:11:05 GMT
last-modified: Sat, 29 Aug 2020 01:47:51 GMT
Server: Tengine
etag: "5f49b3c7-e1c"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
cache-control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 3612
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5f48da925f206758738245.jpg
video.sekindo.com/uploads/cn21/video/users/converted/24485/video_5c74e337b0b1c456249184/ 27 KB
27 KB 30ms
27ms Image
image/jpeg 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn21/video/users/converted/24485/video_5c74e337b0b1c456249184/vid5f48da925f206758738245.jpg?cbuster=1598610067

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

c8bef2fe7b345380c0da251c82c7ea5aba5340d7ddd7e7d6927d628aad21d406

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 31 Aug 2020 21:11:05 GMT
last-modified: Fri, 28 Aug 2020 10:26:24 GMT
Server: Tengine
etag: "5f48dbd0-6b7c"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
cache-control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 27516
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5f49b1aa65fe1569602305.jpg
video.sekindo.com/uploads/cn22/video/users/converted/24485/video_5c74e337b0b1c456249184/ 16 KB
16 KB 30ms
28ms Image
image/jpeg 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn22/video/users/converted/24485/video_5c74e337b0b1c456249184/vid5f49b1aa65fe1569602305.jpg?cbuster=1598665132

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

95d620d3536c6cab025e39204ce48e4e4fa1e2f7c5acdae3c88686e1692a19b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 31 Aug 2020 21:11:05 GMT
last-modified: Sat, 29 Aug 2020 01:47:18 GMT
Server: Tengine
etag: "5f49b3a6-3e3f"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
cache-control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 15935
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5f48da950f2a2202128399.jpg
video.sekindo.com/uploads/cn21/video/users/converted/24485/video_5c74e337b0b1c456249184/ 7 KB
8 KB 26ms
24ms Image
image/jpeg 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn21/video/users/converted/24485/video_5c74e337b0b1c456249184/vid5f48da950f2a2202128399.jpg?cbuster=1598610070

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

9785fb7b221d3b9c2fe68d6058ff6326c010842bb699a411ecad99f16f65b2b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 31 Aug 2020 21:11:05 GMT
last-modified: Fri, 28 Aug 2020 10:26:46 GMT
Server: Tengine
etag: "5f48dbe6-1cbd"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
cache-control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 7357
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2

200

sync
x.bidswitch.net/ul_cb/ Frame AE5F
Redirect Chain

https://x.bidswitch.net/sync?ssp=sekindo&user_id=5f4d677bccfc9&custom_data=5f4d677bccfc9&gdpr=1&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=sekindo&user_id=5f4d677bccfc9&custom_data=5f4d677bccfc9&gdpr=1&gdpr_consent=

43 B
410 B

24ms
24ms

Image
image/gif

35.156.223.207
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?ssp=sekindo&user_id=5f4d677bccfc9&custom_data=5f4d677bccfc9&gdpr=1&gdpr_consent=
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.156.223.207 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 31 Aug 2020 21:11:27 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

status: 302
date: Mon, 31 Aug 2020 21:11:27 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
location: https://x.bidswitch.net/ul_cb/sync?ssp=sekindo&user_id=5f4d677bccfc9&custom_data=5f4d677bccfc9&gdpr=1&gdpr_consent=
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200
OK

liveCS.php
live.sekindo.com/live/ Frame AE5F
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D93%26advUuid%3D%7Bdevice_id%7D
https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=93&advUuid=9db49dab-ebc1-4b52-b778-b42ce70e9842

0
321 B

20ms
20ms

Image
text/html

185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=93&advUuid=9db49dab-ebc1-4b52-b778-b42ce70e9842
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:23 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
content-type: text/html; charset=utf-8

Redirect headers

status: 307
date: Mon, 31 Aug 2020 21:11:24 GMT
content-length: 0
location: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=93&advUuid=9db49dab-ebc1-4b52-b778-b42ce70e9842

GET
H2 200 adsct
t.co/i/ 43 B
448 B 201ms
144ms Image
image/gif 104.244.42.69
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.69 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 120
pragma: no-cache
last-modified: Mon, 31 Aug 2020 21:11:24 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 5d5890ebfe96da096b945cbf02d0bfca
x-transaction: 00c724f80031be64
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://fonts.googleapis.com/css?family=Roboto&display=swap
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 09:03:54 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 43650
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Tue, 31 Aug 2021 09:03:54 GMT

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame AE5F 77 KB
3 KB 67ms
67ms XHR
application/json 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.1.0&vid_viewabilityState=1&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn16%2Fvideo%2Fusers%2Fconverted%2F24485%2Fvideo1523972806%2Fvid5f453c65006a7774132681.mp4&vid_content_id=974903&vid_content_desc=Gold+Is+Becoming+Too+Crowded%2C+AMP+Capital%27s+Naeimi+Says&vid_content_title=Gold+Is+Becoming+Too+Crowded%2C+AMP+Capital%27s+Naeimi+Says&vid_content_duration=296&debugInformation=ABT+%2F+DynamicFloor+%2F+2+%2F+Active&x=320&y=180&fpl=1&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ri=6C69766553746174737C736B317B54307D7B64323032302D30392D30315F30307D7B7331323334383830387D7B4338357D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B7251554A554943386752486C755957317059305A7362323979494338674D6941764945466A64476C325A513D3D7D7B4C363631357DFEFE&isApp=0&geoLati=50.8847&geoLong=4.5049&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F83.0.4103.61+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5f4d677bccfc9&cbuster=1598908284292&gdpr=1&gdprConsent=&isWePassGdpr=0
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30392D30315F30307D7B7331323334383830387D7B4338357D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B7251554A554943386752486C755957317059305A7362323979494338674D6941764945466A64476C325A513D3D7D7B4C363631357DFEFE&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F83.0.4103.61+Safari%2F537.36&fpl=-1&debugInformation=ABT+%2F+DynamicFloor+%2F+2+%2F+Active&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=30&c2pWaitTime=10&csuuid=5f4d677bccfc9&debugInfo=12348808_ABT+%2F+DynamicFloor+%2F+2+%2F+Active&debugPlayerSession=&pubUrlDEMO=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.8847&geoLong=4.5049&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 152f44a1d127a5a4b87a08fa6b547da9628e8ad66c691f5180588a0a929b98a9

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:24 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 3123

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame AE5F 25 KB
2 KB 66ms
66ms XHR
application/json 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.1.0&vid_viewabilityState=0&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn16%2Fvideo%2Fusers%2Fconverted%2F24485%2Fvideo1523972806%2Fvid5f453c65006a7774132681.mp4&vid_content_id=974903&vid_content_desc=Gold+Is+Becoming+Too+Crowded%2C+AMP+Capital%27s+Naeimi+Says&vid_content_title=Gold+Is+Becoming+Too+Crowded%2C+AMP+Capital%27s+Naeimi+Says&vid_content_duration=296&debugInformation=ABT+%2F+DynamicFloor+%2F+2+%2F+Active&x=320&y=180&fpl=1&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ri=6C69766553746174737C736B317B54307D7B64323032302D30392D30315F30307D7B7331323334383830387D7B4338357D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B7251554A554943386752486C755957317059305A7362323979494338674D6941764945466A64476C325A513D3D7D7B4C363631357DFEFE&isApp=0&geoLati=50.8847&geoLong=4.5049&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F83.0.4103.61+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5f4d677bccfc9&cbuster=1598908284293&gdpr=1&gdprConsent=&isWePassGdpr=0
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30392D30315F30307D7B7331323334383830387D7B4338357D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B7251554A554943386752486C755957317059305A7362323979494338674D6941764945466A64476C325A513D3D7D7B4C363631357DFEFE&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F83.0.4103.61+Safari%2F537.36&fpl=-1&debugInformation=ABT+%2F+DynamicFloor+%2F+2+%2F+Active&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=30&c2pWaitTime=10&csuuid=5f4d677bccfc9&debugInfo=12348808_ABT+%2F+DynamicFloor+%2F+2+%2F+Active&debugPlayerSession=&pubUrlDEMO=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=50.8847&geoLong=4.5049&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 5bc007ee201fc5230153fffb0d9f029e10dbaab754cf9d0ac3e8094968e7ec3f

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:24 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 1834

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ Frame AE5F 6 KB
3 KB 24ms
22ms XHR
application/javascript 99.86.5.213
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.5.213 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-5-213.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 05:02:12 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin
age: 58153
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Thu, 20 Aug 2020 07:51:21 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: GmoBA1fVmA4B1UWr3fqWtzvmNqHt01jRcvIMkJC5C3KMBCmElZE5GA==

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame AE5F 0
215 B 367ms
47ms XHR
application/json 52.28.38.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.28.38.201 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame AE5F 0
59 B 37ms
19ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Mon, 31 Aug 2020 21:11:24 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ Frame AE5F 24 B
672 B 90ms
88ms XHR
application/json 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=435871&v=8.1&r={%22id%22:%225d56acc503cb25%22,%22imp%22:[{%22id%22:%22680861c25e9e73%22,%22ext%22:{%22siteID%22:%22435871%22,%22sid%22:%22320x180%22},%22bidfloor%22:3,%22bidfloorcur%22:%22USD%22,%22video%22:{%22mimes%22:[%22video/mp4%22,%22application/javascript%22],%22minduration%22:1,%22maxduration%22:200,%22api%22:[1,2],%22protocols%22:[1,2,3,4,5,6],%22linearity%22:1,%22startdelay%22:0,%22skip%22:1,%22w%22:320,%22h%22:180,%22placement%22:1}},{%22id%22:%227ee637b771f03a%22,%22ext%22:{%22siteID%22:%22435870%22,%22sid%22:%22320x180%22},%22bidfloor%22:3,%22bidfloorcur%22:%22USD%22,%22video%22:{%22mimes%22:[%22video/mp4%22,%22application/javascript%22],%22minduration%22:1,%22maxduration%22:200,%22api%22:[1,2],%22protocols%22:[1,2,3,4,5,6],%22linearity%22:1,%22startdelay%22:0,%22skip%22:1,%22w%22:320,%22h%22:180,%22placement%22:1}}],%22site%22:{%22page%22:%22https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue%22},%22ext%22:{%22source%22:%22prebid%22},%22source%22:{%22ext%22:{%22schain%22:{%22ver%22:%221.0%22,%22complete%22:1,%22nodes%22:[{%22asi%22:%22admetricspro.com%22,%22sid%22:%221005%22,%22hp%22:1}]}}},%22regs%22:{%22ext%22:{%22gdpr%22:1}},%22user%22:{%22ext%22:{%22consent%22:%22%22}}}&ac=j&sd=1&nf=1
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d2441096bd7de5d08f47b80e1406c927d0b19ab810c1ece78d5bdfb040a20d69

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 31 Aug 2020 21:11:24 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 44
Expires: Mon, 31 Aug 2020 21:11:24 GMT

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame AE5F 92 B
285 B 39ms
37ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=8b1150d0-a43d-4a34-8e5b-93e5e015a459&nocache=1598908284444&gdpr_consent=&gdpr=1&schain=1.0,1!admetricspro.com,1005,1,,,&skip=1&auid=540882778&vwd=320&vht=180
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: OXGW/16.192.1 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:24 GMT
via: 1.1 google
server: OXGW/16.192.1
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame AE5F 19 B
710 B 26ms
26ms XHR
application/json 37.252.172.38
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.38 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

690.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 31 Aug 2020 21:11:24 GMT
X-Proxy-Origin: 82.102.19.136; 82.102.19.136; 690.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.183:80
AN-X-Request-Uuid: a618cea9-52c8-42a5-b739-df267b6b8ad8
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/QVh-Tz10ahidjrORgXOS1oB0/ 337 KB
132 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/QVh-Tz10ahidjrORgXOS1oB0/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en&render=explicit&ver=5.4.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

919ce225464d5e8d79944356fcaa74323a12f8fc847eec6c7a877f9e752f7fb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 24 Aug 2020 21:36:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 24 Aug 2020 04:38:28 GMT
server: sffe
age: 603267
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 135073
x-xss-protection: 0
expires: Tue, 24 Aug 2021 21:36:57 GMT

GET
H2 200 flipboard.svg
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/ 236 B
566 B 269ms
269ms Image
image/svg+xml 2600:9000:2156:1400:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/flipboard.svg
Requested by: Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=8c4fcc0f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:1400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70

Request headers

Referer: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=8c4fcc0f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Mon, 31 Aug 2020 21:11:24 GMT
content-encoding: gzip
last-modified: Mon, 31 Aug 2020 14:26:41 GMT
server: nginx
x-amz-cf-pop: FRA50-C1
etag: W/"5f4d08a1-ec"
x-cache: Miss from cloudfront
content-type: image/svg+xml
status: 200
cache-control: max-age=604800, public
x-amz-cf-id: kmUn9xFLCLpOW4oswFUymqp7bkY78051PGXIZc8uf9B0vzSzZE3G7g==
via: 1.1 a1098f0eeab192209962e3a9d76d0339.cloudfront.net (CloudFront)
expires: Mon, 07 Sep 2020 21:11:24 GMT

GET
H2 200 fontawesome-webfont.woff2
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/ 75 KB
76 KB 497ms
478ms Font
font/woff2 2600:9000:2156:1400:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=8c4fcc0f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:1400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Origin: https://threatpost.com
Referer: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=8c4fcc0f
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:24 GMT
via: 1.1 d55780b776b171387055eca956ae29a9.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 77160
pragma: public
last-modified: Mon, 31 Aug 2020 14:26:42 GMT
server: nginx
etag: "5f4d08a2-12d68"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
x-amz-cf-id: cC2Wbn4y4zU5zItbcBkahZCU3MhjrgeuSFA-X56aRpsFvizGV2256w==
expires: Tue, 31 Aug 2021 21:11:24 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
649 B 187ms
140ms Script
application/javascript 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 116
pragma: no-cache
last-modified: Mon, 31 Aug 2020 21:11:24 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: e00a99ea1c629f6a463c14a2e5681eec
x-transaction: 00f870eb0082dfe0
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 anchor
www.google.com/recaptcha/api2/ Frame 7C80 0
0 152ms
151ms Document
text/html 2a00:1450:4001:816::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=QVh-Tz10ahidjrORgXOS1oB0&theme=standard&size=normal&cb=fyebhf3hepnn

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-EtwXs9dTwEfNFr69N7fN9A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=QVh-Tz10ahidjrORgXOS1oB0&theme=standard&size=normal&cb=fyebhf3hepnn
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 31 Aug 2020 21:11:24 GMT
content-security-policy: script-src 'report-sample' 'nonce-EtwXs9dTwEfNFr69N7fN9A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10390
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 / Show response
graph.facebook.com/ 82 B
490 B 62ms
47ms XHR
application/json 2a03:2880:f02d:e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?id=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1554f794a0cc095ee381dee0971f1d1a8a9aaa55c743103e24913f07e18ec6b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
etag: "18d473d4e6c8864964840ba010bee2d3d0c74b27"
status: 200
x-fb-rev: 1002595345
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 82
pragma: no-cache
x-fb-debug: 5VheGTkv7ip9LKfMnz6j21z4i1aysxYhSy93eN/m2OyFEENwcO5L3lezqlqVAwSt9WlJhnl5dhiz6MoS25k2VA==
x-fb-trace-id: DoNHz4RyPPD
date: Mon, 31 Aug 2020 21:11:24 GMT
content-type: application/json
access-control-allow-origin: *
x-fb-request-id: A0fiZ6jKy5GQBzb2VT0IYxL
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v3.1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 404 share
www.linkedin.com/countserv/count/ 0
0 204ms
188ms Script
text/html 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.linkedin.com/countserv/count/share?url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F&format=jsonp&callback=jQuery1124012239389729874284_1598908283610&_=1598908283611
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 info.json Show response
www.reddit.com/api/ 102 B
1 KB 223ms
168ms XHR
application/json 199.232.53.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reddit.com/api/info.json?url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.53.140 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

snooserv /

Resource Hash

f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:24 GMT
via: 1.1 varnish
x-content-type-options: nosniff
status: 200
content-length: 102
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge
x-moose: majestic
server: snooserv
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: X-Moose
cache-control: private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
accept-ranges: bytes
expires: -1

GET
H2 200 pixel;r=751629205;source=gtm;rf=0;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue;fpan=1;fpa=P0-105086734-1598908284588;ns=0;...
pixel.quantserve.com/ 35 B
371 B 10ms
9ms Image
image/gif 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=751629205;source=gtm;rf=0;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue;fpan=1;fpa=P0-105086734-1598908284588;ns=0;ce=1;qjs=1;qv=35f667c6-20200713111428;cm=;gdpr=0;ref=;d=threatpost.com;je=0;sr=1600x1200x24;enc=n;dst=1;et=1598908284588;tzo=-120;ogl=image.https%3A%2F%2Fmedia%252Ethreatpost%252Ecom%2Fwp-content%2Fuploads%2Fsites%2F103%2F2020%2F01%2F22100148%2Ftroja%2Ctype.article%2Ctitle.Shlayer%20Mac%20Malware%20Returns%20with%20Extra%20Sneakiness%2Cdescription.Spreading%20via%20poisoned%20Google%20search%20results%252C%20this%20new%20version%20of%20Mac's%20No%252E%201%20th%2Curl.https%3A%2F%2Fthreatpost%252Ecom%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:24 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
status: 200
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 anchor
www.google.com/recaptcha/api2/ Frame 98A2 0
0 36ms
35ms Document
text/html 2a00:1450:4001:816::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=QVh-Tz10ahidjrORgXOS1oB0&theme=light&size=normal&cb=9tiqvomgd4jw

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-DR4SECY9RvwIYug/4rKsOA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=QVh-Tz10ahidjrORgXOS1oB0&theme=light&size=normal&cb=9tiqvomgd4jw
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 31 Aug 2020 21:11:24 GMT
content-security-policy: script-src 'report-sample' 'nonce-DR4SECY9RvwIYug/4rKsOA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10747
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
890 B 28ms
16ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 31 Aug 2020 21:11:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
890 B 29ms
16ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 31 Aug 2020 21:11:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 144 KB
18 KB 377ms
375ms XHR
text/plain 172.217.18.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3776165179607908&correlator=1985797843066176&output=ldjh&impl=fifs&eid=21066032%2C21067127%2C21067203&vrg=2020082701&gdpr=0&tfua=0&tfcd=0&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200831&iu_parts=21707124336%2CThreatPost-970x250-ATF%2CThreatPost-300x250-ATF%2CThreatPost-300x600-ATF%2CThreatPost-2x2-Skin&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%7C970x250%7C970x90%2C300x250%7C336x280%2C300x250%7C300x600%2C2x2&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%26hb_adid_rubicon%3D648ea67f9eab11a%26hb_bidder_rubicon%3Drubicon%26dyn_bids%3D0.10%26hb_adid%3D648ea67f9eab11a%26hb_bidder%3Drubicon%7Camznbid%3D2%26amznp%3D2%26hb_adid_nobid%3D63a9cbdee152d95%26hb_bidder_nobid%3Dnobid%26dyn_bids%3D0.01%26hb_adid%3D63a9cbdee152d95%26hb_bidder%3Dnobid%7Camznbid%3D2%26amznp%3D2&eri=1&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Fshlayer-mac-malware-extra-sneakiness%252F156669%252F%26urlquery%3Dgoogfc%26contentid%3D156669%26category%3Deditors-picks%26contenttags%3Danti-evasion%252Cfake-adobe-flash-installer%252Cgoogle-search%252Cintego%252Cmac-malware%252Cmalware-analysis%252Cnew-version%252Cpoisoned-search-results%252Cshlayer%252Cstealth&cookie_enabled=1&bc=31&abxe=1&lmt=1598908284&dt=1598908284639&dlt=1598908282927&idt=606&frm=20&biw=1600&bih=1200&oid=3&adxs=436%2C1082%2C1082%2C0&adys=10%2C257%2C1570%2C0&adks=1015519800%2C654286612%2C375389812%2C3385906655&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&dssz=51&icsg=171851648000&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90%7C300x250%7C300x250%7C1600x2&msz=728x90%7C300x250%7C300x250%7C1600x2&ga_vid=2075126819.1598908284&ga_sid=1598908285&ga_hid=1250074073&fws=0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020082701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s29-in-f2.1e100.net

Software

cafe /

Resource Hash

2dc46a5c066cf11fb55779d15805ef190c46451e30343e10483709d5f20e1900

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:25 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17687
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,5283645110
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,-1,138301519116
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://threatpost.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
54d623ab6ca75f98feb0b16010cc1ec0.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 0
0 112ms
38ms Other
text/html 2a00:1450:4001:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://54d623ab6ca75f98feb0b16010cc1ec0.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 54ms
5ms Other
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame AE5F 0
59 B 21ms
20ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Mon, 31 Aug 2020 21:11:25 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame AE5F 173 B
381 B 93ms
23ms XHR
application/json 3.120.9.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.9.189 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: c55fd3a48d3838d61dfc82410a2c440bea8ecb0b4bf1b451012ac04327ed4bd8

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:24 GMT
content-encoding: gzip
status: 200
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 168
expires: 0

GET
H3-Q050 200 bframe
www.google.com/recaptcha/api2/ Frame 082C 0
0 21ms
21ms Document
text/html 2a00:1450:4001:816::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=QVh-Tz10ahidjrORgXOS1oB0&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=x2kx8koqh6rk

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:816::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-CZpaf6CS3bGhiSbKz0PMlA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=QVh-Tz10ahidjrORgXOS1oB0&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=x2kx8koqh6rk
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 31 Aug 2020 21:11:24 GMT
content-security-policy: script-src 'report-sample' 'nonce-CZpaf6CS3bGhiSbKz0PMlA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1174
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 bframe
www.google.com/recaptcha/api2/ Frame 7AAD 0
0 26ms
26ms Document
text/html 2a00:1450:4001:816::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=QVh-Tz10ahidjrORgXOS1oB0&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=d8k1antr32b2

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:816::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-eWtEV71tTwoKA6/+JWQL8g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=QVh-Tz10ahidjrORgXOS1oB0&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=d8k1antr32b2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 31 Aug 2020 21:11:25 GMT
content-security-policy: script-src 'report-sample' 'nonce-eWtEV71tTwoKA6/+JWQL8g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1176
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 bl-9a4f7ce-c706c2eb.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame FDF9 74 KB
21 KB 32ms
31ms Script
application/javascript 143.204.201.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-9a4f7ce-c706c2eb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.201.95 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-201-95.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2568034b9d66c093730623e756fb7be1e3382eda3ea7f521188d0390bb61b07a

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 20:47:04 GMT
content-encoding: gzip
age: 1462
x-cache: Hit from cloudfront
status: 200
content-length: 21305
x-amz-meta-git_commit: 9a4f7ce
last-modified: Mon, 31 Aug 2020 20:45:21 GMT
server: AmazonS3
etag: "2635bfe525e35422f9b20c75390f3e25"
x-amz-version-id: tZyo2bsqyZxiTa8olUgtXvuXBT9w5Mhi
via: 1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: lfIGBlIv-Dsf58nlOR22N6UUW4EQaNo10DA7R36WhWOOUdtltAj5og==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame FDF9 61 KB
21 KB 31ms
30ms Script
application/javascript 143.204.201.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.201.95 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-201-95.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 18 Aug 2020 17:46:30 GMT
content-encoding: gzip
age: 1135496
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: -aetf4nHLsZXrHuAp0rWoM6xYVEt34W3vQ5_y4-4jUCa3Fi7FdAD0A==

GET
H2 200 bl-9a4f7ce-c706c2eb.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 78B8 74 KB
21 KB 23ms
23ms Script
application/javascript 143.204.201.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-9a4f7ce-c706c2eb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.201.95 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-201-95.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2568034b9d66c093730623e756fb7be1e3382eda3ea7f521188d0390bb61b07a

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 20:47:04 GMT
content-encoding: gzip
age: 1462
x-cache: Hit from cloudfront
status: 200
content-length: 21305
x-amz-meta-git_commit: 9a4f7ce
last-modified: Mon, 31 Aug 2020 20:45:21 GMT
server: AmazonS3
etag: "2635bfe525e35422f9b20c75390f3e25"
x-amz-version-id: tZyo2bsqyZxiTa8olUgtXvuXBT9w5Mhi
via: 1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: 1VscciC-Zzqb8BArL6PsIpvrhmBeSNMOtOaKp_iK75hTS52wWdkN8A==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 78B8 61 KB
21 KB 24ms
23ms Script
application/javascript 143.204.201.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.201.95 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-201-95.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 18 Aug 2020 17:46:30 GMT
content-encoding: gzip
age: 1135496
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: p5klZkmy8cqKF1qOPpAJ710CZ8ZerqjVvXOZbyY-I-AMWJqkkdkdEQ==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
425 B 81ms
25ms Other
text/plain 13.224.193.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=eyJzaXRlSWQiOiJtYXRoLWFpZHMtdGhyZWF0cG9zdCIsInVybCI6Imh0dHBzOi8vdGhyZWF0cG9zdC5jb20vc2hsYXllci1tYWMtbWFsd2FyZS1leHRyYS1zbmVha2luZXNzLzE1NjY2OS8%2Fd2ViX3ZpZXc9dHJ1ZSIsImFkVW5pdCI6Ii8yMTcwNzEyNDMzNi9UaHJlYXRQb3N0LTMwMHg2MDAtQVRGXzAiLCJhZFNlcnZlckRldGFpbHMiOnsiYWR2ZXJ0aXNlcklkIjoiNDU5NDU1OTc1MiIsImNhbXBhaWduSWQiOiIyNjU0MDI1MDM5IiwiY3JlYXRpdmVJZCI6IjEzODMwMTEzMDEzMyIsImxpbmVpdGVtSWQiOiI1Mjc1NjY4OTA3IiwiYWRTZXJ2ZXIiOiJkZnAifSwid2lkdGgiOjMwMCwiaGVpZ2h0IjoyNTAsInd2IjoiMS4wLjArOWE0ZjdjZSIsImJ2IjoiMS4wLjArOWE0ZjdjZSIsInRhZ01hcmt1cCI6IjxpZnJhbWUgaWQ9XCJnb29nbGVfYWRzX2lmcmFtZV8vMjE3MDcxMjQzMzYvVGhyZWF0UG9zdC0zMDB4NjAwLUFURl8wXCIgdGl0bGU9XCIzcmQgcGFydHkgYWQgY29udGVudFwiIG5hbWU9XCJnb29nbGVfYWRzX2lmcmFtZV8vMjE3MDcxMjQzMzYvVGhyZWF0UG9zdC0zMDB4NjAwLUFURl8wXCIgd2lkdGg9XCIzMDBcIiBoZWlnaHQ9XCI2MDBcIiBzY3JvbGxpbmc9XCJub1wiIG1hcmdpbndpZHRoPVwiMFwiIG1hcmdpbmhlaWdodD1cIjBcIiBmcmFtZWJvcmRlcj1cIjBcIiBzcmNkb2M9XCJcIiBzYW5kYm94PVwiYWxsb3ctZm9ybXMgYWxsb3ctcG9wdXBzIGFsbG93LXBvcHVwcy10by1lc2NhcGUtc2FuZGJveCBhbGxvdy1wb2ludGVyLWxvY2sgYWxsb3ctc2FtZS1vcmlnaW4gYWxsb3ctc2NyaXB0cyBhbGxvdy10b3AtbmF2aWdhdGlvbi1ieS11c2VyLWFjdGl2YXRpb25cIiBzdHlsZT1cImJvcmRlcjogMHB4OyB2ZXJ0aWNhbC1hbGlnbjogYm90dG9tO1wiPjwvaWZyYW1lPjwhLS0gSUZSQU1FIElOTkVSIENPTlRFTlQgLS0%2BIiwiYmxhY2tsaXN0RGF0YSI6eyJhY3Rpb24iOjEwLCJhY3Rpb25EZXRhaWxzIjoibmV3Y2hpYy5jb20iLCJyZXBvcnRNYXJrdXAiOnRydWUsIml0ZW1zIjpbeyJob3N0bmFtZSI6Im5ld2NoaWMuY29tIiwidG9rZW4iOiIiLCJhY3Rpb24iOjEwfV0sIm1hcmt1cCI6IjwhZG9jdHlwZSBodG1sPjxodG1sIGFtcDRhZHMgY2xhc3M9aS1hbXBodG1sLWluYWJveCBpLWFtcGh0bWwtbGF5b3V0IGktYW1waHRtbC1uby1ib2lsZXJwbGF0ZT48aGVhZD48bWV0YSBuYW1lPVwicmVmZXJyZXJcIiBjb250ZW50PVwib3JpZ2luXCI%2BPG1ldGEgaHR0cC1lcXVpdj1Db250ZW50LVNlY3VyaXR5LVBvbGljeSBjb250ZW50PVwic2NyaXB0LXNyYyBodHRwczovL2Nkbi5hbXBwcm9qZWN0Lm9yZy87b2JqZWN0LXNyYyAnbm9uZSc7Y2hpbGQtc3JjIGJsb2I6O2ZyYW1lLXNyYyAnbm9uZSdcIj48bWV0YSBjaGFyc2V0PXV0Zi04PjxzdHlsZSBhbXAtcnVudGltZSBpLWFtcGh0bWwtdmVyc2lvbj0wMTIwMDgyNDIzMDEwMDA%2BaHRtbHtvdmVyZmxvdy14OmhpZGRlbiFpbXBvcnRhbnR9aHRtbC5pLWFtcGh0bWwtZmlle2hlaWdodDoxMDAlIWltcG9ydGFudDt3aWR0aDoxMDAlIWltcG9ydGFudH1odG1sOm5vdChbYW1wNGFkc10pLGh0bWw6bm90KFthbXA0YWRzXSkgYm9keXtoZWlnaHQ6YXV0byFpbXBvcnRhbnR9aHRtbDpub3QoW2FtcDRhZHNdKSBib2R5e21hcmdpbjowIWltcG9ydGFudH1ib2R5ey13ZWJraXQtdGV4dC1zaXplLWFkanVzdDoxMDAlOy1tb3otdGV4dC1zaXplLWFkanVzdDoxMDAlOy1tcy10ZXh0LXNpemUtYWRqdXN0OjEwMCU7dGV4dC1zaXplLWFkanVzdDoxMDAlfWh0bWwuaS1hbXBodG1sLXNpbmdsZWRvYy5pLWFtcGh0bWwtZW1iZWRkZWR7LW1zLXRvdWNoLWFjdGlvbjpwYW4teTt0b3VjaC1hY3Rpb246cGFuLXl9aHRtbC5pLWFtcGh0bWwtZmllPmJvZHksaHRtbC5pLWFtcGh0bWwtc2luZ2xlZG9jPmJvZHl7b3ZlcmZsb3c6dmlzaWJsZSFpbXBvcnRhbnR9aHRtbC5pLWFtcGh0bWwtZmllOm5vdCguaS1hbXBodG1sLWluYWJveCk%2BYm9keSxodG1sLmktYW1waHRtbC1zaW5nbGVkb2M6bm90KC5pLWFtcGh0bWwtaW5hYm94KT5ib2R5e3Bvc2l0aW9uOnJlbGF0aXZlIWltcG9ydGFudH1odG1sLmktYW1waHRtbC13ZWJ2aWV3PmJvZHl7b3ZlcmZsb3cteDpoaWRkZW4haW1wb3J0YW50O292ZXJmbG93LXk6dmlzaWJsZSFpbXBvcnRhbnQ7bWluLWhlaWdodDoxMDB2aCFpbXBvcnRhbnR9aHRtbC5pLWFtcGh0bWwtaW9zLWVtYmVkLWxlZ2FjeT5ib2R5e292ZXJmbG93LXg6aGlkZGVuIWltcG9ydGFudDtvdmVyZmxvdy15OmF1dG8haW1wb3J0YW50O3Bvc2l0aW9uOmFic29sdXRlIWltcG9ydGFudH1odG1sLmktYW1waHRtbC1pb3MtZW1iZWR7b3ZlcmZsb3cteTphdXRvIWltcG9ydGFudDtwb3NpdGlvbjpzdGF0aWN9I2ktYW1waHRtbC13cmFwcGVye292ZXJmbG93LXg6aGlkZGVuIWltcG9ydGFudDtvdmVyZmxvdy15OmF1dG8haW1wb3J0YW50O3Bvc2l0aW9uOmFic29sdXRlIWltcG9ydGFudDt0b3A6MCFpbXBvcnRhbnQ7bGVmdDowIWltcG9ydGFudDtyaWdodDowIWltcG9ydGFudDtib3R0b206MCFpbXBvcnRhbnQ7bWFyZ2luOjAhaW1wb3J0YW50O2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50fWh0bWwuaS1hbXBodG1sLWlvcy1lbWJlZC5pLWFtcGh0bWwtaW9zLW92ZXJzY3JvbGwsaHRtbC5pLWFtcGh0bWwtaW9zLWVtYmVkLmktYW1waHRtbC1pb3Mtb3ZlcnNjcm9sbD4jaS1hbXBodG1sLXdyYXBwZXJ7LXdlYmtpdC1vdmVyZmxvdy1zY3JvbGxpbmc6dG91Y2ghaW1wb3J0YW50fSNpLWFtcGh0bWwtd3JhcHBlcj5ib2R5e3Bvc2l0aW9uOnJlbGF0aXZlIWltcG9ydGFudDtib3JkZXItdG9wOjFweCBzb2xpZCB0cmFuc3BhcmVudCFpbXBvcnRhbnR9I2ktYW1waHRtbC13cmFwcGVyK2JvZHl7dmlzaWJpbGl0eTp2aXNpYmxlfSNpLWFtcGh0bWwtd3JhcHBlcitib2R5IC5pLWFtcGh0bWwtbGlnaHRib3gtZWxlbWVudCwjaS1hbXBodG1sLXdyYXBwZXIrYm9keVtpLWFtcGh0bWwtbGlnaHRib3hde3Zpc2liaWxpdHk6aGlkZGVufSNpLWFtcGh0bWwtd3JhcHBlcitib2R5W2ktYW1waHRtbC1saWdodGJveF0gLmktYW1waHRtbC1saWdodGJveC1lbGVtZW50e3Zpc2liaWxpdHk6dmlzaWJsZX0jaS1hbXBodG1sLXdyYXBwZXIuaS1hbXBodG1sLXNjcm9sbC1kaXNhYmxlZCwuaS1hbXBodG1sLXNjcm9sbC1kaXNhYmxlZHtvdmVyZmxvdy14OmhpZGRlbiFpbXBvcnRhbnQ7b3ZlcmZsb3cteTpoaWRkZW4haW1wb3J0YW50fWFtcC1pbnN0YWdyYW17cGFkZGluZzo1NHB4IDBweCAwcHghaW1wb3J0YW50O2JhY2tncm91bmQtY29sb3I6I2ZmZn1hbXAtaWZyYW1lIGlmcmFtZXtib3gtc2l6aW5nOmJvcmRlci1ib3ghaW1wb3J0YW50fVthbXAtYWNjZXNzXVthbXAtYWNjZXNzLWhpZGVde2Rpc3BsYXk6bm9uZX1bc3Vic2NyaXB0aW9ucy1kaWFsb2ddLGJvZHk6bm90KC5pLWFtcGh0bWwtc3Vicy1yZWFkeSkgW3N1YnNjcmlwdGlvbnMtYWN0aW9uXSxib2R5Om5vdCguaS1hbXBodG1sLXN1YnMtcmVhZHkpIFtzdWJzY3JpcHRpb25zLXNlY3Rpb25de2Rpc3BsYXk6bm9uZSFpbXBvcnRhbnR9YW1wLWV4cGVyaW1lbnQsYW1wLWxpdmUtbGlzdD5bdXBkYXRlXXtkaXNwbGF5Om5vbmV9LmktYW1waHRtbC1qYW5rLW1ldGVye3Bvc2l0aW9uOmZpeGVkO2JhY2tncm91bmQtY29sb3I6cmdiYSgyMzIsNzIsOTUsMC41KTtib3R0b206MDtyaWdodDowO2NvbG9yOiNmZmY7Zm9udC1zaXplOjE2cHg7ei1pbmRleDoxMDAwO3BhZGRpbmc6NXB4fWFtcC1saXN0W3Jlc2l6YWJsZS1jaGlsZHJlbl0%2BLmktYW1waHRtbC1sb2FkaW5nLWNvbnRhaW5lci5hbXAtaGlkZGVue2Rpc3BsYXk6bm9uZSFpbXBvcnRhbnR9YW1wLWxpc3QgW2ZldGNoLWVycm9yXSxhbXAtbGlzdFtsb2FkLW1vcmVdIFtsb2FkLW1vcmUtYnV0dG9uXSxhbXAtbGlzdFtsb2FkLW1vcmVdIFtsb2FkLW1vcmUtZW5kXSxhbXAtbGlzdFtsb2FkLW1vcmVdIFtsb2FkLW1vcmUtZmFpbGVkXSxhbXAtbGlzdFtsb2FkLW1vcmVdIFtsb2FkLW1vcmUtbG9hZGluZ117ZGlzcGxheTpub25lfWFtcC1saXN0W2RpZmZhYmxlXSBkaXZbcm9sZT1saXN0XXtkaXNwbGF5OmJsb2NrfWFtcC1zdG9yeS1wYWdlLGFtcC1zdG9yeVtzdGFuZGFsb25lXXttaW4taGVpZ2h0OjFweCFpbXBvcnRhbnQ7ZGlzcGxheTpibG9jayFpbXBvcnRhbnQ7aGVpZ2h0OjEwMCUhaW1wb3J0YW50O21hcmdpbjowIWltcG9ydGFudDtwYWRkaW5nOjAhaW1wb3J0YW50O292ZXJmbG93OmhpZGRlbiFpbXBvcnRhbnQ7d2lkdGg6MTAwJSFpbXBvcnRhbnR9YW1wLXN0b3J5W3N0YW5kYWxvbmVde2JhY2tncm91bmQtY29sb3I6IzIwMjEyNSFpbXBvcnRhbnQ7cG9zaXRpb246cmVsYXRpdmUhaW1wb3J0YW50fWFtcC1zdG9yeS1wYWdle2JhY2tncm91bmQtY29sb3I6Izc1NzU3NX1hbXAtc3RvcnkgLmFtcC1hY3RpdmU%2BZGl2LGFtcC1zdG9yeSAuaS1hbXBodG1sLWxvYWRlci1iYWNrZ3JvdW5ke2Rpc3BsYXk6bm9uZSFpbXBvcnRhbnR9YW1wLXN0b3J5LXBhZ2U6bm90KDpmaXJzdC1vZi10eXBlKTpub3QoW2Rpc3RhbmNlXSk6bm90KFthY3RpdmVdKXt0cmFuc2Zvcm06dHJhbnNsYXRlWSgxMDAwdmgpIWltcG9ydGFudH1hbXAtYXV0b2NvbXBsZXRle3Bvc2l0aW9uOnJlbGF0aXZlIWltcG9ydGFudDtkaXNwbGF5OmlubGluZS1ibG9jayFpbXBvcnRhbnR9YW1wLWF1dG9jb21wbGV0ZT5pbnB1dCxhbXAtYXV0b2NvbXBsZXRlPnRleHRhcmVhe3BhZGRpbmc6MC41cmVtO2JvcmRlcjoxcHggc29saWQgcmdiYSgwLDAsMCwwLjMzKX0uaS1hbXBodG1sLWF1dG9jb21wbGV0ZS1yZXN1bHRzLGFtcC1hdXRvY29tcGxldGU%2BaW5wdXQsYW1wLWF1dG9jb21wbGV0ZT50ZXh0YXJlYXtmb250LXNpemU6MXJlbTtsaW5lLWhlaWdodDoxLjVyZW19W2FtcC1meF49Zmx5LWluXXt2aXNpYmlsaXR5OmhpZGRlbn1hbXAtc2NyaXB0W25vZG9tXXtwb3NpdGlvbjpmaXhlZCFpbXBvcnRhbnQ7dG9wOjAhaW1wb3J0YW50O3dpZHRoOjFweCFpbXBvcnRhbnQ7aGVpZ2h0OjFweCFpbXBvcnRhbnQ7b3ZlcmZsb3c6aGlkZGVuIWltcG9ydGFudDt2aXNpYmlsaXR5OmhpZGRlbn1cbi8qIyBzb3VyY2VVUkw9L2Nzcy9hbXBkb2MuY3NzKi9baGlkZGVuXXtkaXNwbGF5Om5vbmUhaW1wb3J0YW50fS5pLWFtcGh0bWwtZWxlbWVudHtkaXNwbGF5OmlubGluZS1ibG9ja30uaS1hbXBodG1sLWJsdXJyeS1wbGFjZWhvbGRlcnt0cmFuc2l0aW9uOm9wYWNpdHkgMC4zcyBjdWJpYy1iZXppZXIoMC4wLDAuMCwwLjIsMSkhaW1wb3J0YW50O3BvaW50ZXItZXZlbnRzOm5vbmV9W2xheW91dD1ub2Rpc3BsYXldOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpe2Rpc3BsYXk6bm9uZSFpbXBvcnRhbnR9LmktYW1waHRtbC1sYXlvdXQtZml4ZWQsW2xheW91dD1maXhlZF1bd2lkdGhdW2hlaWdodF06bm90KC5pLWFtcGh0bWwtbGF5b3V0LWZpeGVkKXtkaXNwbGF5OmlubGluZS1ibG9jaztwb3NpdGlvbjpyZWxhdGl2ZX0uaS1hbXBodG1sLWxheW91dC1yZXNwb25zaXZlLFtsYXlvdXQ9cmVzcG9uc2l2ZV1bd2lkdGhdW2hlaWdodF06bm90KC5pLWFtcGh0bWwtbGF5b3V0LXJlc3BvbnNpdmUpLFt3aWR0aF1baGVpZ2h0XVtoZWlnaHRzXTpub3QoW2xheW91dF0pOm5vdCguaS1hbXBodG1sLWxheW91dC1yZXNwb25zaXZlKSxbd2lkdGhdW2hlaWdodF1bc2l6ZXNdOm5vdChbbGF5b3V0XSk6bm90KC5pLWFtcGh0bWwtbGF5b3V0LXJlc3BvbnNpdmUpe2Rpc3BsYXk6YmxvY2s7cG9zaXRpb246cmVsYXRpdmV9LmktYW1waHRtbC1sYXlvdXQtaW50cmluc2ljLFtsYXlvdXQ9aW50cmluc2ljXVt3aWR0aF1baGVpZ2h0XTpub3QoLmktYW1waHRtbC1sYXlvdXQtaW50cmluc2ljKXtkaXNwbGF5OmlubGluZS1ibG9jaztwb3NpdGlvbjpyZWxhdGl2ZTttYXgtd2lkdGg6MTAwJX0uaS1hbXBodG1sLWxheW91dC1pbnRyaW5zaWMgLmktYW1waHRtbC1zaXplcnttYXgtd2lkdGg6MTAwJX0uaS1hbXBodG1sLWludHJpbnNpYy1zaXplcnttYXgtd2lkdGg6MTAwJTtkaXNwbGF5OmJsb2NrIWltcG9ydGFudH0uaS1hbXBodG1sLWxheW91dC1jb250YWluZXIs&i=1-8&t=adltag_kej0pkof_ATKTuxYTXqp&r=8f9327c4116d5df8731ffd844c80fb4&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.4 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-4.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 1d67a4c00b06651cb6daa95ec3f21f9b.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 70548
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Mon, 31 Aug 2020 01:35:38 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: oevdhQt9CANIP8gDH_evuCb1vWB_L4ReV7XnKormWmm00955PTm6AA==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
427 B 88ms
33ms Other
text/plain 13.224.193.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=LmktYW1waHRtbC1sYXlvdXQtZml4ZWQtaGVpZ2h0LFtsYXlvdXQ9Y29udGFpbmVyXSxbbGF5b3V0PWZpeGVkLWhlaWdodF1baGVpZ2h0XTpub3QoLmktYW1waHRtbC1sYXlvdXQtZml4ZWQtaGVpZ2h0KXtkaXNwbGF5OmJsb2NrO3Bvc2l0aW9uOnJlbGF0aXZlfS5pLWFtcGh0bWwtbGF5b3V0LWZpbGwsW2xheW91dD1maWxsXTpub3QoLmktYW1waHRtbC1sYXlvdXQtZmlsbCl7ZGlzcGxheTpibG9jaztvdmVyZmxvdzpoaWRkZW4haW1wb3J0YW50O3Bvc2l0aW9uOmFic29sdXRlO3RvcDowO2xlZnQ6MDtib3R0b206MDtyaWdodDowfS5pLWFtcGh0bWwtbGF5b3V0LWZsZXgtaXRlbSxbbGF5b3V0PWZsZXgtaXRlbV06bm90KC5pLWFtcGh0bWwtbGF5b3V0LWZsZXgtaXRlbSl7ZGlzcGxheTpibG9jaztwb3NpdGlvbjpyZWxhdGl2ZTstbXMtZmxleDoxIDEgYXV0bztmbGV4OjEgMSBhdXRvfS5pLWFtcGh0bWwtbGF5b3V0LWZsdWlke3Bvc2l0aW9uOnJlbGF0aXZlfS5pLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZHtvdmVyZmxvdzpoaWRkZW4haW1wb3J0YW50fS5pLWFtcGh0bWwtbGF5b3V0LWF3YWl0aW5nLXNpemV7cG9zaXRpb246YWJzb2x1dGUhaW1wb3J0YW50O3RvcDphdXRvIWltcG9ydGFudDtib3R0b206YXV0byFpbXBvcnRhbnR9aS1hbXBodG1sLXNpemVye2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50fS5pLWFtcGh0bWwtYmx1cnJ5LXBsYWNlaG9sZGVyLC5pLWFtcGh0bWwtZmlsbC1jb250ZW50e2Rpc3BsYXk6YmxvY2s7aGVpZ2h0OjA7bWF4LWhlaWdodDoxMDAlO21heC13aWR0aDoxMDAlO21pbi1oZWlnaHQ6MTAwJTttaW4td2lkdGg6MTAwJTt3aWR0aDowO21hcmdpbjphdXRvfS5pLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZCAuaS1hbXBodG1sLWZpbGwtY29udGVudHtwb3NpdGlvbjphYnNvbHV0ZTt0b3A6MDtsZWZ0OjA7Ym90dG9tOjA7cmlnaHQ6MH0uaS1hbXBodG1sLXJlcGxhY2VkLWNvbnRlbnQsLmktYW1waHRtbC1zY3JlZW4tcmVhZGVye3BhZGRpbmc6MCFpbXBvcnRhbnQ7Ym9yZGVyOm5vbmUhaW1wb3J0YW50fS5pLWFtcGh0bWwtc2NyZWVuLXJlYWRlcntwb3NpdGlvbjpmaXhlZCFpbXBvcnRhbnQ7dG9wOjBweCFpbXBvcnRhbnQ7bGVmdDowcHghaW1wb3J0YW50O3dpZHRoOjRweCFpbXBvcnRhbnQ7aGVpZ2h0OjRweCFpbXBvcnRhbnQ7b3BhY2l0eTowIWltcG9ydGFudDtvdmVyZmxvdzpoaWRkZW4haW1wb3J0YW50O21hcmdpbjowIWltcG9ydGFudDtkaXNwbGF5OmJsb2NrIWltcG9ydGFudDt2aXNpYmlsaXR5OnZpc2libGUhaW1wb3J0YW50fS5pLWFtcGh0bWwtc2NyZWVuLXJlYWRlcn4uaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ7bGVmdDo4cHghaW1wb3J0YW50fS5pLWFtcGh0bWwtc2NyZWVuLXJlYWRlcn4uaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ%2BLmktYW1waHRtbC1zY3JlZW4tcmVhZGVye2xlZnQ6MTJweCFpbXBvcnRhbnR9LmktYW1waHRtbC1zY3JlZW4tcmVhZGVyfi5pLWFtcGh0bWwtc2NyZWVuLXJlYWRlcn4uaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ%2BLmktYW1waHRtbC1zY3JlZW4tcmVhZGVye2xlZnQ6MTZweCFpbXBvcnRhbnR9LmktYW1waHRtbC11bnJlc29sdmVke3Bvc2l0aW9uOnJlbGF0aXZlO292ZXJmbG93OmhpZGRlbiFpbXBvcnRhbnR9LmktYW1waHRtbC1zZWxlY3QtZGlzYWJsZWR7LXdlYmtpdC11c2VyLXNlbGVjdDpub25lIWltcG9ydGFudDstbW96LXVzZXItc2VsZWN0Om5vbmUhaW1wb3J0YW50Oy1tcy11c2VyLXNlbGVjdDpub25lIWltcG9ydGFudDt1c2VyLXNlbGVjdDpub25lIWltcG9ydGFudH0uaS1hbXBodG1sLW5vdGJ1aWx0LFtsYXlvdXRdOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpLFt3aWR0aF1baGVpZ2h0XVtoZWlnaHRzXTpub3QoW2xheW91dF0pOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpLFt3aWR0aF1baGVpZ2h0XVtzaXplc106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KXtwb3NpdGlvbjpyZWxhdGl2ZTtvdmVyZmxvdzpoaWRkZW4haW1wb3J0YW50O2NvbG9yOnRyYW5zcGFyZW50IWltcG9ydGFudH0uaS1hbXBodG1sLW5vdGJ1aWx0Om5vdCguaS1hbXBodG1sLWxheW91dC1jb250YWluZXIpPiosW2xheW91dF06bm90KFtsYXlvdXQ9Y29udGFpbmVyXSk6bm90KC5pLWFtcGh0bWwtZWxlbWVudCk%2BKixbd2lkdGhdW2hlaWdodF1baGVpZ2h0c106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KT4qLFt3aWR0aF1baGVpZ2h0XVtzaXplc106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KT4qe2Rpc3BsYXk6bm9uZX0uaS1hbXBodG1sLW5vdGJ1aWx0Om5vdCguaS1hbXBodG1sLWxheW91dC1jb250YWluZXIpLFtsYXlvdXRdOm5vdChbbGF5b3V0PWNvbnRhaW5lcl0pOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpLFt3aWR0aF1baGVpZ2h0XVtoZWlnaHRzXTpub3QoW2xheW91dF0pOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpLFt3aWR0aF1baGVpZ2h0XVtzaXplc106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KXtjb2xvcjp0cmFuc3BhcmVudCFpbXBvcnRhbnQ7bGluZS1oZWlnaHQ6MCFpbXBvcnRhbnR9LmktYW1waHRtbC1naG9zdHt2aXNpYmlsaXR5OmhpZGRlbiFpbXBvcnRhbnR9LmktYW1waHRtbC1lbGVtZW50PltwbGFjZWhvbGRlcl0sW2xheW91dF06bm90KC5pLWFtcGh0bWwtZWxlbWVudCk%2BW3BsYWNlaG9sZGVyXSxbd2lkdGhdW2hlaWdodF1baGVpZ2h0c106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KT5bcGxhY2Vob2xkZXJdLFt3aWR0aF1baGVpZ2h0XVtzaXplc106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KT5bcGxhY2Vob2xkZXJde2Rpc3BsYXk6YmxvY2t9LmktYW1waHRtbC1lbGVtZW50PltwbGFjZWhvbGRlcl0uYW1wLWhpZGRlbiwuaS1hbXBodG1sLWVsZW1lbnQ%2BW3BsYWNlaG9sZGVyXS5oaWRkZW57dmlzaWJpbGl0eTpoaWRkZW59LmktYW1waHRtbC1lbGVtZW50Om5vdCguYW1wLW5vdHN1cHBvcnRlZCk%2BW2ZhbGxiYWNrXSwuaS1hbXBodG1sLWxheW91dC1jb250YWluZXI%2BW3BsYWNlaG9sZGVyXS5hbXAtaGlkZGVuLC5pLWFtcGh0bWwtbGF5b3V0LWNvbnRhaW5lcj5bcGxhY2Vob2xkZXJdLmhpZGRlbntkaXNwbGF5Om5vbmV9LmktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkPltmYWxsYmFja10sLmktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkPltwbGFjZWhvbGRlcl17cG9zaXRpb246YWJzb2x1dGUhaW1wb3J0YW50O3RvcDowIWltcG9ydGFudDtsZWZ0OjAhaW1wb3J0YW50O3JpZ2h0OjAhaW1wb3J0YW50O2JvdHRvbTowIWltcG9ydGFudDt6LWluZGV4OjF9LmktYW1waHRtbC1ub3RidWlsdD5bcGxhY2Vob2xkZXJde2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50fS5pLWFtcGh0bWwtaGlkZGVuLWJ5LW1lZGlhLXF1ZXJ5e2Rpc3BsYXk6bm9uZSFpbXBvcnRhbnR9LmktYW1waHRtbC1lbGVtZW50LWVycm9ye2JhY2tncm91bmQ6cmVkIWltcG9ydGFudDtjb2xvcjojZmZmIWltcG9ydGFudDtwb3NpdGlvbjpyZWxhdGl2ZSFpbXBvcnRhbnR9LmktYW1waHRtbC1lbGVtZW50LWVycm9yOmJlZm9yZXtjb250ZW50OmF0dHIoZXJyb3ItbWVzc2FnZSl9aS1hbXAtc2Nyb2xsLWNvbnRhaW5lcixpLWFtcGh0bWwtc2Nyb2xsLWNvbnRhaW5lcntwb3NpdGlvbjphYnNvbHV0ZTt0b3A6MDtsZWZ0OjA7cmlnaHQ6MDtib3R0b206MDtkaXNwbGF5OmJsb2NrfWktYW1wLXNjcm9sbC1jb250YWluZXIuYW1wLWFjdGl2ZSxpLWFtcGh0bWwtc2Nyb2xsLWNvbnRhaW5lci5hbXAtYWN0aXZle292ZXJmbG93OmF1dG87LXdlYmtpdC1vdmVyZmxvdy1zY3JvbGxpbmc6dG91Y2h9LmktYW1waHRtbC1sb2FkaW5nLWNvbnRhaW5lcntkaXNwbGF5OmJsb2NrIWltcG9ydGFudDtwb2ludGVyLWV2ZW50czpub25lO3otaW5kZXg6MX0uaS1hbXBodG1sLW5vdGJ1aWx0Pi5pLWFtcGh0bWwtbG9hZGluZy1jb250YWluZXJ7ZGlzcGxheTpibG9jayFpbXBvcnRhbnR9LmktYW1waHRtbC1sb2FkaW5nLWNvbnRhaW5lci5hbXAtaGlkZGVue3Zpc2liaWxpdHk6aGlkZGVufS5pLWFtcGh0bWwtZWxlbWVudD5bb3ZlcmZsb3dde2N1cnNvcjpwb2ludGVyO3Bvc2l0aW9uOnJlbGF0aXZlO3otaW5kZXg6Mjt2aXNpYmlsaXR5OmhpZGRlbjtkaXNwbGF5OmluaXRpYWw7bGluZS1oZWlnaHQ6bm9ybWFsfS5pLWFtcGh0bWwtZWxlbWVudD5bb3ZlcmZsb3ddLmFtcC12aXNpYmxle3Zpc2liaWxpdHk6dmlzaWJsZX10ZW1wbGF0ZXtkaXNwbGF5Om5vbmUhaW1wb3J0YW50fS5hbXAtYm9yZGVyLWJveCwuYW1wLWJvcmRlci1ib3ggKiwuYW1wLWJvcmRlci1ib3ggOmFmdGVyLC5hbXAtYm9yZGVyLWJveCA6YmVmb3Jle2JveC1zaXppbmc6Ym9yZGVyLWJveH1hbXAtcGl4ZWx7ZGlzcGxheTpub25lIWltcG9ydGFudH1hbXAtYW5hbHl0aWNzLGFtcC1hdXRvLWFkcyxhbXAtc3RvcnktYXV0by1hZHN7cG9zaXRpb246Zml4ZWQhaW1wb3J0YW50O3RvcDowIWltcG9ydGFudDt3aWR0aDoxcHghaW1wb3J0YW50O2hlaWdodDoxcHghaW1wb3J0YW50O292ZXJmbG93OmhpZGRlbiFpbXBvcnRhbnQ7dmlzaWJpbGl0eTpoaWRkZW59aHRtbC5pLWFtcGh0bWwtZmllPmFtcC1hbmFseXRpY3N7cG9zaXRpb246aW5pdGlhbCFpbXBvcnRhbnR9W3Zpc2libGUtd2hlbi1pbnZhbGlkXTpub3QoLnZpc2libGUpLGZvcm0gW3N1Ym1pdC1lcnJvcl0sZm9ybSBbc3VibWl0LXN1Y2Nlc3NdLGZvcm0gW3N1Ym1pdHRpbmdde2Rpc3BsYXk6bm9uZX1hbXAtYWNjb3JkaW9ue2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50fWFtcC1hY2NvcmRpb24%2Bc2VjdGlvbntmbG9hdDpub25lIWltcG9ydGFudH1hbXAtYWNjb3JkaW9uPnNlY3Rpb24%2BKntmbG9hdDpub25lIWltcG9ydGFudDtkaXNwbGF5OmJsb2NrIWltcG9ydGFudDtvdmVyZmxvdzpoaWRkZW4haW1wb3J0YW50O3Bvc2l0aW9uOnJlbGF0aXZlIWltcG9ydGFudH1hbXAtYWNjb3JkaW9uLGFtcC1hY2NvcmRpb24%2Bc2VjdGlvbnttYXJnaW46MH1hbXAtYWNjb3JkaW9uPnNlY3Rpb24%2BOmxhc3QtY2hpbGR7ZGlzcGxheTpub25lIWltcG9ydGFudH1hbXAtYWNjb3JkaW9uPnNlY3Rpb25bZXhwYW5kZWRdPjpsYXN0LWNoaWxke2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50fVxuLyojIHNvdXJjZVVSTD0vY3NzL2FtcHNoYXJlZC5jc3MqL2h0bWwuaS1hbXBodG1sLWluYWJveHt3aWR0aDoxMDAlIWltcG9ydGFudDtoZWlnaHQ6MTAwJSFpbXBvcnRhbnR9aHRtbC5pLWFtcGh0bWwtaW5hYm94PmJvZHl7cG9zaXRpb246aW5pdGlhbCFpbXBvcnRhbnR9PC9zdHlsZT48bWV0YSBjb250ZW50PVwid2lkdGg9ZGV2aWNlLXdpZHRoLG1pbmltdW0tc2NhbGU9MSxpbml0aWFsLXNjYWxlPTFcIiBuYW1lPXZpZXdwb3J0PjxtZXRhIGNvbnRlbnQ9XCJ2ZW5kb3I9ZG91YmxlY2xpY2ssdHlwZT1pbXByZXNzaW9uLWlkLHZhbHVlPUNJU0EyOEt0eHVzQ0ZaR1hkd29kS1UwRGN3XCIgbmFtZT1hbXA0YWRzLWlkPjxsaW5rIGFzPXNjcmlwdCBocmVmPWh0dHBzOi8vY2RuLmFtcHByb2plY3Qub3JnL3J0di8wMTIwMDgyNDIzMDEwMDAvYW1wNGFkcy12MC5qcyByZWw9cHJlbG9hZD48c2NyaXB0IGFzeW5jIHNyYz1odHRwczovL2Nkbi5hbXBwcm9qZWN0Lm9yZy9ydHYvMDEyMDA4MjQyMzAxMDAwL2FtcDRhZHMtdjAuanM%2BPC9zY3JpcHQ%2BPHNjcmlwdCBhc3luYyBjdXN0b20tZWxlbWVudD1hbXAtYWQtZXhpdCBzcmM9aHR0cHM6Ly9jZG4uYW1wcHJvamVjdC5vcmcvcnR2LzAxMjAwODI0MjMwMTAwMC92MC9hbXAtYWQtZXhpdC0wLjEuanM%2BPC9zY3JpcHQ%2BPHNjcmlwdCBhc3luYyBjdXN0b20tZWxlbWVudD1hbXAtYW5hbHl0aWNzIHNyYz1odHRwczovL2Nkbi5hbXBwcm9qZWN0Lm9yZy9ydHYvMDEyMDA4MjQyMzAxMDAwL3YwL2FtcC1hbmFseXRpY3MtMC4xLmpzPjwvc2NyaXB0PjxzY3JpcHQgYXN5bmMgY3VzdG9tLWVsZW1lbnQ9YW1wLWZpdC10ZXh0IHNyYz1odHRwczovL2Nkbi5hbXBwcm9qZWN0Lm&i=2-8&t=adltag_kej0pkof_ATKTuxYTXqp&r=8f9327c4116d5df8731ffd844c80fb4&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.4 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-4.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 1d67a4c00b06651cb6daa95ec3f21f9b.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 70548
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Mon, 31 Aug 2020 01:35:38 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: 7FmDC2CSuctCRWJQcnLhLDMBJEkrrXCBHcZhyE8qjfRqwuyniH7lNw==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
426 B 89ms
34ms Other
text/plain 13.224.193.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=9yZy9ydHYvMDEyMDA4MjQyMzAxMDAwL3YwL2FtcC1maXQtdGV4dC0wLjEuanM%2BPC9zY3JpcHQ%2BPHNjcmlwdCBhc3luYyBjdXN0b20tZWxlbWVudD1hbXAtZm9ybSBzcmM9aHR0cHM6Ly9jZG4uYW1wcHJvamVjdC5vcmcvcnR2LzAxMjAwODI0MjMwMTAwMC92MC9hbXAtZm9ybS0wLjEuanM%2BPC9zY3JpcHQ%2BPHN0eWxlIGFtcC1jdXN0b20%2BYSB7IGNvbG9yOiAjMDAwMDAwIH1ib2R5IHsgbWFyZ2luOiAwOyBiYWNrZ3JvdW5kOiB0cmFuc3BhcmVudDsgfSNnb29nbGVfaW1hZ2VfZGl2IHtoZWlnaHQ6IDYwMHB4O3dpZHRoOiAzMDBweDtvdmVyZmxvdzpoaWRkZW47cG9zaXRpb246cmVsYXRpdmV9aHRtbCwgYm9keSB7d2lkdGg6MTAwJTtoZWlnaHQ6MTAwJTt9Ym9keSB7ZGlzcGxheTp0YWJsZTt0ZXh0LWFsaWduOmNlbnRlcjt9I2dvb2dsZV9jZW50ZXJfZGl2IHtkaXNwbGF5OnRhYmxlLWNlbGw7dmVydGljYWwtYWxpZ246bWlkZGxlO30jZ29vZ2xlX2ltYWdlX2RpdiB7ZGlzcGxheTppbmxpbmUtYmxvY2s7fS5hYmdjIHtwb3NpdGlvbjphYnNvbHV0ZTt6LWluZGV4OjIxNDc0ODM2NDY7cmlnaHQ6MDt0b3A6MDt9LmFiZ2MgYW1wLWltZywgLmFiZ2MgaW1nIHtkaXNwbGF5OmJsb2NrO30uYWJncyB7cG9zaXRpb246YWJzb2x1dGU7LXdlYmtpdC10cmFuc2Zvcm06dHJhbnNsYXRlWCg3NnB4KTt0cmFuc2Zvcm06dHJhbnNsYXRlWCg3NnB4KTtyaWdodDoxNnB4O3RvcDowO30uYWJnY3Age3Bvc2l0aW9uOmFic29sdXRlO3JpZ2h0OjA7dG9wOjA7d2lkdGg6MzFweDtoZWlnaHQ6MTVweDtwYWRkaW5nLWxlZnQ6MTBweDtwYWRkaW5nLWJvdHRvbToxMHB4O30uYWJnYiB7cG9zaXRpb246cmVsYXRpdmU7bWFyZ2luLXJpZ2h0OjE2cHg7dG9wOjA7fS5hYmdjOmhvdmVyIC5hYmdzIHstd2Via2l0LXRyYW5zZm9ybTpub25lO3RyYW5zZm9ybTpub25lO30uY2JiIHtkaXNwbGF5OiBibG9jaztwb3NpdGlvbjogYWJzb2x1dGU7cmlnaHQ6MDt0b3A6MDtjdXJzb3I6IHBvaW50ZXI7aGVpZ2h0OiAxNXB4O3dpZHRoOiAxNXB4O3otaW5kZXg6IDkwMjA7cGFkZGluZy1sZWZ0OjE2cHg7fS5idG4ge2Rpc3BsYXk6IGlubGluZS1ibG9jaztib3JkZXItcmFkaXVzOiAycHg7LW1vei1ib3gtc2l6aW5nOiBib3JkZXItYm94Oy13ZWJraXQtYm94LXNpemluZzogYm9yZGVyLWJveDtib3gtc2l6aW5nOiBib3JkZXItYm94O2JveC1zaGFkb3c6IDBweCAwcHggMnB4IHJnYmEoMCwwLDAsMC4xMiksIDBweCAxcHggM3B4IHJnYmEoMCwwLDAsMC4yNik7Y3Vyc29yOiBwb2ludGVyO2ZvbnQtc2l6ZTogMC43ZW07bWFyZ2luOiAwIDFweCAwLjRlbSAxcHg7fUBtZWRpYSAobWF4LXdpZHRoOiAzNzVweCkgYW5kIChtaW4taGVpZ2h0OiAxMDBweCkgey5idG4ge2Rpc3BsYXk6IGJsb2NrO3dpZHRoOiA5MCU7bWF4LXdpZHRoOiAyNDBweDttYXJnaW4tbGVmdDogYXV0bzttYXJnaW4tcmlnaHQ6IGF1dG87fX0jc3B2MSBhbXAtZml0LXRleHQ%2BZGl2IHstd2Via2l0LWp1c3RpZnktY29udGVudDogZmxleC1zdGFydDtqdXN0aWZ5LWNvbnRlbnQ6IGZsZXgtc3RhcnQ7fS5qdCAucG4gYW1wLWZpdC10ZXh0PmRpdiB7LXdlYmtpdC1qdXN0aWZ5LWNvbnRlbnQ6IGZsZXgtc3RhcnQ7anVzdGlmeS1jb250ZW50OiBmbGV4LXN0YXJ0O30uYnRuID4gc3BhbiB7ZGlzcGxheTogaW5saW5lLWJsb2NrO3BhZGRpbmc6IDAuNWVtIDAuNmVtO2xpbmUtaGVpZ2h0OiAxZW07fSNzYnRuIHtiYWNrZ3JvdW5kLWNvbG9yOiAjRkZGRkZGO2NvbG9yOiAjOUU5RUE2O3RleHQtZGVjb3JhdGlvbjogbm9uZTt9I3NidG46aG92ZXIsI3NidG46YWN0aXZlIHtiYWNrZ3JvdW5kLWNvbG9yOiAjRjVGNUY1O30jcmJ0biB7YmFja2dyb3VuZC1jb2xvcjogcmdiKDY2LDEzMywyNDUpO2NvbG9yOiB3aGl0ZTt9I3JidG46aG92ZXIsI3JidG46YWN0aXZlIHtiYWNrZ3JvdW5kLWNvbG9yOiAjMzI3NUU1O30jbXRhIHtwb3NpdGlvbjphYnNvbHV0ZTt0b3A6IDA7bGVmdDogMDtmb250LWZhbWlseTogQXJpYWwsIHNhbnMtc2VyaWY7Zm9udC1zaXplOiAxMnB4O2ZvbnQtd2VpZ2h0OiA0MDA7bGluZS1oZWlnaHQ6IDFlbTt9I210YSBpbnB1dFt0eXBlPVwicmFkaW9cIl0ge2Rpc3BsYXk6IG5vbmU7fSNtdGEgLnBuIHtyaWdodDogLTMwMHB4O3RvcDogLTYwMHB4O3dpZHRoOjMwMHB4O2hlaWdodDo2MDBweDtwb3NpdGlvbjogYWJzb2x1dGU7LW1vei1ib3gtc2l6aW5nOiBib3JkZXItYm94Oy13ZWJraXQtYm94LXNpemluZzogYm9yZGVyLWJveDtib3gtc2l6aW5nOiBib3JkZXItYm94O2JhY2tncm91bmQtY29sb3I6ICNGQUZBRkE7dGV4dC1hbGlnbjogY2VudGVyO30jc3B2MiB7ZGlzcGxheTogLXdlYmtpdC1mbGV4O2Rpc3BsYXk6IGZsZXg7LXdlYmtpdC1qdXN0aWZ5LWNvbnRlbnQ6IGZsZXgtc3RhcnQ7anVzdGlmeS1jb250ZW50OiBmbGV4LXN0YXJ0Oy13ZWJraXQtZmxleC13cmFwOiBub3dyYXA7ZmxleC13cmFwOiBub3dyYXA7b3ZlcmZsb3c6IGhpZGRlbjtiYWNrZ3JvdW5kLWNvbG9yOiAjRkFGQUZBO2ZvbnQtc2l6ZTogMDt9LnN2ICNzcHYyIHstd2Via2l0LWZsZXgtZGlyZWN0aW9uOiBjb2x1bW47ZmxleC1kaXJlY3Rpb246IGNvbHVtbjt9Lmp0LnN2ICNzcHYyIHstd2Via2l0LWp1c3RpZnktY29udGVudDogZmxleC1zdGFydDtqdXN0aWZ5LWNvbnRlbnQ6IGZsZXgtc3RhcnQ7LXdlYmtpdC1hbGlnbi1pdGVtczogY2VudGVyO2FsaWduLWl0ZW1zOiBjZW50ZXI7fSNzcHYyICogey1tb3otYm94LXNpemluZzogYm9yZGVyLWJveDstd2Via2l0LWJveC1zaXppbmc6IGJvcmRlci1ib3g7Ym94LXNpemluZzogYm9yZGVyLWJveDt9I3NwcjE6Y2hlY2tlZCB%2BICNjYmIsI3NwcjI6Y2hlY2tlZCB%2BICNjYmIsI3NwcjM6Y2hlY2tlZCB%2BICNjYmJ7ZGlzcGxheTogbm9uZTt9I3NwdjMge29wYWNpdHk6MTt9LmFtcC1hbmltYXRlICNzcHY0IHtvcGFjaXR5OjA7dHJhbnNpdGlvbjogb3BhY2l0eSAwLjVzIGxpbmVhciAyLjVzO30uYW1wLWFuaW1hdGUgICNzcHYzIGFtcC1maXQtdGV4dCB7b3BhY2l0eToxO3RyYW5zaXRpb246IG9wYWNpdHkgMC41cyBsaW5lYXIgMnM7fSNzcHIzOmNoZWNrZWQgfiAjc3B2MyBhbXAtZml0LXRleHQge29wYWNpdHk6MH0jc3ByMzpjaGVja2VkIH4gI3NwdjQge29wYWNpdHk6MTt9I3NwcjE6Y2hlY2tlZCB%2BICNzcHYxLCNzcHIyOmNoZWNrZWQgfiAjc3B2Miwjc3ByMzpjaGVja2VkIH4gI3NwdjMsI3NwcjM6Y2hlY2tlZCB%2BICNzcHY0e3JpZ2h0OiAwcHg7dG9wOiAwcHg7fS5jbG9zZSB7cG9zaXRpb246IGFic29sdXRlO3RvcDogMnB4O2NvbG9yOiBibGFjaztmb250LXNpemU6IDE1cHg7bGluZS1oZWlnaHQ6IDE1cHg7b3BhY2l0eTogMC41O2hlaWdodDogMTVweDt3aWR0aDogMTVweDt1c2VyLXNlbGVjdDogbm9uZTtjdXJzb3I6IHBvaW50ZXI7fVtkaXI9XCJydGxcIl0gLmNsb3NlIHt0cmFuc2Zvcm06IHNjYWxlWCgtMSk7fS5jdCBzdmcge2JvcmRlcjogMDttYXJnaW46IDAgMCAtMC40NWVtIDA7ZGlzcGxheTogaW5saW5lLWJsb2NrO2hlaWdodDogMS4zOGVtO29wYWNpdHk6IDAuNDt9LmN0IHtkaXNwbGF5OiBpbmxpbmUtYmxvY2s7bGluZS1oZWlnaHQ6IDEuMjhlbTtjb2xvcjogcmdiYSgwLDAsMCwwLjQpO3RleHQtYWxpZ246Y2VudGVyO3BhZGRpbmc6IDAuM2VtO30uZmN0IHtwYWRkaW5nOiAxZW07fSNwY3Qge2Rpc3BsYXk6IGJsb2NrO2ZvbnQtd2VpZ2h0OiBib2xkO3BhZGRpbmc6IDFlbSAwLjNlbTt9I3RpIHt3aWR0aDogMzAwcHg7fSNidG5zIHt3aWR0aDogMzAwcHg7fS5mbCB7d2lkdGg6IDMwMHB4O2hlaWdodDo2MDBweDt9I3NpIHtwb3NpdGlvbjogcmVsYXRpdmU7ZGlzcGxheTogaW5saW5lLWJsb2NrO21hcmdpbi1ib3R0b206IC0wLjE1ZW07aGVpZ2h0OiAxZW07d2lkdGg6IDFlbTtvcGFjaXR5OiAwLjQ7fS5zYiB7ZmxleC1zaHJpbms6IDA7aGVpZ2h0OiA1MHB4O30uc28ge3Bvc2l0aW9uOiByZWxhdGl2ZTt6LWluZGV4OiA5MTEwO292ZXJmbG93OiBoaWRkZW47ZGlzcGxheTogaW5saW5lLWJsb2NrO3BhZGRpbmc6IDFweCA1cHg7d2lkdGg6IDk2cHg7aGVpZ2h0OiA1MHB4O2JvcmRlcjogMXB4IHNvbGlkICNFMEUwRTA7YmFja2dyb3VuZC1jb2xvcjogI0ZGRkZGRjtjdXJzb3I6IHBvaW50ZXI7fS5zbzpob3Zlciwuc286YWN0aXZlIHtiYWNrZ3JvdW5kLWNvbG9yOiAjRjVGNUY1O30uc28gZGl2IHtkaXNwbGF5OiAtd2Via2l0LWZsZXg7ZGlzcGxheTogZmxleDstd2Via2l0LWFsaWduLWl0ZW1zOiBjZW50ZXI7YWxpZ24taXRlbXM6IGNlbnRlcjstd2Via2l0LWp1c3RpZnktY29udGVudDogY2VudGVyO2p1c3RpZnktY29udGVudDogY2VudGVyO3dpZHRoOiAxMDAlO2hlaWdodDogMTAwJTt9LnNvIHNwYW4ge2NvbG9yOiAjNDI4NUY0O2ZvbnQtZmFtaWx5OiBBcmlhbCwgc2Fucy1zZXJpZjt0ZXh0LWFsaWduOiBjZW50ZXI7Zm9udC1zaXplOiAxMnB4O2xpbmUtaGVpZ2h0OiAxNHB4O3doaXRlLXNwYWNlOiBub3JtYWw7fUBtZWRpYSAobWluLWhlaWdodDogNTRweCkgey5zaC5zcyAuc28sLnN2IC5zbyB7Ym94LXNoYWRvdzogMHB4IDBweCAycHggcmdiYSgwLDAsMCwwLjEyKSwgMHB4IDFweCAzcHggcmdiYSgwLDAsMCwwLjI2KTtib3JkZXI6IG5vbmU7fX0uc3YgLnNvLC5zaC5zcyAuc28ge2JvcmRlci1yYWRpdXM6IDJweDt9LnN2IC5zbyB7bWFyZ2luOiA0cHg7fS5zdi5qdCAuc286Zmlyc3QtY2hpbGQge21hcmdpbi10b3A6IDhweDt9PC9zdHlsZT48L2hlYWQ%2BPGJvZHkgY2xhc3M9YW1wLWFuaW1hdGU%2BPGRpdiBpZD1nb29nbGVfY2VudGVyX2Rpdj48ZGl2IGlkPWdvb2dsZV9pbWFnZV9kaXY%2BPGEgaHJlZj1cImh0dHBzOi8vZ29vZ2xlYWRzLmcuZG91YmxlY2xpY2submV0L2FjbGs%2Fc2E9bCZhbXA7YWk9Q3pnVjJmR2ROWDRUU0s1R3YzZ09wbW8yWUI3emg1c1ZkZ0pHOXZfMExGQkFCSU5HSDBpQmd1ZWktZ05RQm9BSHhnXzJWQThnQkEtQUNBS2dEQWNnRENLb0VxZ0pQMERwd0wyM1ROSVFYSkhuY3JWYl8yd0ZXSDZMVFdzdjlvaXlQMG1ZQjJLTWNqVENGQ0h3MUs2cW1pWHhsdkJxVzFGS1BYYzNHU0xIaER2cG5rUWtSU0VEWmllM1N1MDQ1am9XZE1reDVNbEl3N2haTGMyZkhfMWNUdmk5a2JxcEl5WlVWeTVJTjdSOEl3LVowVC1YMlZMeWp5akN3UmFlMl94MGJEWi02d2dOMFB1TmxzdllmTDc5ZGJBZmYzbHFwSGt6RDRXaHlGUzFlR2FsTmttOXRyM0V3N183aVp6c20yOFVha1NrVllCczF4ckdxaEMzZzVXZVJfeFZQYV94Y3ZGOFFzZDhYd2JpOTlfT1JCN2xOdWJWT2JPZ2NqSVYzSnJLZHdrQlZxZ3FZeTNCYTBqalQ0SGo2c0VFMUNFdnc0djdfaWx0YTlZSUFkT2FwVXluVzdTakJrN1lXM0tyVUpDbU1ad2kxVVl2dlg3bm1LM1MtODNSWWQ4Vm41S3I3N1JneU8wUkNZZWhyd0FTcGxJSzlyZ0xnQkFHZ0JnT0FCNy1Tbm42b0I0N09HNmdIMWNrYnFBZVQyQnVvQjdvR3FBZncyUnVvQl9MWkc2Z0hwcjRicUFmczFSdW9CX1BSRzZnSDdOVWJxQWVXMkJ1b0I4TGFHOWdIQWRJSUNRaUE0WUJBRUFFWUhmSUlHMkZrZUMxemRXSnplVzR0TnpJMk16VTNNelEwTmpnd05EQTNPTEVKUFpyNEs0cHhXOXFBQ2dPWUN3SElDd0hZRXd3JmFtcDthZT0xJmFtcDtudW09MSZhbXA7Y2lkPUNBQVNQZVJvRFQxMlgzUnFmY2hMWFFvc2FhTmZnZHJoN0Z2WlltZmdUdEY2blpYc3FCME5Wa1ZuZkNON3ZKRXhIYmRPVEpNSUd4UkVBck5ub3dIWTdjQSZhbXA7c2lnPUFPRDY0XzFVb2FmLWRydGQ5V1FsN0hBZ3VTY1NiRFFLMkEmYW1wO2NsaWVudD1jYS1wdWItOTY4NTczNDQ0NTQ3NjgxNCZhbXA7bng9Q0xJQ0tfWCZhbXA7bnk9Q0xJQ0tfWSZhbXA7bmI9MiZhbXA7YWR1cmw9aHR0cHM6Ly93d3cubmV3Y2hpYy5jb20vdGhlbWUtbWNsLXQtMzM4Mjk1LyUzRmNsZWFuU3FsJTNEMSUyNnV0bV9zb3VyY2UlM0Rnb29nbGUlMjZ1dG1fbWVkaXVtJTNEY3BjX2FkczElMjZ1dG1fY2FtcGFpZ24lM0Rhbm52LWNuZXctbWNsLXJtLWNsNzcyNi13b3ItY2w4Mjk1LWF1MTktMzA2JTI2dXRtX2NvbnRlbnQlM0RsZWVyJTI2dXRtX2Rl&i=3-8&t=adltag_kej0pkof_ATKTuxYTXqp&r=8f9327c4116d5df8731ffd844c80fb4&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.4 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-4.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 1d67a4c00b06651cb6daa95ec3f21f9b.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 70548
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Mon, 31 Aug 2020 01:35:38 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: ACyxnAy3HkrI9lvGctomGTWSfX1TUtgHx8XHklOn10ozOFsrsIDFFg==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
426 B 22ms
20ms Other
text/plain 13.224.193.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=c2lnbiUzRCUyNmFkX2lkJTNENDU3OTUyNTk1NTE0JTI2Z2NsaWQlM0RFQUlhSVFvYkNoTUloSURid3EzRzZ3SVZrWmQzQ2gwcFRRTnpFQUVZQVNBQUVnS2c5X0RfQndFXCIgaWQ9YXcwIG9uPVwidGFwOmV4aXQtYXBpLmV4aXQodGFyZ2V0PSYjMzk7bGFuZGluZ1BhZ2UmIzM5OyxfbmI9JiMzOTsyJiMzOTspXCIgdGFyZ2V0PV9ibGFuaz48YW1wLWltZyBhbHQgY2xhc3M9XCJpbWdfYWQgaS1hbXBodG1sLWxheW91dC1maXhlZCBpLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZFwiIGhlaWdodD02MDAgaS1hbXBodG1sLWxheW91dD1maXhlZCBpLWFtcGh0bWwtc3NyIHNyYz1odHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vc2ltZ2FkLzEzNDEyMTQ4NzY4OTk0MTA5Mzc2IHN0eWxlPXdpZHRoOjMwMHB4O2hlaWdodDo2MDBweDsgd2lkdGg9MzAwPjxpbWcgYWx0IGNsYXNzPVwiaS1hbXBodG1sLWZpbGwtY29udGVudCBpLWFtcGh0bWwtcmVwbGFjZWQtY29udGVudFwiIGRlY29kaW5nPWFzeW5jIHNyYz1odHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vc2ltZ2FkLzEzNDEyMTQ4NzY4OTk0MTA5Mzc2PjwvYW1wLWltZz48L2E%2BPGFtcC1waXhlbCBjbGFzcz1cImktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWRcIiBpLWFtcGh0bWwtbGF5b3V0PWZpeGVkIHJlZmVycmVycG9saWN5PW5vLXJlZmVycmVyIHNyYz0vL3d3dy5nb29nbGUuY29tL3BhZ2VhZC9kcnQvdWkgc3R5bGU9d2lkdGg6MXB4O2hlaWdodDoxcHg7PjwvYW1wLXBpeGVsPjxkaXYgYXJpYS1oaWRkZW49dHJ1ZSBjbGFzcz1cImFiZ2MgYWJnZiBwZW5cIiBkaXI9bHRyIGlkPWFiZ2M%2BPGRpdiBjbGFzcz1cImFiZ2NwIHBlYVwiIGlkPWFiZ2NwPjxkaXYgY2xhc3M9YWJncyBpZD1hYmdzPjxhIGNsYXNzPWFiZ2wgaHJlZj1cImh0dHBzOi8vYWRzc2V0dGluZ3MuZ29vZ2xlLmNvbS93aHl0aGlzYWQ%2FcmVhc29ucz1BQjNhZkdFQUFBVm9XMXRiVzI1MWJHd3NXekV3TERJeFhTeHVkV3hzTEc1MWJHd3NiblZzYkN4YklqZ3dOekkzSWwxZExGdHVkV3hzTENKb2RIUndjem92TDJkdmIyZHNaV0ZrY3k1bkxtUnZkV0pzWldOc2FXTnJMbTVsZEM5d1lXZGxZV1F2WTI5dWRtVnljMmx2Ymk4X1lXazlRM3BuVmpKbVIyUk9XRFJVVTBzMVIzWXpaMDl3Ylc4eVdVSTNlbWcxYzFaa1owcEhPWFpmTUV4R1FrRkNTVTVIU0RCcFFtZDFaV2t0WjA1UlFtOUJTSGhuWHpKV1FUaG5Ra0V0UVVOQlMyZEVRV05uUkVOTGIwVnhaMHBRTUVSd2Qwd3lNMVJPU1ZGWVNraHVZM0pXWWw4eWQwWlhTRFpNVkZkemRqbHZhWGxRTUcxWlFqSkxUV05xVkVOR1EwaDNNVXMyY1cxcFdIaHNka0p4VnpGR1MxQllZek5IVTB4SWFFUjJjRzVyVVd0U1UwVkVXbWxsTTFOMU1EUTFhbTlYWkUxcmVEVk5iRWwzTjJoYVRHTXlaa2hmTVdOVWRtazVhMkp4Y0VsNVdsVldlVFZKVGpkU09FbDNMVm93VkMxWU1sWk1lV3A1YWtOM1VtRmxNbDk0TUdKRVdpMDJkMmRPTUZCMVRteHpkbGxtVERjNVpHSkJabVl6YkhGd1NHdDZSRFJYYUhsR1V6RmxSMkZzVG10dE9YUnlNMFYzTjE4M2FWcDZjMjB5T0ZWaGExTnJWbGxDY3pGNGNrZHhhRU16WnpWWFpWSmZlRlpRWVY5NFkzWkdPRkZ6WkRoWWQySnBPVGxmVDFKQ04yeE9kV0pXVDJKUFoyTnFTVll6U25KTFpIZHJRbFp4WjNGWmVUTkNZVEJxYWxRMFNHbzJjMFZGTVVORmRuYzBkamRmYVd4MFlUbFpTVUZrVDJGd1ZYbHVWemRUYWtKck4xbFhNMHR5VlVwRGJVMWFkMmt4VlZsMmRsZzNibTFMTTFNdE9ETlNXV1E0Vm00MVMzSTNOMUpuZVU4d1VrTlpaV2h5ZDBGVGNHeEpTemx5WjB4blFrRkhaMEpuVDBGQ055MVRibTQyYjBJME4wOUhObWRJTVdOclluRkJaVlF5UW5WdlFqZHZSM0ZCWm5jeVVuVnZRbDlNV2tjMlowaHdjalJpY1VGbWN6RlNkVzlDWDFCU1J6Wm5TRGRPVldKeFFXVlhNa0oxYjBJNFRHRkhPV2RJUVdSSlNVTlJhVUUwV1VKQlJVRkZXVWhtU1VsSE1rWnJaVU14ZW1SWFNucGxWelIwVG5wSk1rMTZWVE5OZWxFd1RtcG5kMDVFUVROUFRFVktVRnB5TkVzMGNIaFhPWEZCUTJkUFdVTjNTRWxEZDBoWlJYZDNYSFV3TURJMmMybG5hRDE1YlZCS1RsaDNjV05QTUZ4MU1EQXlObU5wWkQxRFFWRlRVR2REVGtseVRFMXVlRVZoTFdZeVVFeEhVMVZFTjFNNWRGTmFiakJJV0ZFd1VtODNhSEZoTjBzMVNFUXRka3B5Y2tWNk9HUnZaMnhrYVRVMFRrOTJNV3RWYVhSNE1UQlhNMjFtWkhkeE1IaEJkamhHSWl4YmJuVnNiQ3h1ZFd4c0xHNTFiR3dzSW1oMGRIQnpPaTh2WkdsemNHeGhlV0ZrY3kxbWIzSnRZWFJ6TG1kdmIyZHNaWFZ6WlhKamIyNTBaVzUwTG1OdmJTOWhaSE12Y0hKbGRtbGxkeTlqYjI1MFpXNTBMbXB6UDJOc2FXVnVkRDEzZEdGY2RUQXdNalp2WW1aMWMyTmhkR1ZrUTNWemRHOXRaWEpKWkQwMk1UazVOekV5TnpnNFhIVXdNREkyWTNKbFlYUnBkbVZKWkQwME5UYzVOVEkxT1RVMU1UUmNkVEF3TWpaMlpYSnphVzl1U1dROU1GeDFNREF5Tm1Ga1IzSnZkWEJEY21WaGRHbDJaVWxrUFRReE1UWTBORFkzTmpJeU5GeDFNREF5Tm1oMGJXeFFZWEpsYm5SSlpEMXdjbVYyTFRCY2RUQXdNalpvWldsbmFIUTlOakF3WEhVd01ESTJkMmxrZEdnOU16QXdYSFV3TURJMmMybG5QVUZEYVZaQ1gzcHFSWHB2WnpOWGNFVjJiakJwVm5oTlFpMXhOV0pWUmpZM1VXY2lYU3h1ZFd4c0xHNTFiR3dzTVN3aVUyeEhNVTk0TkZsWU1tTkpaMHBIT1haZk1FeEZTM1Z4ZUU5TldrZE1VekYyV0RScFF6STFiR1F5VG05aFYwMTFXVEk1ZEUxblkwbENVazFaTFVGWlZWRm9aR3BaVXpGM1pGZEpkRTlVV1RST1ZHTjZUa1JSTUU1VVVUTk9hbWQ0VGtWblJsZEJUbmRCWVdkQ1FWRWlMQ0kyT1RFNU5qSXpPVGM1SWwxZFhTeGJNU3d4TERGZFhTZk1xUGJUZEw2YmQxUVhGeXB6VVFMU3VSSzVZaTkwRnZpckdNMHhEOHpXa3VpN2dIUEhVeUIwU2NZTnhhT0p3NjEwTGpGckxzSXdUclc0a1hKNnozR2ZwREh0dXRadGxCSkpZVDJXc2xJQ1dHb1VySVlUWlQxb2E2eTNYcXd2V3FPei1kZFF2azFaZUk3ZjczUVljR3FjcWU0OEN3RnFPSzhsdUNXWjhTSEZ4N1ZXYmRQaWZ0RVlpT0hOY0tkSksyX2ZHN2phWGNFQko3UEJTMUVKQTdMeGFMQUZjbzdHM1BxdW9MRjkxSGFqUVk4Unl3NTdmX2o4Mm9yY0xXS05ZX0dkNjh1b3JvWlJrLVRCby1aZ3VvSGdHa1Joam9XS0lQazVoSTl3Y0tKTU9KN2o5M05wVzJXRUM3XzRfMnRlYVo1TjhIY25qNFQtV29TbVZWMDViekEsYUxWVF9UZ3lLX3h3MVRhdVZzQXZkZyZhbXA7c291cmNlPWRpc3BsYXlcIiBpZD1hYmdsIHRhcmdldD1fYmxhbms%2BPGFtcC1pbWcgY2xhc3M9XCJpLWFtcGh0bWwtbGF5b3V0LWZpeGVkIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkXCIgaGVpZ2h0PTE1IGktYW1waHRtbC1sYXlvdXQ9Zml4ZWQgaS1hbXBodG1sLXNzciBzcmM9aHR0cHM6Ly90cGMuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9pbWFnZXMvYWRjaG9pY2VzL2VuLnBuZyBzdHlsZT13aWR0aDo3NXB4O2hlaWdodDoxNXB4OyB3aWR0aD03NT48aW1nIGNsYXNzPVwiaS1hbXBodG1sLWZpbGwtY29udGVudCBpLWFtcGh0bWwtcmVwbGFjZWQtY29udGVudFwiIGRlY29kaW5nPWFzeW5jIHNyYz1odHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2ltYWdlcy9hZGNob2ljZXMvZW4ucG5nPjwvYW1wLWltZz48L2E%2BPC9kaXY%2BPGRpdiBjbGFzcz1hYmdiIGlkPWFiZ2I%2BPGEgaHJlZj1cImh0dHBzOi8vYWRzc2V0dGluZ3MuZ29vZ2xlLmNvbS93aHl0aGlzYWQ%2FcmVhc29ucz1BQjNhZkdFQUFBVm9XMXRiVzI1MWJHd3NXekV3TERJeFhTeHVkV3hzTEc1MWJHd3NiblZzYkN4YklqZ3dOekkzSWwxZExGdHVkV3hzTENKb2RIUndjem92TDJkdmIyZHNaV0ZrY3k1bkxtUnZkV0pzWldOc2FXTnJMbTVsZEM5d1lXZGxZV1F2WTI5dWRtVnljMmx2Ymk4X1lXazlRM3BuVmpKbVIyUk9XRFJVVTBzMVIzWXpaMDl3Ylc4eVdVSTNlbWcxYzFaa1owcEhPWFpmTUV4R1FrRkNTVTVIU0RCcFFtZDFaV2t0WjA1UlFtOUJTSGhuWHpKV1FUaG5Ra0V0UVVOQlMyZEVRV05uUkVOTGIwVnhaMHBRTUVSd2Qwd3lNMVJPU1ZGWVNraHVZM0pXWWw4eWQwWlhTRFpNVkZkemRqbHZhWGxRTUcxWlFqSkxUV05xVkVOR1EwaDNNVXMyY1cxcFdIaHNka0p4VnpGR1MxQllZek5IVTB4SWFFUjJjRzVyVVd0U1UwVkVXbWxsTTFOMU1EUTFhbTlYWkUxcmVEVk5iRWwzTjJoYVRHTXlaa2hmTVdOVWRtazVhMkp4Y0VsNVdsVldlVFZKVGpkU09FbDNMVm93VkMxWU1sWk1lV3A1YWtOM1VtRmxNbDk0TUdKRVdpMDJkMmRPTUZCMVRteHpkbGxtVERjNVpHSkJabVl6YkhGd1NHdDZSRFJYYUhsR1V6RmxSMkZzVG10dE9YUnlNMFYzTjE4M2FWcDZjMjB5T0ZWaGExTnJWbGxDY3pGNGNrZHhhRU16WnpWWFpWSmZlRlpRWVY5NFkzWkdPRkZ6WkRoWWQySnBPVGxmVDFKQ04yeE9kV0pXVDJKUFoyTnFTVll6U25KTFpIZHJRbFp4WjNGWmVUTkNZVEJxYWxRMFNHbzJjMFZGTVVORmRuYzBkamRmYVd4MFlUbFpTVUZrVDJGd1ZYbHVWemRUYWtKck4xbFhNMHR5VlVwRGJVMWFkMmt4VlZsMmRsZzNibTFMTTFNdE9ETlNXV1E0Vm00MVMzSTNOMUpuZVU4d1VrTlpaV2h5ZDBGVGNHeEpTemx5WjB4blFrRkhaMEpuVDBGQ055MVRibTQyYjBJME4wOUhObWRJTVdOclluRkJaVlF5UW5WdlFqZHZSM0ZCWm5jeVVuVnZRbDlNV2tjMlowaHdjalJpY1VGbWN6RlNkVzlDWDFCU1J6Wm5TRGRPVldKeFFXVlhNa0oxYjBJNFRHRkhPV2RJUVdSSlNVTlJhVUUwV1VKQlJVRkZXVWhtU1VsSE1rWnJaVU14ZW1SWFNucGxWelIwVG5wSk1rMTZWVE5OZWxFd1RtcG5kMDVFUVROUFRFVktVRnB5TkVzMGNIaFhPWEZCUTJkUFdVTjNTRWxEZDBoWlJYZDNYSFV3TURJMmMybG5hRDE1YlZCS1RsaDNjV05QTUZ4MU1EQXlObU5wWkQxRFFWRlRVR2REVGtseVRFMXVlRVZoTFdZeVVFeEhVMVZFTjFNNWRGTmFiakJJV0ZFd1VtODNhSEZoTjBzMVNFUXRka3B5Y2tWNk9HUnZaMnhrYVRVMFRrOTJNV3RWYVhSNE1UQlhNMjFtWkhkeE1IaEJkamhHSWl4YmJuVnNiQ3h1ZFd4c0xHNTFiR3dzSW1oMGRIQnpPaTh2WkdsemNHeGhlV0ZrY3kxbWIzSnRZWFJ6TG1kdmIyZHNaWFZ6WlhKamIyNTBaVzUwTG1OdmJTOWhaSE12Y0hKbGRtbGxkeTlqYjI1MFpXNTBMbXB6UDJOc2FXVnVkRDEzZEdGY2RUQXdNalp2WW1aMWMyTmhkR1ZrUTNWemRHOXRaWEpKWkQwMk1UazVOekV5TnpnNFhIVXdNREkyWTNKbFlYUnBkbVZKWkQwME5UYzVOVEkxT1RVMU1UUmNkVEF3TWpaMlpYSnphVzl1U1dROU1GeDFNREF5Tm1Ga1IzSnZkWEJEY21WaGRHbDJaVWxrUFRReE1UWTBORFkzTmpJeU5GeDFNREF5Tm1oMGJXeFFZWEpsYm5SSlpEMXdjbVYyTFRCY2RUQXdNalpvWldsbmFIUTlOakF3WEhVd01ESTJkMmxrZEdnOU16QXdYSFV3TURJMmMybG5QVUZEYVZaQ1gzcHFSWHB2WnpOWGNFVjJiakJwVm5oTlFpMXhOV0pWUmpZM1VXY2lYU3h1ZFd4c0xHNTFiR3dzTVN3aVUyeEhNVTk0TkZsWU1tTkpaMHBIT1haZk1FeEZTM1Z4ZUU5TldrZE1VekYyV0RScFF6STFiR1F5VG05aFYwMTFXVEk1ZEUxblkwbENVazFaTFVGWlZWRm9aR3BaVXpGM1pGZEpkRTlVV1RST1ZHTjZUa1JSTUU1VVVUTk9hbWQ0VGtWblJsZEJUbmRCWVdkQ1FWRWlMQ0kyT1RFNU5qSXpPVGM1SWwxZFhTeGJNU3d4TERGZFhTZk1xUGJUZEw2YmQxUVhGeXB6VVFMU3VSSzVZaTkwRnZpckdNMHhEOHpXa3VpN2dIUEhVeUIwU2NZTnhhT0p3NjEwTGpGckxzSXdUclc0a1hKNnozR2ZwREh0dXRadGxCSkpZVDJXc2xJQ1dHb1VySVlUWlQxb2E2eTNYcXd2V3FPei1kZFF2azFaZUk3ZjczUVljR3FjcWU0OEN3RnFPSzhsdUNXWjhTSEZ4N1ZXYmRQaWZ0RVlpT0hOY0tkSksyX2ZHN2phWGNFQko3UEJTMUVKQTdMeGFMQUZjbzdHM1BxdW9MRjkxSGFqUVk4Unl3NTdmX2o4Mm9yY0xXS05ZX0dkNjh1b3JvWlJrLVRCby1aZ3VvSGdHa1Joam9XS0lQazVoSTl3Y0tKTU9KN2o5M05wVzJXRUM3XzRfMnRlYVo1TjhIY25qNFQtV29TbVZWMDViekEsYUxWVF9UZ3lLX3h3MVRhdVZzQXZkZyZhbXA7c291cmNlPWRpc3BsYXlcIiB0YXJnZXQ9X2JsYW5rPjxh&i=4-8&t=adltag_kej0pkof_ATKTuxYTXqp&r=8f9327c4116d5df8731ffd844c80fb4&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.4 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-4.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 1d67a4c00b06651cb6daa95ec3f21f9b.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 70548
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Mon, 31 Aug 2020 01:35:38 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: 3unomNZezrKW8kh75quBES9ZfrjUEiPOtbnZVibb5aT718ro_FjqYA==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
427 B 25ms
23ms Other
text/plain 13.224.193.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=bXAtaW1nIGNsYXNzPVwiaS1hbXBodG1sLWxheW91dC1maXhlZCBpLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZFwiIGhlaWdodD0xNSBpLWFtcGh0bWwtbGF5b3V0PWZpeGVkIGktYW1waHRtbC1zc3Igc3JjPWh0dHBzOi8vdHBjLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvaW1hZ2VzL2FkY2hvaWNlcy9pY29uLnBuZyBzdHlsZT13aWR0aDoxNXB4O2hlaWdodDoxNXB4OyB3aWR0aD0xNT48aW1nIGNsYXNzPVwiaS1hbXBodG1sLWZpbGwtY29udGVudCBpLWFtcGh0bWwtcmVwbGFjZWQtY29udGVudFwiIGRlY29kaW5nPWFzeW5jIHNyYz1odHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2ltYWdlcy9hZGNob2ljZXMvaWNvbi5wbmc%2BPC9hbXAtaW1nPjwvYT48L2Rpdj48L2Rpdj48YW1wLWFuYWx5dGljcyBjbGFzcz1cImktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWRcIiBpLWFtcGh0bWwtbGF5b3V0PWZpeGVkIHN0eWxlPXdpZHRoOjFweDtoZWlnaHQ6MXB4OyB0cmlnZ2VyPWltbWVkaWF0ZT48c2NyaXB0IHR5cGU9YXBwbGljYXRpb24vanNvbj57XCJyZXF1ZXN0c1wiOiB7XCJyZXBvcnROb0xhYmVsSW5zdGFuY2VcIjogXCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wYWdlYWQvY29udmVyc2lvbi8%2FYWk9Q3pnVjJmR2ROWDRUU0s1R3YzZ09wbW8yWUI3emg1c1ZkZ0pHOXZfMExGQkFCSU5HSDBpQmd1ZWktZ05RQm9BSHhnXzJWQThnQkEtQUNBS2dEQWNnRENLb0VxZ0pQMERwd0wyM1ROSVFYSkhuY3JWYl8yd0ZXSDZMVFdzdjlvaXlQMG1ZQjJLTWNqVENGQ0h3MUs2cW1pWHhsdkJxVzFGS1BYYzNHU0xIaER2cG5rUWtSU0VEWmllM1N1MDQ1am9XZE1reDVNbEl3N2haTGMyZkhfMWNUdmk5a2JxcEl5WlVWeTVJTjdSOEl3LVowVC1YMlZMeWp5akN3UmFlMl94MGJEWi02d2dOMFB1TmxzdllmTDc5ZGJBZmYzbHFwSGt6RDRXaHlGUzFlR2FsTmttOXRyM0V3N183aVp6c20yOFVha1NrVllCczF4ckdxaEMzZzVXZVJfeFZQYV94Y3ZGOFFzZDhYd2JpOTlfT1JCN2xOdWJWT2JPZ2NqSVYzSnJLZHdrQlZxZ3FZeTNCYTBqalQ0SGo2c0VFMUNFdnc0djdfaWx0YTlZSUFkT2FwVXluVzdTakJrN1lXM0tyVUpDbU1ad2kxVVl2dlg3bm1LM1MtODNSWWQ4Vm41S3I3N1JneU8wUkNZZWhyd0FTcGxJSzlyZ0xnQkFHZ0JnT0FCNy1Tbm42b0I0N09HNmdIMWNrYnFBZVQyQnVvQjdvR3FBZncyUnVvQl9MWkc2Z0hwcjRicUFmczFSdW9CX1BSRzZnSDdOVWJxQWVXMkJ1b0I4TGFHOWdIQWRJSUNRaUE0WUJBRUFFWUhmSUlHMkZrZUMxemRXSnplVzR0TnpJMk16VTNNelEwTmpnd05EQTNPTEVKUFpyNEs0cHhXOXFBQ2dPWUN3SElDd0hZRXd3JnNpZ2g9eW1QSk5Yd3FjTzAmY2lkPUNBUVNQZ0NOSXJMTW54RWEtZjJQTEdTVUQ3Uzl0U1puMEhYUTBSbzdocWE3SzVIRC12SnJyRXo4ZG9nbGRpNTROT3Yxa1VpdHgxMFczbWZkd3EweEF2OEYmY2lkPUNBUVNQZ0NOSXJMTW54RWEtZjJQTEdTVUQ3Uzl0U1puMEhYUTBSbzdocWE3SzVIRC12SnJyRXo4ZG9nbGRpNTROT3Yxa1VpdHgxMFczbWZkd3EweEF2OEYmbGFiZWw9JHtsYWJlbH1cIixcInJlcG9ydExhYmVsSW5zdGFuY2VcIjogXCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wYWdlYWQvY29udmVyc2lvbi8%2FYWk9Q3pnVjJmR2ROWDRUU0s1R3YzZ09wbW8yWUI3emg1c1ZkZ0pHOXZfMExGQkFCSU5HSDBpQmd1ZWktZ05RQm9BSHhnXzJWQThnQkEtQUNBS2dEQWNnRENLb0VxZ0pQMERwd0wyM1ROSVFYSkhuY3JWYl8yd0ZXSDZMVFdzdjlvaXlQMG1ZQjJLTWNqVENGQ0h3MUs2cW1pWHhsdkJxVzFGS1BYYzNHU0xIaER2cG5rUWtSU0VEWmllM1N1MDQ1am9XZE1reDVNbEl3N2haTGMyZkhfMWNUdmk5a2JxcEl5WlVWeTVJTjdSOEl3LVowVC1YMlZMeWp5akN3UmFlMl94MGJEWi02d2dOMFB1TmxzdllmTDc5ZGJBZmYzbHFwSGt6RDRXaHlGUzFlR2FsTmttOXRyM0V3N183aVp6c20yOFVha1NrVllCczF4ckdxaEMzZzVXZVJfeFZQYV94Y3ZGOFFzZDhYd2JpOTlfT1JCN2xOdWJWT2JPZ2NqSVYzSnJLZHdrQlZxZ3FZeTNCYTBqalQ0SGo2c0VFMUNFdnc0djdfaWx0YTlZSUFkT2FwVXluVzdTakJrN1lXM0tyVUpDbU1ad2kxVVl2dlg3bm1LM1MtODNSWWQ4Vm41S3I3N1JneU8wUkNZZWhyd0FTcGxJSzlyZ0xnQkFHZ0JnT0FCNy1Tbm42b0I0N09HNmdIMWNrYnFBZVQyQnVvQjdvR3FBZncyUnVvQl9MWkc2Z0hwcjRicUFmczFSdW9CX1BSRzZnSDdOVWJxQWVXMkJ1b0I4TGFHOWdIQWRJSUNRaUE0WUJBRUFFWUhmSUlHMkZrZUMxemRXSnplVzR0TnpJMk16VTNNelEwTmpnd05EQTNPTEVKUFpyNEs0cHhXOXFBQ2dPWUN3SElDd0hZRXd3JnNpZ2g9eW1QSk5Yd3FjTzAmY2lkPUNBUVNQZ0NOSXJMTW54RWEtZjJQTEdTVUQ3Uzl0U1puMEhYUTBSbzdocWE3SzVIRC12SnJyRXo4ZG9nbGRpNTROT3Yxa1VpdHgxMFczbWZkd3EweEF2OEYmY2lkPUNBUVNQZ0NOSXJMTW54RWEtZjJQTEdTVUQ3Uzl0U1puMEhYUTBSbzdocWE3SzVIRC12SnJyRXo4ZG9nbGRpNTROT3Yxa1VpdHgxMFczbWZkd3EweEF2OEYmbGFiZWw9JHtsYWJlbH0mbGFiZWxfaW5zdGFuY2U9JHtsYWJlbEluc3RhbmNlfSZjYnQ9U2xHMU94NFlYMmNJZ0pHOXZfMExFS3VxeE9NWkdMUzF2WDRpQzI1bGQyTm9hV011WTI5dE1nY0lCUk1ZLUFZVVFoZGpZUzF3ZFdJdE9UWTROVGN6TkRRME5UUTNOamd4TkVnRldBTndBYWdCQVFcIn0sXCJ0cmFuc3BvcnRcIjoge1wiYmVhY29uXCI6IGZhbHNlLFwieGhycG9zdFwiOiBmYWxzZSxcImltYWdlXCI6IHRydWV9LFwidHJpZ2dlcnNcIjoge1widHJhY2tNdXRlXCI6IHtcIm9uXCI6IFwiY2xpY2tcIixcInNlbGVjdG9yXCI6IFwibGFiZWxbZm9yPSdzcHIxJ11cIixcInJlcXVlc3RcIjogXCJyZXBvcnROb0xhYmVsSW5zdGFuY2VcIn0sXCJ0cmFja1JlcG9ydEFkXCI6IHtcIm9uXCI6IFwiY2xpY2tcIixcInNlbGVjdG9yXCI6IFwibGFiZWxbZm9yPSdzcHIyJ11cIixcInJlcXVlc3RcIjogXCJyZXBvcnRMYWJlbEluc3RhbmNlXCJ9LFwidHJhY2tTdXJ2ZXlSZXNwb25zZVwiOiB7XCJvblwiOiBcImNsaWNrXCIsXCJzZWxlY3RvclwiOiBcImxhYmVsW2Zvcj0nc3ByMyddXCIsXCJyZXF1ZXN0XCI6IFwicmVwb3J0TGFiZWxJbnN0YW5jZVwifSxcInRyYWNrV2h5VGhpc0FkXCI6IHtcIm9uXCI6IFwiY2xpY2tcIixcInNlbGVjdG9yXCI6IFwiI3NidG5cIixcInJlcXVlc3RcIjogXCJyZXBvcnRMYWJlbEluc3RhbmNlXCJ9fX08L3NjcmlwdD48L2FtcC1hbmFseXRpY3M%2BPGZvcm0gYWN0aW9uPS8vZy5jbyBjbGFzcz1cInN2IGp0IGFtcC1hbmltYXRlIGFiZ2YgcGVuXCIgaWQ9bXRhIHRhcmdldD1fYmxhbms%2BPGlucHV0IGlkPXNwcjAgbmFtZT1hIHR5cGU9cmFkaW8%2BPGlucHV0IGlkPXNwcjEgbmFtZT1hIHR5cGU9cmFkaW8%2BPGlucHV0IGlkPXNwcjIgbmFtZT1hIHR5cGU9cmFkaW8%2BPGlucHV0IGlkPXNwcjMgbmFtZT1hIHR5cGU9cmFkaW8%2BPGxhYmVsIGNsYXNzPVwiY2JiIHBlYVwiIGRhdGEtdmFycy1sYWJlbD11c2VyX2ZlZWRiYWNrX21lbnVfaW50ZXJhY3Rpb24gZm9yPXNwcjEgaWQ9Y2JiPjxzdmcgaGVpZ2h0PTE1IHdpZHRoPTE1IHhtbG5zPS8vd3d3LnczLm9yZy8yMDAwL3N2Zz48cGF0aCBkPU0wLDBsMTUsMGwwLDE1bC0xNSwwWiBmaWxsPSNjZGNjY2M%2BPC9wYXRoPjxwYXRoIGQ9TTMuMjUsMy4yNWw4LjUsOC41TTExLjc1LDMuMjVsLTguNSw4LjUgc3Ryb2tlPSMwMGFlY2Qgc3Ryb2tlLXdpZHRoPTEuMjU%2BPC9wYXRoPjwvc3ZnPjwvbGFiZWw%2BPGRpdiBjbGFzcz1cInBuIGFiZ2ZcIiBpZD1zcHYxPjxhbXAtZml0LXRleHQgY2xhc3M9XCJmbCBpLWFtcGh0bWwtbGF5b3V0LXJlc3BvbnNpdmUgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWRcIiBoZWlnaHQ9NjAwIGktYW1waHRtbC1sYXlvdXQ9cmVzcG9uc2l2ZSBsYXlvdXQ9cmVzcG9uc2l2ZSBtYXgtZm9udC1zaXplPTIwIG1pbi1mb250LXNpemU9OCB3aWR0aD0zMDA%2BPGktYW1waHRtbC1zaXplciBzdHlsZT1kaXNwbGF5OmJsb2NrO3BhZGRpbmctdG9wOjIwMC4wMDAwJTs%2BPC9pLWFtcGh0bWwtc2l6ZXI%2BPGRpdiBjbGFzcz1jbG9zZSBpZD1tZW51LWRpc21pc3M%2BPGxhYmVsIGZvcj1zcHIwPjxzdmcgdmlld2JveD1cIjAgMCAyNCAyNFwiPjxwYXRoIGNsYXNzPW5hdGl2ZS1hcnJvdyBkPVwiTTIwIDExSDcuODNsNS41OS01LjU5TDEyIDRsLTggOCA4IDggMS40MS0xLjQxTDcuODMgMTNIMjB2LTJ6XCI%2BPC9wYXRoPjwvc3ZnPjwvbGFiZWw%2BPC9kaXY%2BPGRpdiBpZD10aT48c3BhbiBjbGFzcz1jdD5BZHMgYnkgPHN2ZyBmaWxsPSMwMDAwMDAgdmlld2JveD1cIjAgMCA2MCAyNFwiIHhtbG5zPWh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnPjxwYXRoIGQ9XCJNNy41IDE2LjI5Yy00LjA3IDAtNy40OS0zLjMxLTcuNDktNy4zOFMzLjQzIDEuNTMgNy41IDEuNTNjMi4yNSAwIDMuODUuODggNS4wNiAyLjAzbC0xLjQyIDEuNDJjLS44Ny0uODEtMi4wNC0xLjQ0LTMuNjQtMS40NC0yLjk3IDAtNS4yOSAyLjQtNS4yOSA1LjM3czIuMzIgNS4zNyA1LjI5IDUuMzdjMS45MyAwIDMuMDMtLjc3IDMuNzMtMS40OC41OC0uNTguOTUtMS40IDEuMS0yLjU0SDcuNVY4LjI0aDYuNzljLjA3LjM2LjExLjc5LjExIDEuMjYgMCAxLjUxLS40MSAzLjM5LTEuNzUgNC43Mi0xLjMgMS4zNS0yLjk1IDIuMDctNS4xNSAyLjA3em0xNy43NS00Ljc2YzAgMi43NC0yLjEzIDQuNzUtNC43NSA0Ljc1cy00Ljc1LTIuMDItNC43NS00Ljc1YzAtMi43NSAyLjEzLTQuNzUgNC43NS00Ljc1czQuNzUgMiA0Ljc1IDQuNzV6bS0yLjA4IDBjMC0xLjcxLTEuMjQtMi44OC0yLjY3LTIuODhzLTIuNjcgMS4xNy0yLjY3IDIuODhjMCAxLjY5IDEuMjQgMi44OCAyLjY3IDIuODhzMi42Ny0xLjE4IDIuNjctMi44OHptMTMuMDggMGMwIDIuNzQtMi4xMyA0Ljc1LTQuNzUgNC43NXMtNC43NS0yLjAyLTQuNzUtNC43NWMwLTIuNzUgMi4xMy00Ljc1IDQuNzUtNC43NXM0Ljc1IDIgNC43NSA0Ljc1em0tMi4wOCAwYzAtMS43MS0xLjI0LTIuODgtMi42Ny0yLjg4cy0yLjY3IDEuMTctMi42NyAyLjg4YzAgMS42OSAxLjI0IDIuODggMi42NyAyLjg4czIuNjctMS4xOCAyLjY3LTIuODh6bTEyLjU4LTQuNDZ2OC41M2MwIDMuNTEtMi4wNyA0Ljk1LTQuNTIgNC45NS0yLjMgMC0zLjY5LTEuNTUtNC4yMS0yLjgxbDEuODItLjc2Yy4zMi43NyAxLjEyIDEuNjkgMi4zOSAxLjY5IDEuNTcgMCAyLjU0LS45NyAyLjU0LTIuNzl2LS42OGgtLjA3Yy0uNDcuNTgtMS4zNyAxLjA4LTIuNSAxLjA4LTIuMzggMC00LjU2LTIuMDctNC41Ni00Ljc0IDAtMi42OCAyLjE4LTQuNzcgNC41Ni00Ljc3IDEuMTMgMCAyLjAzLjUgMi41IDEuMDZoLjA3di0uNzZoMS45OHptLTEuODQgNC40OGMwLTEuNjctMS4xMi0yLjktMi41NC0yLjktMS40NCAwLTIuNjUgMS4yMi0yLjY1IDIuOSAwIDEuNjYgMS4yMSAyLjg2IDIuNjUgMi44NiAxLjQzLjAxIDIuNTQtMS4yIDIuNTQtMi44NnptNS44OS05LjUyVjE2aC0yLjA5VjIuMDNoMi4wOXptOC40OSAxMS4wN2wxLjYyIDEuMDhjLS41Mi43Ny0xLjc4IDIuMTEtMy45NiAyLjExLTIuNyAwLTQuNzItMi4wOS00LjcyLTQuNzUgMC0yLjgzIDIuMDMtNC43NSA0LjQ4LTQuNzUgMi40NyAwIDMuNjcgMS45NiA0LjA3IDMuMDJsLjIyLjU0LTYuMzYgMi42M2MuNDkuOTUgMS4yNCAxLjQ0IDIuMyAxLjQ0IDEuMDcgMCAxLjgxLS41MyAyLjM1LTEuMzJ6bS00Ljk5LTEuNzFsNC4yNS0xLjc2Yy0uMjMtLjU5LS45NC0xLjAxLTEuNzYtMS4wMS0xLjA2IDAtMi41NC45My0yLjQ5IDIuNzd6XCI%2BPC9wYXRoPjxwYXRoIGQ9XCJNMCAwaDYydjI0SDB6XCIgZmlsbD1ub25lPjwvcGF0aD48L3N2Zz48L3NwYW4%2BPC9kaXY%2BPGRpdiBpZD1idG5zPjxsYWJlbCBkYXRhLXZhcnMtbGFiZWw9dXNlcl9mZWVkYmFja19tZW51X29wdGlvbiBkYXRhLXZhcnMtbGFiZWwtaW5zdGFuY2U9MSBmb3I9c3ByMj48YSBjbGFzcz1i&i=5-8&t=adltag_kej0pkof_ATKTuxYTXqp&r=8f9327c4116d5df8731ffd844c80fb4&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.4 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-4.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 1d67a4c00b06651cb6daa95ec3f21f9b.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 70548
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Mon, 31 Aug 2020 01:35:38 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: huOxQRhNYn42XHp12p7WRwBKziqTzDhvLv4EA_VrK0FdCz1C5YpQMw==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
425 B 27ms
25ms Other
text/plain 13.224.193.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=dG4gaWQ9cmJ0bj48c3Bhbj5TZW5kIGZlZWRiYWNrPC9zcGFuPjwvYT48L2xhYmVsPjxsYWJlbD48YSBjbGFzcz1idG4gZGF0YS12YXJzLWxhYmVsPWNsb3NlYnV0dG9uX3doeXRoaXNhZF9jbGljayBkYXRhLXZhcnMtbGFiZWwtaW5zdGFuY2U9MSBocmVmPVwiaHR0cHM6Ly9hZHNzZXR0aW5ncy5nb29nbGUuY29tL3doeXRoaXNhZD9yZWFzb25zPUFCM2FmR0VBQUFWb1cxdGJXMjUxYkd3c1d6RXdMREl4WFN4dWRXeHNMRzUxYkd3c2JuVnNiQ3hiSWpnd056STNJbDFkTEZ0dWRXeHNMQ0pvZEhSd2N6b3ZMMmR2YjJkc1pXRmtjeTVuTG1SdmRXSnNaV05zYVdOckxtNWxkQzl3WVdkbFlXUXZZMjl1ZG1WeWMybHZiaThfWVdrOVEzcG5WakptUjJST1dEUlVVMHMxUjNZelowOXdiVzh5V1VJM2VtZzFjMVprWjBwSE9YWmZNRXhHUWtGQ1NVNUhTREJwUW1kMVpXa3RaMDVSUW05QlNIaG5YekpXUVRoblFrRXRRVU5CUzJkRVFXTm5SRU5MYjBWeFowcFFNRVJ3ZDB3eU0xUk9TVkZZU2todVkzSldZbDh5ZDBaWFNEWk1WRmR6ZGpsdmFYbFFNRzFaUWpKTFRXTnFWRU5HUTBoM01VczJjVzFwV0hoc2RrSnhWekZHUzFCWVl6TkhVMHhJYUVSMmNHNXJVV3RTVTBWRVdtbGxNMU4xTURRMWFtOVhaRTFyZURWTmJFbDNOMmhhVEdNeVpraGZNV05VZG1rNWEySnhjRWw1V2xWV2VUVkpUamRTT0VsM0xWb3dWQzFZTWxaTWVXcDVha04zVW1GbE1sOTRNR0pFV2kwMmQyZE9NRkIxVG14emRsbG1URGM1WkdKQlptWXpiSEZ3U0d0NlJEUlhhSGxHVXpGbFIyRnNUbXR0T1hSeU0wVjNOMTgzYVZwNmMyMHlPRlZoYTFOclZsbENjekY0Y2tkeGFFTXpaelZYWlZKZmVGWlFZVjk0WTNaR09GRnpaRGhZZDJKcE9UbGZUMUpDTjJ4T2RXSldUMkpQWjJOcVNWWXpTbkpMWkhkclFsWnhaM0ZaZVROQ1lUQnFhbFEwU0dvMmMwVkZNVU5GZG5jMGRqZGZhV3gwWVRsWlNVRmtUMkZ3VlhsdVZ6ZFRha0pyTjFsWE0wdHlWVXBEYlUxYWQya3hWVmwyZGxnM2JtMUxNMU10T0ROU1dXUTRWbTQxUzNJM04xSm5lVTh3VWtOWlpXaHlkMEZUY0d4SlN6bHlaMHhuUWtGSFowSm5UMEZDTnkxVGJtNDJiMEkwTjA5SE5tZElNV05yWW5GQlpWUXlRblZ2UWpkdlIzRkJabmN5VW5WdlFsOU1Xa2MyWjBod2NqUmljVUZtY3pGU2RXOUNYMUJTUnpablNEZE9WV0p4UVdWWE1rSjFiMEk0VEdGSE9XZElRV1JKU1VOUmFVRTBXVUpCUlVGRldVaG1TVWxITWtaclpVTXhlbVJYU25wbFZ6UjBUbnBKTWsxNlZUTk5lbEV3VG1wbmQwNUVRVE5QVEVWS1VGcHlORXMwY0hoWE9YRkJRMmRQV1VOM1NFbERkMGhaUlhkM1hIVXdNREkyYzJsbmFEMTViVkJLVGxoM2NXTlBNRngxTURBeU5tTnBaRDFEUVZGVFVHZERUa2x5VEUxdWVFVmhMV1l5VUV4SFUxVkVOMU01ZEZOYWJqQklXRkV3VW04M2FIRmhOMHMxU0VRdGRrcHlja1Y2T0dSdloyeGthVFUwVGs5Mk1XdFZhWFI0TVRCWE0yMW1aSGR4TUhoQmRqaEdJaXhiYm5Wc2JDeHVkV3hzTEc1MWJHd3NJbWgwZEhCek9pOHZaR2x6Y0d4aGVXRmtjeTFtYjNKdFlYUnpMbWR2YjJkc1pYVnpaWEpqYjI1MFpXNTBMbU52YlM5aFpITXZjSEpsZG1sbGR5OWpiMjUwWlc1MExtcHpQMk5zYVdWdWREMTNkR0ZjZFRBd01qWnZZbVoxYzJOaGRHVmtRM1Z6ZEc5dFpYSkpaRDAyTVRrNU56RXlOemc0WEhVd01ESTJZM0psWVhScGRtVkpaRDAwTlRjNU5USTFPVFUxTVRSY2RUQXdNaloyWlhKemFXOXVTV1E5TUZ4MU1EQXlObUZrUjNKdmRYQkRjbVZoZEdsMlpVbGtQVFF4TVRZME5EWTNOakl5TkZ4MU1EQXlObWgwYld4UVlYSmxiblJKWkQxd2NtVjJMVEJjZFRBd01qWm9aV2xuYUhROU5qQXdYSFV3TURJMmQybGtkR2c5TXpBd1hIVXdNREkyYzJsblBVRkRhVlpDWDNwcVJYcHZaek5YY0VWMmJqQnBWbmhOUWkxeE5XSlZSalkzVVdjaVhTeHVkV3hzTEc1MWJHd3NNU3dpVTJ4SE1VOTRORmxZTW1OSlowcEhPWFpmTUV4RlMzVnhlRTlOV2tkTVV6RjJXRFJwUXpJMWJHUXlUbTloVjAxMVdUSTVkRTFuWTBsQ1VrMVpMVUZaVlZGb1pHcFpVekYzWkZkSmRFOVVXVFJPVkdONlRrUlJNRTVVVVROT2FtZDRUa1ZuUmxkQlRuZEJZV2RDUVZFaUxDSTJPVEU1TmpJek9UYzVJbDFkWFN4Yk1Td3hMREZkWFNmTXFQYlRkTDZiZDFRWEZ5cHpVUUxTdVJLNVlpOTBGdmlyR00weEQ4eldrdWk3Z0hQSFV5QjBTY1lOeGFPSnc2MTBMakZyTHNJd1RyVzRrWEo2ejNHZnBESHR1dFp0bEJKSllUMldzbElDV0dvVXJJWVRaVDFvYTZ5M1hxd3ZXcU96LWRkUXZrMVplSTdmNzNRWWNHcWNxZTQ4Q3dGcU9LOGx1Q1daOFNIRng3VldiZFBpZnRFWWlPSE5jS2RKSzJfZkc3amFYY0VCSjdQQlMxRUpBN0x4YUxBRmNvN0czUHF1b0xGOTFIYWpRWThSeXc1N2Zfajgyb3JjTFdLTllfR2Q2OHVvcm9aUmstVEJvLVpndW9IZ0drUmhqb1dLSVBrNWhJOXdjS0pNT0o3ajkzTnBXMldFQzdfNF8ydGVhWjVOOEhjbmo0VC1Xb1NtVlYwNWJ6QSxhTFZUX1RneUtfeHcxVGF1VnNBdmRnJmFtcDtzb3VyY2U9ZGlzcGxheVwiIGlkPXNidG4gdGFyZ2V0PV9ibGFuaz48c3Bhbj5XaHkgdGhpcyBhZD%2FCoDxzdmcgZmlsbD0jMDAwMDAwIGlkPXNpIHZpZXdib3g9XCIwIDAgMTYgMTZcIiB4bWxucz0vL3d3dy53My5vcmcvMjAwMC9zdmc%2BPGNpcmNsZSBjeD02IGN5PTYgcj0wLjY3PjwvY2lyY2xlPjxwYXRoIGQ9TTQuMiwxMS4zUTMuMywxMS44LDMuMywxMC43NUwzLjMsNC4xUTMuMywzLjEsNC4zLDMuNUwxMC40LDcuMFExMi4wLDcuNSwxMC40LDguMEw2LjY1LDEwLjBMNi42NSw3Ljc1YTAuNjUsMC42NSwwLDEsMCwtMS4zLDBMNS4zNSwxMC43NWEwLjksMC45LDAsMCwwLDEuMywwLjhMMTIuNyw4LjJRMTMuNyw3LjUsMTIuNyw2LjdMMy4zLDEuNlEyLjIsMS4zLDEuOCwyLjVMMS44LDEyLjVRMi4yLDEzLjksMy4zLDEzLjNMNC44LDEyLjVBMC4zLDAuMywwLDEsMCw0LjIsMTEuM1o%2BPC9wYXRoPjwvc3ZnPjwvc3Bhbj48L2E%2BPC9sYWJlbD48L2Rpdj48L2FtcC1maXQtdGV4dD48L2Rpdj48ZGl2IGNsYXNzPVwicG4gYWJnZlwiIGlkPXNwdjI%2BPGxhYmVsIGNsYXNzPVwic2Igc29cIiBkYXRhLXZhcnMtbGFiZWw9bXV0ZV9zdXJ2ZXlfb3B0aW9uIGRhdGEtdmFycy1sYWJlbC1pbnN0YW5jZT0xMSBmb3I9c3ByMz48ZGl2PjxzcGFuPkFscmVhZHkgYm91Z2h0IHRoaXM8L3NwYW4%2BPC9kaXY%2BPC9sYWJlbD48bGFiZWwgY2xhc3M9XCJzYiBzb1wiIGRhdGEtdmFycy1sYWJlbD1tdXRlX3N1cnZleV9vcHRpb24gZGF0YS12YXJzLWxhYmVsLWluc3RhbmNlPTEyIGZvcj1zcHIzPjxkaXY%2BPHNwYW4%2BTm90IGludGVyZXN0ZWQgaW4gdGhpcyBhZDwvc3Bhbj48L2Rpdj48L2xhYmVsPjxsYWJlbCBjbGFzcz1cInNiIHNvXCIgZGF0YS12YXJzLWxhYmVsPW11dGVfc3VydmV5X29wdGlvbiBkYXRhLXZhcnMtbGFiZWwtaW5zdGFuY2U9MiBmb3I9c3ByMz48ZGl2PjxzcGFuPlNlZW4gdGhpcyBhZCBtdWx0aXBsZSB0aW1lczwvc3Bhbj48L2Rpdj48L2xhYmVsPjxsYWJlbCBjbGFzcz1cInNiIHNvXCIgZGF0YS12YXJzLWxhYmVsPW11dGVfc3VydmV5X29wdGlvbiBkYXRhLXZhcnMtbGFiZWwtaW5zdGFuY2U9MyBmb3I9c3ByMz48ZGl2PjxzcGFuPkFkIGNvdmVyZWQgY29udGVudDwvc3Bhbj48L2Rpdj48L2xhYmVsPjwvZGl2PjxkaXYgY2xhc3M9XCJwbiBhYmdmXCIgaWQ9c3B2Mz48YW1wLWZpdC10ZXh0IGNsYXNzPVwiZmwgaS1hbXBodG1sLWxheW91dC1yZXNwb25zaXZlIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkXCIgaGVpZ2h0PTYwMCBpLWFtcGh0bWwtbGF5b3V0PXJlc3BvbnNpdmUgbGF5b3V0PXJlc3BvbnNpdmUgbWF4LWZvbnQtc2l6ZT0xNyBtaW4tZm9udC1zaXplPTggd2lkdGg9MzAwPjxpLWFtcGh0bWwtc2l6ZXIgc3R5bGU9ZGlzcGxheTpibG9jaztwYWRkaW5nLXRvcDoyMDAuMDAwMCU7PjwvaS1hbXBodG1sLXNpemVyPjxzcGFuIGlkPXBjdD5UaGFua3MuIEZlZWRiYWNrIGltcHJvdmVzIEdvb2dsZSBhZHM8L3NwYW4%2BPC9hbXAtZml0LXRleHQ%2BPC9kaXY%2BPGRpdiBjbGFzcz1cInBuIGFiZ2ZcIiBpZD1zcHY0PjxhbXAtZml0LXRleHQgY2xhc3M9XCJmbCBpLWFtcGh0bWwtbGF5b3V0LXJlc3BvbnNpdmUgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWRcIiBoZWlnaHQ9NjAwIGktYW1waHRtbC1sYXlvdXQ9cmVzcG9uc2l2ZSBsYXlvdXQ9cmVzcG9uc2l2ZSBtYXgtZm9udC1zaXplPTIwIG1pbi1mb250LXNpemU9OCB3aWR0aD0zMDA%2BPGktYW1waHRtbC1zaXplciBzdHlsZT1kaXNwbGF5OmJsb2NrO3BhZGRpbmctdG9wOjIwMC4wMDAwJTs%2BPC9pLWFtcGh0bWwtc2l6ZXI%2BPHNwYW4gY2xhc3M9XCJjdCBmY3RcIj5BZCBjbG9zZWQgYnkgPHN2ZyBmaWxsPSMwMDAwMDAgdmlld2JveD1cIjAgMCA2MCAyNFwiIHhtbG5zPWh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnPjxwYXRoIGQ9XCJNNy41IDE2LjI5Yy00LjA3IDAtNy40OS0zLjMxLTcuNDktNy4zOFMzLjQzIDEuNTMgNy41IDEuNTNjMi4yNSAwIDMuODUuODggNS4wNiAyLjAzbC0xLjQyIDEuNDJjLS44Ny0uODEtMi4wNC0xLjQ0LTMuNjQtMS40NC0yLjk3IDAtNS4yOSAyLjQtNS4yOSA1LjM3czIuMzIgNS4zNyA1LjI5IDUuMzdjMS45MyAwIDMuMDMtLjc3IDMuNzMtMS40OC41OC0uNTguOTUtMS40IDEuMS0yLjU0SDcuNVY4LjI0aDYuNzljLjA3LjM2LjExLjc5LjExIDEuMjYgMCAxLjUxLS40MSAzLjM5LTEuNzUgNC43Mi0xLjMgMS4zNS0yLjk1IDIuMDctNS4xNSAyLjA3em0xNy43NS00Ljc2YzAgMi43NC0yLjEzIDQuNzUtNC43NSA0Ljc1cy00Ljc1LTIuMDItNC43NS00Ljc1YzAtMi43NSAyLjEzLTQuNzUgNC43NS00Ljc1czQuNzUgMiA0Ljc1IDQuNzV6bS0yLjA4IDBjMC0xLjcxLTEuMjQtMi44OC0yLjY3LTIuODhzLTIuNjcgMS4xNy0yLjY3IDIuODhjMCAxLjY5IDEuMjQgMi44OCAyLjY3IDIuODhzMi42Ny0xLjE4IDIuNjctMi44OHptMTMuMDggMGMwIDIuNzQtMi4xMyA0Ljc1LTQuNzUgNC43NXMtNC43NS0yLjAyLTQuNzUtNC43NWMwLTIuNzUgMi4xMy00Ljc1IDQuNzUtNC43NXM0Ljc1IDIgNC43NSA0Ljc1em0tMi4wOCAwYzAtMS43MS0xLjI0LTIuODgtMi42Ny0yLjg4cy0yLjY3IDEuMTctMi42NyAyLjg4YzAgMS42OSAxLjI0IDIuODggMi42NyAyLjg4czIuNjctMS4xOCAyLjY3LTIuODh6bTEyLjU4LTQuNDZ2OC41M2MwIDMuNTEtMi4wNyA0Ljk1LTQuNTIgNC45NS0yLjMgMC0zLjY5LTEuNTUtNC4yMS0yLjgxbDEuODItLjc2Yy4zMi43NyAxLjEyIDEuNjkgMi4zOSAxLjY5IDEuNTcgMCAyLjU0LS45NyAyLjU0LTIuNzl2LS42OGgtLjA3Yy0uNDcuNTgtMS4zNyAxLjA4LTIuNSAxLjA4LTIuMzggMC00LjU2LTIuMDctNC41Ni00Ljc0IDAtMi42OCAyLjE4LTQuNzcgNC41Ni00Ljc3IDEuMTMgMCAyLjAzLjUgMi41IDEuMDZoLjA3di0uNzZoMS45OHptLTEuODQgNC40OGMwLTEuNjctMS4xMi0yLjktMi41NC0yLjktMS40NCAwLTIuNjUgMS4yMi0yLjY1IDIuOSAwIDEuNjYgMS4yMSAyLjg2IDIuNjUgMi44NiAxLjQzLjAxIDIuNTQtMS4yIDIuNTQtMi44NnptNS44OS05LjUyVjE2aC0yLjA5VjIuMDNoMi4wOXptOC40OSAxMS4wN2wxLjYyIDEuMDhjLS41Mi43Ny0xLjc4IDIuMTEtMy45NiAyLjExLTIuNyAwLTQuNzItMi4wOS00LjcyLTQuNzUgMC0yLjgzIDIuMDMtNC43NSA0LjQ4LTQuNzUgMi40NyAwIDMuNjcgMS45NiA0LjA3IDMuMDJsLjIyLjU0LTYuMzYgMi42M2MuNDkuOTUgMS4yNCAxLjQ0IDIuMyAxLjQ0IDEuMDcgMCAxLjgxLS41MyAyLjM1LTEuMzJ6bS00Ljk5LTEuNzFsNC4yNS0xLjc2Yy0uMjMtLjU5LS45NC0xLjAxLTEuNzYtMS4wMS0xLjA2IDAtMi41NC45My0yLjQ5IDIuNzd6XCI%2BPC9wYXRoPjxwYXRoIGQ9XCJNMCAwaDYydjI0SDB6XCIgZmlsbD1ub25lPjwvcGF0aD48L3N2Zz48L3NwYW4%2BPC9hbXAtZml0LXRleHQ%2BPC9kaXY%2BPC9mb3JtPjwvZGl2PjwvZGl2PjwvZGl2PjxhbXAtYW5hbHl0aWNzIGNsYXNzPVwiaS1hbXBodG1sLWxheW91dC1maXhlZCBpLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZFwiIGktYW1waHRtbC1sYXlvdXQ9Zml4ZWQgc3R5bGU9d2lkdGg6MXB4O2&i=6-8&t=adltag_kej0pkof_ATKTuxYTXqp&r=8f9327c4116d5df8731ffd844c80fb4&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.4 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-4.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 1d67a4c00b06651cb6daa95ec3f21f9b.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 70548
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Mon, 31 Aug 2020 01:35:38 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: NbYTY-f8dQHENQT7pIfvdal8wpGpo16dC2s44qkOi3a4cVovUxOr_Q==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
425 B 28ms
26ms Other
text/plain 13.224.193.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=hlaWdodDoxcHg7IHRyaWdnZXI9aW1tZWRpYXRlPjxzY3JpcHQgdHlwZT1hcHBsaWNhdGlvbi9qc29uPntcInRyYW5zcG9ydFwiOiB7XCJiZWFjb25cIjogZmFsc2UsIFwieGhycG9zdFwiOiBmYWxzZX0sXCJyZXF1ZXN0c1wiOiB7XCJ2aXNpYmlsaXR5MVwiOiBcImh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGNzL2FjdGl2ZXZpZXc%2FeGFpPUFLQU9qc3YyT1BoZThtTTRiVTNzOWpRMjV1LUVUT1NjYS1rc1pDQWE3MGlOeS1iNkY4d3RhRHBhaE9NMDBaVHlBMTZIN0hzLUdlT1VYUnZ6S2c0RklMS0ExYWtWdWRsQUpBWVZQOFE2dS1rUFFycmZXdkMxcVd5cFR3d3JUNmxNZncmc2FpPUFNZmwtWVNEOHBGekFrMU9XXzNVaFBDd1R5QmhrV0dCYmRteUprWWFxLUdyQm96dXRoYU1OSjl3UFdRU2tvb2h5T1N4MV8xelkyQW85VUZ6QVlhUDVJSzljUWN1dklMMjV6RFFEVFoyTFM0V25yYUZJRWIzblNKS1g4TEJ0QUpacUtnJnNpZz1DZzBBcktKU3pJWGZUZEl3enFId0VBRSZjaWQ9Q0FBU1BlUm9EVDEyWDNScWZjaExYUW9zYWFOZmdkcmg3RnZaWW1mZ1R0RjZuWlhzcUIwTlZrVm5mQ043dkpFeEhiZE9USk1JR3hSRUFyTm5vd0hZN2NBJmlkPWFtcGltJm89JHtlbGVtZW50WH0sJHtlbGVtZW50WX0mZD0ke2VsZW1lbnRXaWR0aH0sJHtlbGVtZW50SGVpZ2h0fSZzcz0ke3NjcmVlbldpZHRofSwke3NjcmVlbkhlaWdodH0mYnM9JHt2aWV3cG9ydFdpZHRofSwke3ZpZXdwb3J0SGVpZ2h0fSZtY3Z0PSR7bWF4Q29udGludW91c1Zpc2libGVUaW1lfSZtdG9zPTAsMCwke21heENvbnRpbnVvdXNWaXNpYmxlVGltZX0sJHttYXhDb250aW51b3VzVmlzaWJsZVRpbWV9LCR7bWF4Q29udGludW91c1Zpc2libGVUaW1lfSZ0b3M9MCwwLCR7dG90YWxWaXNpYmxlVGltZX0sMCwwJnRmcz0ke2ZpcnN0U2VlblRpbWV9JnRscz0ke2xhc3RTZWVuVGltZX0mZz0ke21pblZpc2libGVQZXJjZW50YWdlfSZoPSR7bWF4VmlzaWJsZVBlcmNlbnRhZ2V9JnR0PSR7dG90YWxUaW1lfSZyPXYmYXZtcz1hbXBhJmFkaz0zNzUzODk4MTJcIn0sXCJ0cmlnZ2Vyc1wiOiB7XCJjb250aW51b3VzVmlzaWJsZVwiOiB7XCJvblwiOiBcInZpc2libGVcIixcInJlcXVlc3RcIjogW1widmlzaWJpbGl0eTFcIl0sXCJwYXJlbnRQb3N0TWVzc2FnZVwiOiBcImltcHJlc3Npb24tdmlld2FibGVcIixcInZpc2liaWxpdHlTcGVjXCI6IHtcInNlbGVjdG9yXCI6IFwiOnJvb3RcIixcInZpc2libGVQZXJjZW50YWdlTWluXCI6IDUwLFwiY29udGludW91c1RpbWVNaW5cIjogMTAwMH19LFwidmlzaWJpbGl0eUNoYW5nZWRcIjoge1wib25cIjogXCJ2aXNpYmxlXCIsXCJwYXJlbnRQb3N0TWVzc2FnZVwiOiBcInZpc2liaWxpdHktY2hhbmdlZC0ke2ludGVyc2VjdGlvblJhdGlvfVwiLFwidmlzaWJpbGl0eVNwZWNcIjoge1wicmVwZWF0XCI6IHRydWUsXCJzZWxlY3RvclwiOiBcIjpyb290XCIsXCJ2aXNpYmxlUGVyY2VudGFnZVRocmVzaG9sZHNcIjogW1swLDBdLFswLDVdLFs1LDEwXSxbMTAsMTVdLFsxNSwyMF0sWzIwLDI1XSxbMjUsMzBdLFszMCwzNV0sWzM1LDQwXSxbNDAsNDVdLFs0NSw1MF0sWzUwLDU1XSxbNTUsNjBdLFs2MCw2NV0sWzY1LDcwXSxbNzAsNzVdLFs3NSw4MF0sWzgwLDg1XSxbODUsOTBdLFs5MCw5NV0sWzk1LDEwMF0sWzEwMCwxMDBdXX19LFwiaW5pTG9hZFwiOiB7XCJvblwiOiBcImluaS1sb2FkXCIsXCJwYXJlbnRQb3N0TWVzc2FnZVwiOiBcIntcXFwiY1xcXCI6XFxcInNmY2hhbm5lbDNcXFwiLFxcXCJwXFxcIjpcXFwie1xcXFxcXFwidWlkXFxcXFxcXCI6XFxcXFxcXCIzXFxcXFxcXCIsXFxcXFxcXCJ3aWR0aFxcXFxcXFwiOiR7c2Nyb2xsV2lkdGh9LFxcXFxcXFwiaGVpZ2h0XFxcXFxcXCI6JHtzY3JvbGxIZWlnaHR9fVxcXCIsXFxcInNcXFwiOlxcXCJjcmVhdGl2ZV9nZW9tZXRyeV91cGRhdGVcXFwifVxcblwifX19PC9zY3JpcHQ%2BPC9hbXAtYW5hbHl0aWNzPjxhbXAtYW5hbHl0aWNzIGNsYXNzPVwiaS1hbXBodG1sLWxheW91dC1maXhlZCBpLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZFwiIGktYW1waHRtbC1sYXlvdXQ9Zml4ZWQgc3R5bGU9d2lkdGg6MXB4O2hlaWdodDoxcHg7IHRyaWdnZXI9aW1tZWRpYXRlPjxzY3JpcHQgdHlwZT1hcHBsaWNhdGlvbi9qc29uPntcInRyYW5zcG9ydFwiOiB7XCJiZWFjb25cIjogdHJ1ZSwgXCJ4aHJwb3N0XCI6IGZhbHNlfSxcInJlcXVlc3RzXCI6IHtcImFtcGVvc1wiOiBcImh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGNzL2FjdGl2ZXZpZXc%2FeGFpPUFLQU9qc3YyT1BoZThtTTRiVTNzOWpRMjV1LUVUT1NjYS1rc1pDQWE3MGlOeS1iNkY4d3RhRHBhaE9NMDBaVHlBMTZIN0hzLUdlT1VYUnZ6S2c0RklMS0ExYWtWdWRsQUpBWVZQOFE2dS1rUFFycmZXdkMxcVd5cFR3d3JUNmxNZncmc2FpPUFNZmwtWVNEOHBGekFrMU9XXzNVaFBDd1R5QmhrV0dCYmRteUprWWFxLUdyQm96dXRoYU1OSjl3UFdRU2tvb2h5T1N4MV8xelkyQW85VUZ6QVlhUDVJSzljUWN1dklMMjV6RFFEVFoyTFM0V25yYUZJRWIzblNKS1g4TEJ0QUpacUtnJnNpZz1DZzBBcktKU3pJWGZUZEl3enFId0VBRSZjaWQ9Q0FBU1BlUm9EVDEyWDNScWZjaExYUW9zYWFOZmdkcmg3RnZaWW1mZ1R0RjZuWlhzcUIwTlZrVm5mQ043dkpFeEhiZE9USk1JR3hSRUFyTm5vd0hZN2NBJmlkPWFtcGVvcyZvPSR7ZWxlbWVudFh9LCR7ZWxlbWVudFl9JmQ9JHtlbGVtZW50V2lkdGh9LCR7ZWxlbWVudEhlaWdodH0mc3M9JHtzY3JlZW5XaWR0aH0sJHtzY3JlZW5IZWlnaHR9JmJzPSR7dmlld3BvcnRXaWR0aH0sJHt2aWV3cG9ydEhlaWdodH0mbWN2dD0ke21heENvbnRpbnVvdXNWaXNpYmxlVGltZX0mbXRvcz0wLDAsJHttYXhDb250aW51b3VzVmlzaWJsZVRpbWV9LCR7bWF4Q29udGludW91c1Zpc2libGVUaW1lfSwke21heENvbnRpbnVvdXNWaXNpYmxlVGltZX0mdG9zPTAsMCwke3RvdGFsVmlzaWJsZVRpbWV9LDAsMCZ0ZnM9JHtmaXJzdFNlZW5UaW1lfSZ0bHM9JHtsYXN0U2VlblRpbWV9Jmc9JHttaW5WaXNpYmxlUGVyY2VudGFnZX0maD0ke21heFZpc2libGVQZXJjZW50YWdlfSZwdD0ke3BhZ2VMb2FkVGltZX0mdHQ9JHt0b3RhbFRpbWV9JnJwdD0ke25hdlRpbWluZyhuYXZpZ2F0aW9uU3RhcnQsbG9hZEV2ZW50U3RhcnQpfSZyc3Q9JHtuYXZUaW1pbmcobmF2aWdhdGlvblN0YXJ0KX0mcj1kZSZpc2Q9JHtpbml0aWFsU2Nyb2xsRGVwdGh9Jm1zZD0ke21heFNjcm9sbERlcHRofSZhdm1zPWFtcGFcIn0sXCJ0cmlnZ2Vyc1wiOiB7XCJlbmRPZlNlc3Npb25cIjoge1wib25cIjogXCJ2aXNpYmxlXCIsXCJyZXF1ZXN0XCI6IFwiYW1wZW9zXCIsXCJ2aXNpYmlsaXR5U3BlY1wiOiB7XCJyZXBvcnRXaGVuXCI6IFwiZG9jdW1lbnRFeGl0XCIsXCJzZWxlY3RvclwiOiBcIjpyb290XCIsXCJ2aXNpYmxlUGVyY2VudGFnZU1pblwiOiA1MH19fX08L3NjcmlwdD48L2FtcC1hbmFseXRpY3M%2BPGFtcC1waXhlbCBhbGxvdy1zc3ItaW1nIGNsYXNzPVwiaS1hbXBodG1sLWxheW91dC1maXhlZCBpLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZFwiIGktYW1waHRtbC1sYXlvdXQ9Zml4ZWQgaS1hbXBodG1sLXNzciBzcmM9XCIvL3d3dy5nb29nbGUuY29tL2Fkcy9tZWFzdXJlbWVudC9sP2ViY2lkPUFMaDdDYVJuMVJFeXduQlBEQVdjci1tbmdVSUVpOGwzTlp3OGU4Nk5IZlhxUlJ5cGh6THFjOXBxenJheFNtbUtfc18xQ2xTOElWZzJcIiBzdHlsZT13aWR0aDoxcHg7aGVpZ2h0OjFweDs%2BPGltZyBzcmM9XCIvL3d3dy5nb29nbGUuY29tL2Fkcy9tZWFzdXJlbWVudC9sP2ViY2lkPUFMaDdDYVJuMVJFeXduQlBEQVdjci1tbmdVSUVpOGwzTlp3OGU4Nk5IZlhxUlJ5cGh6THFjOXBxenJheFNtbUtfc18xQ2xTOElWZzJcIj48L2FtcC1waXhlbD48ZGl2IHN0eWxlPWJvdHRvbTowO3JpZ2h0OjA7d2lkdGg6MzAwcHg7aGVpZ2h0OjYwMHB4O2JhY2tncm91bmQ6aW5pdGlhbDtwb3NpdGlvbjphYnNvbHV0ZTttYXgtd2lkdGg6MTAwJTttYXgtaGVpZ2h0OjEwMCU7cG9pbnRlci1ldmVudHM6bm9uZTtpbWFnZS1yZW5kZXJpbmc6cGl4ZWxhdGVkO3otaW5kZXg6MjE0NzQ4MzY0NztiYWNrZ3JvdW5kLWltYWdlOnVybCgmIzM5O2RhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBQ3NBQUFBV0JBTUFBQUNybDNpQUFBQUFCbEJNVkVVQUFBRCtBY2lXbVp6V0FBQUFBblJTVGxNQUFwaWRyQlFBQUFCL1NVUkJWQmpUYlpFQkRzQXdDQUx4Qi96L3Rhc1YxQ1p6VzFMU20wVUsvRmRVblFWaUtmRHVVcTlWSklHaVkxUVM1T1hJVWQ3dnAybjFGcWZlT3J0Wk9lbEtlUGt1ODJWR0d0Tzh1OWNJOEpUdFBuWlA2b2ZVOU9ub1JieVpYY2p3K0xaNzhaNkxCcDlNSm0wMFIyY2lMMWkwNTMxdlorYmp1c3VZWk03M0FYaUFCZ1lBUlc5akFBQUFBRWxGVGtTdVFtQ0MmIzM5Oyk7PjwvZGl2PjxhbXAtcGl4ZWwgYWxsb3ctc3NyLWltZyBjbGFzcz1cImktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWRcIiBpLWFtcGh0bWwtbGF5b3V0PWZpeGVkIGktYW1waHRtbC1zc3Igc3JjPVwiaHR0cHM6Ly9zZWN1cmVwdWJhZHMuZy5kb3VibGVjbGljay5uZXQvcGFnZWFkL2Fkdmlldz9haT1Dd0kxTGZHZE5YNFRTSzVHdjNnT3BtbzJZQjd6aDVzVmRnSkc5dl8wTEZCQUJJTkdIMGlCZ3VlaS1nTlFCb0FIeGdfMlZBOGdCQS1BQ0FLZ0RBY2dEQ0tvRXB3SlAwRHB3TDIzVE5JUVhKSG5jclZiXzJ3RldINkxUV3N2OW9peVAwbVlCMktNY2pUQ0ZDSHcxSzZxbWlYeGx2QnFXMUZLUFhjM0dTTEhoRHZwbmtRa1JTRURaaWUzU3UwNDVqb1dkTWt4NU1sSXc3aFpMYzJmSF8xY1R2aTlrYnFwSXlaVVZ5NUlON1I4SXctWjBULVgyVkx5anlqQ3dSYWUyX3gwYkRaLTZ3Z04wUHVObHN2WWZMNzlkYkFmZjNscXBIa3pENFdoeUZTMWVHYWxOa205dHIzRXc3XzdpWnpzbTI4VWFrU2tWWUJzMXhyR3FoQzNnNVdlUl94VlBhX3hjdkY4UXNkOFh3Ymk5OV9PUkI3bE51YlZPYk9nY2pJVjNKcktkd2tCVnFncVl5M0JhMGpqVDRIajZzRUUxQ0V2dzR2N19pbHRhOVlJQWRPYXBVeW5XN1NqQms3WVczS3JVSkNtTVp3aTFVWXZ2WDdubUszUy1zWFpXNVE3elMtZDBRbV9qOWktVHdBU3BsSUs5cmdMZ0JBR1NCUVFJQkJnQmtnVUVDQVVZQkpJRkJBZ0ZHQmlTQlFVSUJSaW9BYUFHQTRBSHY1S2VmcWdIanM0YnFBZlZ5UnVvQjVQWUc2Z0h1Z2FvQl9EWkc2Z0g4dGticUFlbXZodW9CLXpWRzlnSEFmSUhCQkQ4clFiU0NBa0lnT0dBUUJBQkdCM3lDQnRoWkhndGMzVmljM2x1TFRjeU5qTTFOek0wTkRZNE1EUXdOemlBQ2dQSUN3SFlFd3cmYW1wO3NpZ2g9VEJMTXdNcWh3MkEmYW1wO3RwZD1BR1doSm1zZXg5RDJxTFNPYTI5T015SV9JTDFJTXVINzd6cTlCcFhfNXdBLUtfWnNsd1wiIHN0eWxlPXdpZHRoOjFweDtoZWlnaHQ6MXB4Oz48aW1nIHNyYz1cImh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L3BhZ2VhZC9hZHZpZXc%2FYWk9Q3dJMUxmR2ROWDRUU0s1R3YzZ09wbW8yWUI3emg1c1ZkZ0pHOXZfMExGQkFCSU5HSDBpQmd1ZWktZ05RQm9BSHhnXzJWQThnQkEtQUNBS2dEQWNnRENLb0Vwd0pQMERwd0wyM1ROSVFYSkhuY3JWYl8yd0ZXSDZMVFdzdjlvaXlQMG1ZQjJLTWNqVENGQ0h3MUs2cW1pWHhsdkJxVzFGS1BYYzNHU0xIaER2cG5rUWtSU0VEWmllM1N1MDQ1am9XZE1reDVNbEl3N2haTGMyZkhfMWNUdmk5a2JxcEl5WlVWeTVJTjdSOEl3LVowVC1YMlZMeWp5akN3UmFlMl94MGJEWi02d2dOMFB1TmxzdllmTDc5ZGJBZmYzbHFwSGt6RDRXaHlGUzFlR2FsTmttOXRyM0V3N183aVp6c20yOFVha1NrVllCczF4ckdxaEMzZzVXZVJfeFZQYV94Y3ZGOFFzZDhYd2JpOTlfT1JCN2xOdWJWT2JPZ2NqSVYzSnJLZHdrQlZxZ3FZeTNCYTBqalQ0SGo2c0VFMUNFdnc0djdfaWx0YTlZSUFkT2FwVXluVzdTakJrN1lXM0tyVUpDbU1ad2kxVVl2dlg3bm1LM1Mtc1haVzVRN3pTLWQwUW1fajlpLVR3QVNwbElLOXJnTGdCQUdTQlFRSUJCZ0JrZ1VFQ0FVWUJKSUZCQWdGR0JpU0&i=7-8&t=adltag_kej0pkof_ATKTuxYTXqp&r=8f9327c4116d5df8731ffd844c80fb4&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.4 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-4.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 1d67a4c00b06651cb6daa95ec3f21f9b.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 70548
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Mon, 31 Aug 2020 01:35:38 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: WgtWbpTg0xJcVUgIiHn8kFjeze7hoNO5tJjbmytu2NFLwfGk1TceAw==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
425 B 28ms
26ms Other
text/plain 13.224.193.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=JRVUlCUmlvQWFBR0E0QUh2NUtlZnFnSGpzNGJxQWZWeVJ1b0I1UFlHNmdIdWdhb0JfRFpHNmdIOHRrYnFBZW12aHVvQi16Vkc5Z0hBZklIQkJEOHJRYlNDQWtJZ09HQVFCQUJHQjN5Q0J0aFpIZ3RjM1ZpYzNsdUxUY3lOak0xTnpNME5EWTRNRFF3TnppQUNnUElDd0hZRXd3JmFtcDtzaWdoPVRCTE13TXFodzJBJmFtcDt0cGQ9QUdXaEptc2V4OUQycUxTT2EyOU9NeUlfSUwxSU11SDc3enE5QnBYXzV3QS1LX1pzbHdcIj48L2FtcC1waXhlbD48YW1wLWFkLWV4aXQgY2xhc3M9aS1hbXBodG1sLWxheW91dC1jb250YWluZXIgaS1hbXBodG1sLWxheW91dD1jb250YWluZXIgaWQ9ZXhpdC1hcGk%2BPHNjcmlwdCB0eXBlPWFwcGxpY2F0aW9uL2pzb24%2Be1wiZmlsdGVyc1wiOnt9LFwib3B0aW9uc1wiOntcInN0YXJ0VGltaW5nRXZlbnRcIjpcIm5hdmlnYXRpb25TdGFydFwifSxcInRhcmdldHNcIjp7XCJsYW5kaW5nUGFnZVwiOntcImZpbHRlcnNcIjpbXSxcImZpbmFsVXJsXCI6XCJodHRwczovL3d3dy5uZXdjaGljLmNvbS90aGVtZS1tY2wtdC0zMzgyOTUvP2NsZWFuU3FsPTFcXHUwMDI2dXRtX3NvdXJjZT1nb29nbGVcXHUwMDI2dXRtX21lZGl1bT1jcGNfYWRzMVxcdTAwMjZ1dG1fY2FtcGFpZ249YW5udi1jbmV3LW1jbC1ybS1jbDc3MjYtd29yLWNsODI5NS1hdTE5LTMwNlxcdTAwMjZ1dG1fY29udGVudD1sZWVyXFx1MDAyNnV0bV9kZXNpZ249XFx1MDAyNmFkX2lkPTQ1Nzk1MjU5NTUxNFxcdTAwMjZnY2xpZD1FQUlhSVFvYkNoTUloSURid3EzRzZ3SVZrWmQzQ2gwcFRRTnpFQUVZQVNBQUVnS2c5X0RfQndFXCIsXCJ0cmFja2luZ1VybHNcIjpbXCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9hY2xrP3NhPWxcXHUwMDI2YWk9Q3pnVjJmR2ROWDRUU0s1R3YzZ09wbW8yWUI3emg1c1ZkZ0pHOXZfMExGQkFCSU5HSDBpQmd1ZWktZ05RQm9BSHhnXzJWQThnQkEtQUNBS2dEQWNnRENLb0VxZ0pQMERwd0wyM1ROSVFYSkhuY3JWYl8yd0ZXSDZMVFdzdjlvaXlQMG1ZQjJLTWNqVENGQ0h3MUs2cW1pWHhsdkJxVzFGS1BYYzNHU0xIaER2cG5rUWtSU0VEWmllM1N1MDQ1am9XZE1reDVNbEl3N2haTGMyZkhfMWNUdmk5a2JxcEl5WlVWeTVJTjdSOEl3LVowVC1YMlZMeWp5akN3UmFlMl94MGJEWi02d2dOMFB1TmxzdllmTDc5ZGJBZmYzbHFwSGt6RDRXaHlGUzFlR2FsTmttOXRyM0V3N183aVp6c20yOFVha1NrVllCczF4ckdxaEMzZzVXZVJfeFZQYV94Y3ZGOFFzZDhYd2JpOTlfT1JCN2xOdWJWT2JPZ2NqSVYzSnJLZHdrQlZxZ3FZeTNCYTBqalQ0SGo2c0VFMUNFdnc0djdfaWx0YTlZSUFkT2FwVXluVzdTakJrN1lXM0tyVUpDbU1ad2kxVVl2dlg3bm1LM1MtODNSWWQ4Vm41S3I3N1JneU8wUkNZZWhyd0FTcGxJSzlyZ0xnQkFHZ0JnT0FCNy1Tbm42b0I0N09HNmdIMWNrYnFBZVQyQnVvQjdvR3FBZncyUnVvQl9MWkc2Z0hwcjRicUFmczFSdW9CX1BSRzZnSDdOVWJxQWVXMkJ1b0I4TGFHOWdIQWRJSUNRaUE0WUJBRUFFWUhmSUlHMkZrZUMxemRXSnplVzR0TnpJMk16VTNNelEwTmpnd05EQTNPTEVKUFpyNEs0cHhXOXFBQ2dPWUN3SElDd0hZRXd3XFx1MDAyNmFlPTFcXHUwMDI2bnVtPTFcXHUwMDI2Y2lkPUNBQVNQZVJvRFQxMlgzUnFmY2hMWFFvc2FhTmZnZHJoN0Z2WlltZmdUdEY2blpYc3FCME5Wa1ZuZkNON3ZKRXhIYmRPVEpNSUd4UkVBck5ub3dIWTdjQVxcdTAwMjZzaWc9QU9ENjRfMVVvYWYtZHJ0ZDlXUWw3SEFndVNjU2JEUUsyQVxcdTAwMjZjbGllbnQ9Y2EtcHViLTk2ODU3MzQ0NDU0NzY4MTRcXHUwMDI2bmI9X25iXFx1MDAyNm54PUNMSUNLX1hcXHUwMDI2bnk9Q0xJQ0tfWVxcdTAwMjZhY3Q9MVxcdTAwMjZyaT0xXFx1MDAyNmFkdXJsPWh0dHBzOi8vd3d3Lm5ld2NoaWMuY29tL3RoZW1lLW1jbC10LTMzODI5NS8lM0ZjbGVhblNxbCUzRDElMjZ1dG1fc291cmNlJTNEZ29vZ2xlJTI2dXRtX21lZGl1bSUzRGNwY19hZHMxJTI2dXRtX2NhbXBhaWduJTNEYW5udi1jbmV3LW1jbC1ybS1jbDc3MjYtd29yLWNsODI5NS1hdTE5LTMwNiUyNnV0bV9jb250ZW50JTNEbGVlciUyNnV0bV9kZXNpZ24lM0QlMjZhZF9pZCUzRDQ1Nzk1MjU5NTUxNCUyNmdjbGlkJTNERUFJYUlRb2JDaE1JaElEYndxM0c2d0lWa1pkM0NoMHBUUU56RUFFWUFTQUFFZ0tnOV9EX0J3RVwiXSxcInZhcnNcIjp7XCJfbmJcIjp7XCJkZWZhdWx0VmFsdWVcIjpcIlwiLFwiaWZyYW1lVHJhbnNwb3J0U2lnbmFsXCI6XCJcIn19fX19PC9zY3JpcHQ%2BPC9hbXAtYWQtZXhpdD48L2JvZHk%2BPC9odG1sPiIsIm1ldGhvZEJsb2NrZWQiOiJpbml0aWFsREZQLXdyaXRlIn0sImJsb2NrZWQiOnRydWUsImNhbGxTdGFjayI6IkVycm9yXG4gICAgYXQgYUMgKGh0dHBzOi8vdGFnYW4uYWRsaWdodG5pbmcuY29tL21hdGgtYWlkcy10aHJlYXRwb3N0L2ItOWE0ZjdjZS1hN2Y2MDk4Yy5qczoxOjIwMjcwKVxuICAgIGF0IGFNIChodHRwczovL3RhZ2FuLmFkbGlnaHRuaW5nLmNvbS9tYXRoLWFpZHMtdGhyZWF0cG9zdC9iLTlhNGY3Y2UtYTdmNjA5OGMuanM6MToyMzgyOClcbiAgICBhdCBIVE1MRG9jdW1lbnQuPGFub255bW91cz4gKGh0dHBzOi8vdGFnYW4uYWRsaWdodG5pbmcuY29tL21hdGgtYWlkcy10aHJlYXRwb3N0L29wLmpzOjE6MjM2NDIpXG4gICAgYXQgVXYgKGh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L2dwdC9wdWJhZHNfaW1wbF8yMDIwMDgyNzAxLmpzOjY6MjAyNjU4KVxuICAgIGF0IHR3LmwgKGh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L2dwdC9wdWJhZHNfaW1wbF8yMDIwMDgyNzAxLmpzOjY6MjA5MDA1KVxuICAgIGF0IG13IChodHRwczovL3NlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldC9ncHQvcHViYWRzX2ltcGxfMjAyMDA4MjcwMS5qczo2OjIwNTk2NylcbiAgICBhdCB3dy5qIChodHRwczovL3NlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldC9ncHQvcHViYWRzX2ltcGxfMjAyMDA4MjcwMS5qczo2OjIxMDUzOSlcbiAgICBhdCBxYy5sIChodHRwczovL3NlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldC9ncHQvcHViYWRzX2ltcGxfMjAyMDA4MjcwMS5qczo2OjEzMjY5MilcbiAgICBhdCBzYyAoaHR0cHM6Ly9zZWN1cmVwdWJhZHMuZy5kb3VibGVjbGljay5uZXQvZ3B0L3B1YmFkc19pbXBsXzIwMjAwODI3MDEuanM6NjoxMTM4NylcbiAgICBhdCB1Yy5uZXh0IChodHRwczovL3NlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldC9ncHQvcHViYWRzX2ltcGxfMjAyMDA4MjcwMS5qczo2OjExNjc5KSJ9&i=8-8&t=adltag_kej0pkof_ATKTuxYTXqp&r=8f9327c4116d5df8731ffd844c80fb4&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.4 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-4.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 1d67a4c00b06651cb6daa95ec3f21f9b.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 70548
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Mon, 31 Aug 2020 01:35:38 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
x-amz-cf-id: CLcsgMmRWA-Ja8sDOFiVeQEkycZinqATQTmbi6iyTa5k9Wy7cb5eOA==

GET
H2 200 bl-9a4f7ce-c706c2eb.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 48BA 74 KB
21 KB 23ms
22ms Script
application/javascript 143.204.201.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-9a4f7ce-c706c2eb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.201.95 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-201-95.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2568034b9d66c093730623e756fb7be1e3382eda3ea7f521188d0390bb61b07a

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 20:47:04 GMT
content-encoding: gzip
age: 1462
x-cache: Hit from cloudfront
status: 200
content-length: 21305
x-amz-meta-git_commit: 9a4f7ce
last-modified: Mon, 31 Aug 2020 20:45:21 GMT
server: AmazonS3
etag: "2635bfe525e35422f9b20c75390f3e25"
x-amz-version-id: tZyo2bsqyZxiTa8olUgtXvuXBT9w5Mhi
via: 1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: 9zHA0cSTmJxWn_qKFThiWE79Sh4UwmjdUmch2mqPsXXJ15zofdeUig==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 48BA 61 KB
21 KB 23ms
23ms Script
application/javascript 143.204.201.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.201.95 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-201-95.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 18 Aug 2020 17:46:30 GMT
content-encoding: gzip
age: 1135496
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: MYPYOmpw6-C_PvPXEUjDRYgw7JMwYMCWw5UOSF_C2zGg52iPhWmzXg==

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 46 KB
12 KB 355ms
318ms XHR
text/plain 172.217.18.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3776165179607908&correlator=3355384953619243&output=ldjh&impl=fifs&adsid=NT&eid=21066032%2C21067127%2C21067203&vrg=2020082701&gdpr=0&tfua=0&tfcd=0&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200831&iu_parts=21707124336%2CThreatPost-300x600-ATF&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C300x600&ris=1&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2%26hb_adid_nobid%3D63a9cbdee152d95%26hb_bidder_nobid%3Dnobid%26dyn_bids%3D0.01&eri=1&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Fshlayer-mac-malware-extra-sneakiness%252F156669%252F%26urlquery%3Dgoogfc%26contentid%3D156669%26category%3Deditors-picks%26contenttags%3Danti-evasion%252Cfake-adobe-flash-installer%252Cgoogle-search%252Cintego%252Cmac-malware%252Cmalware-analysis%252Cnew-version%252Cpoisoned-search-results%252Cshlayer%252Cstealth&cookie=ID%3D347f0a18fb6cf0c8-22be53ccc1b600d0%3AT%3D1598908284%3AS%3DALNI_MaB5y4GkcjjobOn1kwf6bwBJWzF2g&bc=31&abxe=1&lmt=1598908285&dt=1598908285248&dlt=1598908282927&idt=606&frm=20&biw=1600&bih=1200&oid=3&adxs=1082&adys=1630&adks=375389812&ucis=5&ifi=5&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&dssz=47&icsg=171851648000&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x600&msz=300x600&psts=AGkb-H_S8TocOHmfQ-abu722M9ZAPL-exoM6SpSMvNnKiIZdeIBjmRaz277lM2IbyQ-6luc2212d03I2vRV_5HTOPvDugz-rdJk&ga_vid=2075126819.1598908284&ga_sid=1598908285&ga_hid=1250074073&fws=0&ohw=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020082701.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.18.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s29-in-f2.1e100.net

Software

cafe /

Resource Hash

7ce1aa64937fb13d7a21fb0e014bf3fe7c4ff6f722a2e8b17b4907bcc8a36f14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:25 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11457
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://threatpost.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012008242301000/ Frame FDF9 206 KB
57 KB 39ms
6ms Script
text/javascript 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b08c92f2985a2cf85e942b566af89d0738cb22e14d0db5ddbefd6c4034a169e8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14561
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57291
x-xss-protection: 0
server: sffe
date: Mon, 31 Aug 2020 17:08:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "fe153f75f3748e81"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:08:44 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame FDF9 16 KB
6 KB 51ms
18ms Script
text/javascript 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-ad-exit-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30cfde8a99cbbfb145edbaee540db712a5c6e8efa9e0b8209d803a7d4ecbdbbb

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14561
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5745
x-xss-protection: 0
server: sffe
date: Mon, 31 Aug 2020 17:08:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f38bf2e806d02bb3"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:08:44 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame FDF9 95 KB
29 KB 49ms
16ms Script
text/javascript 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-analytics-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0b8d5f925cb1ad83c665488cf3d59c2b4acf9f0ec9f277db2441ca69d3900b0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14561
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29201
x-xss-protection: 0
server: sffe
date: Mon, 31 Aug 2020 17:08:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "64b4eb13675b1bd5"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:08:44 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame FDF9 4 KB
2 KB 48ms
15ms Script
text/javascript 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-fit-text-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af517de65e4d2beaa3da8659682a9daaf863b96f59567e7550b7a1812a4f97e1

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14561
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1788
x-xss-protection: 0
server: sffe
date: Mon, 31 Aug 2020 17:08:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0cdd699146251721"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:08:44 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame FDF9 47 KB
14 KB 46ms
14ms Script
text/javascript 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-form-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05148a217f01f1d6b7a9e90813a2c58d0dbbd947f76cbcbba24e4c0411463b08

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14561
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14592
x-xss-protection: 0
server: sffe
date: Mon, 31 Aug 2020 17:08:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "c6e61a9007c16120"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:08:44 GMT

GET
H3-Q050 200 3743304619636961074
tpc.googlesyndication.com/daca_images/simgad/ Frame FDF9 40 KB
40 KB 30ms
15ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/3743304619636961074

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a447794ed71b2448144c6c6e0c052233e67b76eaaa71b21ec3174004fb72c38e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 12:57:48 GMT
x-content-type-options: nosniff
age: 29617
x-dns-prefetch-control: off
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40703
x-xss-protection: 0
last-modified: Thu, 30 Jan 2020 03:35:29 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 12:57:48 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame FDF9 2 KB
3 KB 30ms
15ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 31 Aug 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 36147
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Tue, 01 Sep 2020 11:08:58 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame FDF9 295 B
756 B 29ms
16ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 Aug 2020 21:26:58 GMT
x-content-type-options: nosniff
server: cafe
age: 85467
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Mon, 31 Aug 2020 21:26:58 GMT

GET
H3-Q050 200 adview
securepubads.g.doubleclick.net/pagead/ Frame FDF9 0
0 56ms
56ms Image
text/html 172.217.18.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C9Bl-fGdNX4LSK5Gv3gOpmo2YB6zU8LtbxbfY3fQKwI23ARABINGH0iBguei-gNQBoAHOgf_TA8gBAqkCzzQfGie-qT7gAgCoAwHIAwiqBJcCT9BkOP13JV1kFxZCK_0tJdBlstx1nN9jiV7SgYTRAP98FUEFc_tPWWvTkdBgR4O565C5Xzx78dONBvEA9zWxwcIdM_UzSkIDgAZNqA0FumkC6Gvei0EOeonsDSr3BYJoHR5idA-NwMntaOi5tQj4O5262SgyhRzBq0t2qsBkdcZ1s_vYCw4Cos79PfwXWkDt8cVgHat2OJ9PkHm_rqSMxkkpWtoyHaTjNS5eLApOPzHVtpmR0xqIjGgrPGNdqNTWy5zwJ7HSp4wQdgvUhFQB44uHQnRlQRPxnRav8u-MkJY59oK8KWWl386i76eAfLZ2R3KQCoQ2xS94na6gKm7AFQq3mU0Kr9aIeDUUWWST9SAO52YDMkIywAS8y9TU2gLgBAGSBQQIBBgBkgUECAUYBKAGAoAHmv6ALKgHjs4bqAfVyRuoB5PYG6gHugaoB_DZG6gH8tkbqAemvhuoB-zVG9gHAfIHBBCr7QjSCAkIgOGAQBABGB3yCBthZHgtc3Vic3luLTcyNjM1NzM0NDY4MDQwNziACgPICwHYEw0&sigh=CMKjpMSDoIU&tpd=AGWhJmvXHDYQtupUSdM86sofp1iImi_iE8vg-KOUqmPhmi2AcA
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 172.217.18.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra15s29-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame FDF9 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4bc19dae6d5ddc5d386c463ba3917db2735da5c753511e65ae6e018e10b827e4

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012008242301000/ Frame 78B8 206 KB
56 KB 38ms
23ms Script
text/javascript 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b08c92f2985a2cf85e942b566af89d0738cb22e14d0db5ddbefd6c4034a169e8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14561
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57291
x-xss-protection: 0
server: sffe
date: Mon, 31 Aug 2020 17:08:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "fe153f75f3748e81"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:08:44 GMT

GET
H3-Q050 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame 78B8 16 KB
7 KB 36ms
22ms Script
text/javascript 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-ad-exit-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30cfde8a99cbbfb145edbaee540db712a5c6e8efa9e0b8209d803a7d4ecbdbbb

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14561
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5745
x-xss-protection: 0
server: sffe
date: Mon, 31 Aug 2020 17:08:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f38bf2e806d02bb3"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:08:44 GMT

GET
H3-Q050 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame 78B8 95 KB
29 KB 39ms
24ms Script
text/javascript 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-analytics-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0b8d5f925cb1ad83c665488cf3d59c2b4acf9f0ec9f277db2441ca69d3900b0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14561
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29201
x-xss-protection: 0
server: sffe
date: Mon, 31 Aug 2020 17:08:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "64b4eb13675b1bd5"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:08:44 GMT

GET
H3-Q050 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame 78B8 4 KB
2 KB 37ms
23ms Script
text/javascript 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-fit-text-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af517de65e4d2beaa3da8659682a9daaf863b96f59567e7550b7a1812a4f97e1

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14561
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1788
x-xss-protection: 0
server: sffe
date: Mon, 31 Aug 2020 17:08:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0cdd699146251721"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:08:44 GMT

GET
H3-Q050 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame 78B8 47 KB
14 KB 36ms
22ms Script
text/javascript 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-form-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05148a217f01f1d6b7a9e90813a2c58d0dbbd947f76cbcbba24e4c0411463b08

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14561
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14592
x-xss-protection: 0
server: sffe
date: Mon, 31 Aug 2020 17:08:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "c6e61a9007c16120"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:08:44 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 78B8 2 KB
2 KB 7ms
6ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 31 Aug 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 36147
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Tue, 01 Sep 2020 11:08:58 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 78B8 295 B
319 B 10ms
9ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 Aug 2020 21:26:58 GMT
x-content-type-options: nosniff
server: cafe
age: 85467
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Mon, 31 Aug 2020 21:26:58 GMT

GET
H3-Q050 200 16806927080161313538
tpc.googlesyndication.com/daca_images/simgad/ Frame 78B8 45 KB
45 KB 11ms
9ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/16806927080161313538

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

09794436cc7c3ecbf18b516311d783648da5fc8a3f53253b634253e517785ca0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 13:46:35 GMT
x-content-type-options: nosniff
age: 26690
x-dns-prefetch-control: off
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45829
x-xss-protection: 0
last-modified: Thu, 30 Jan 2020 03:36:29 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 13:46:35 GMT

GET
H3-Q050 204 l
www.google.com/ads/measurement/ Frame 78B8 0
0 14ms
13ms Image
text/html 2a00:1450:4001:816::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSMpr43gQQb6AcZyjkFVKXZBzzQctms28V8qZ3bnFmq6l4Fb1t7-bpI9zohjvtReWupoxRV
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:816::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 78B8 0
0 56ms
56ms Image
text/html 172.217.18.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C8lRIfGdNX4PSK5Gv3gOpmo2YB6zU8Ltb1bXY3fQKwI23ARABINGH0iBguei-gNQBoAHOgf_TA8gBAqkCzzQfGie-qT7gAgCoAwHIAwiqBJsCT9ChWDHn7hqN9DgsQPHxcTphjys5IGZeHLKabKnJrP7u7BoqyoOAbDjo3G8qoGB3fpSbxKPgMFjlGjsoRFNkhyyCJDvNKmw_26yDUwS18g008u75EbikRROAgUleUPKF6OOqnI551ArUwOs4RzVYXubt59neY6-jUDWmoRw0ZD1bOD3JN6JiLlv3U26-V5ilmg_1hL14Lzc1Xlkxo5YfNIeC7Mcls9haBCk4ryfdjVI7D4On1rXpYAMSSfSGDPSXTitoIMAK6leyarsmkNPtrmAcG0LnM_een4CKsh3FQ1Mq8ttll8z-2FgV5MeamDozz7-MCiEe2hMHJ6M35feRPlhLs4eG6216VTQBW8mEsa6K1QfubnngYc2E8MAEvMvU1NoC4AQBkgUECAQYAZIFBAgFGASgBgKAB5r-gCyoB47OG6gH1ckbqAeT2BuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwHyBwQQ9tMM0ggJCIDhgEAQARgd8ggbYWR4LXN1YnN5bi03MjYzNTczNDQ2ODA0MDc4gAoDyAsB2BMN&sigh=x3JYTHF1la4&tpd=AGWhJmuhRbfUrAsgo-NhtgG2Pp0pTGFR2Q1X7TBjLW_hp4EumA
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 172.217.18.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra15s29-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 78B8 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b8da2c33dd1f431194d4fa3edc5f0488e937fa6a0e6b6e97cdaea8248b546d38

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012008242301000/ Frame 48BA 206 KB
56 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b08c92f2985a2cf85e942b566af89d0738cb22e14d0db5ddbefd6c4034a169e8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14561
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57291
x-xss-protection: 0
server: sffe
date: Mon, 31 Aug 2020 17:08:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "fe153f75f3748e81"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:08:44 GMT

GET
H3-Q050 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame 48BA 95 KB
29 KB 32ms
30ms Script
text/javascript 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-analytics-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0b8d5f925cb1ad83c665488cf3d59c2b4acf9f0ec9f277db2441ca69d3900b0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14561
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29201
x-xss-protection: 0
server: sffe
date: Mon, 31 Aug 2020 17:08:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "64b4eb13675b1bd5"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:08:44 GMT

GET
H3-Q050 200 7464639028652035684
tpc.googlesyndication.com/simgad/ Frame 48BA 330 B
433 B 12ms
10ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7464639028652035684

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 13:08:26 GMT
x-content-type-options: nosniff
age: 28979
x-dns-prefetch-control: off
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 330
x-xss-protection: 0
last-modified: Tue, 28 Jan 2020 23:02:00 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 13:08:26 GMT

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame 48BA 0
31 B 58ms
55ms Image
image/gif 172.217.18.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu9MfddmS3i6QNqehuV8TuODwdRRPxJ-FkpGFJunDImIV6HQj3eAiosA1WK-DWjprGCzTF6BSXiZIse2jT-jp8u9-sv4D3nyMuZeA0CHqcgWyHXY9jpYKY7NDeNouxdqiH6cK-tz1o7OimIk6A-EoYmDbt9vKmwpu79MRjgzbGcn6hhe_13-1ms4LCj-pqV-bAi9yCaStF_zxgWChxT5yFSKI0JhMuX5huT4g118r1Vl9t81gk8T82AIAYoYrI2_JmJMCc5-h0MmWr1qgbLQw&sai=AMfl-YQSztZpENO9Ga--QW2sNFjcS5J1i10Yf49kAyy4n18ZPAl051WOOh3NKfz5JXQto-HOSeB89VHmRiv-SIxmkhhMxWLNEGafEVAvgn9GY6TspsDO_xhBhMzmje8B5ec&sig=Cg0ArKJSzFueGBHJbbKoEAE&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.18.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s29-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 31 Aug 2020 21:11:25 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 204 l
www.google.com/ads/measurement/ Frame 48BA 0
0 33ms
30ms Image
text/html 2a00:1450:4001:816::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSl4eOGlBoKDJBOX0XV9_-3J2rwHz1-_xlX5Rx8BeHtBMqi04-m-Ru7HaRvhFNhO0JFXYzY
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:816::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 48BA 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0d87ca43d0a4d5909161c7f72d7b23e5309f1322912fb1dac0dfef951f19694c

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 bl-9a4f7ce-c706c2eb.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 12BC 74 KB
21 KB 23ms
22ms Script
application/javascript 143.204.201.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-9a4f7ce-c706c2eb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.201.95 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-201-95.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2568034b9d66c093730623e756fb7be1e3382eda3ea7f521188d0390bb61b07a

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 20:47:04 GMT
content-encoding: gzip
age: 1462
x-cache: Hit from cloudfront
status: 200
content-length: 21305
x-amz-meta-git_commit: 9a4f7ce
last-modified: Mon, 31 Aug 2020 20:45:21 GMT
server: AmazonS3
etag: "2635bfe525e35422f9b20c75390f3e25"
x-amz-version-id: tZyo2bsqyZxiTa8olUgtXvuXBT9w5Mhi
via: 1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: U4VOGZZu-y8etV32FjiwHpJT1WlVcxzKH5y-RXTKeCU6OZmp4pAPPQ==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 12BC 61 KB
21 KB 23ms
23ms Script
application/javascript 143.204.201.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.201.95 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-201-95.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 18 Aug 2020 17:46:30 GMT
content-encoding: gzip
age: 1135496
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: E_A5suuzYCifkVmBOkW52dnY-g90LAd7X9kjI3MwrYKAq6L6yEGy-w==

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame FDF9
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

42ms
40ms

Image
text/html

2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date: Mon, 31 Aug 2020 21:11:25 GMT
x-content-type-options: nosniff
server: safe
status: 302
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-Q050

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 78B8
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

93ms
42ms

Image
text/html

2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date: Mon, 31 Aug 2020 21:11:25 GMT
x-content-type-options: nosniff
server: safe
status: 302
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-Q050 200 3743304619636961074
tpc.googlesyndication.com/daca_images/simgad/ Frame FDF9 40 KB
40 KB 8ms
8ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/3743304619636961074

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a447794ed71b2448144c6c6e0c052233e67b76eaaa71b21ec3174004fb72c38e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 12:57:48 GMT
x-content-type-options: nosniff
age: 29617
x-dns-prefetch-control: off
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40703
x-xss-protection: 0
last-modified: Thu, 30 Jan 2020 03:35:29 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 12:57:48 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame FDF9 2 KB
2 KB 7ms
7ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 31 Aug 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 36147
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Tue, 01 Sep 2020 11:08:58 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame FDF9 295 B
319 B 8ms
7ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 Aug 2020 21:26:58 GMT
x-content-type-options: nosniff
server: cafe
age: 85467
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Mon, 31 Aug 2020 21:26:58 GMT

GET
H3-Q050 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012008242301000/ Frame 12BC 206 KB
56 KB 10ms
6ms Script
text/javascript 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b08c92f2985a2cf85e942b566af89d0738cb22e14d0db5ddbefd6c4034a169e8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14561
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57291
x-xss-protection: 0
server: sffe
date: Mon, 31 Aug 2020 17:08:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "fe153f75f3748e81"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:08:44 GMT

GET
H3-Q050 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame 12BC 16 KB
6 KB 12ms
8ms Script
text/javascript 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-ad-exit-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30cfde8a99cbbfb145edbaee540db712a5c6e8efa9e0b8209d803a7d4ecbdbbb

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14561
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5745
x-xss-protection: 0
server: sffe
date: Mon, 31 Aug 2020 17:08:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f38bf2e806d02bb3"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:08:44 GMT

GET
H3-Q050 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame 12BC 95 KB
29 KB 13ms
9ms Script
text/javascript 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-analytics-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0b8d5f925cb1ad83c665488cf3d59c2b4acf9f0ec9f277db2441ca69d3900b0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14561
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29201
x-xss-protection: 0
server: sffe
date: Mon, 31 Aug 2020 17:08:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "64b4eb13675b1bd5"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:08:44 GMT

GET
H3-Q050 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame 12BC 4 KB
2 KB 13ms
9ms Script
text/javascript 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-fit-text-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af517de65e4d2beaa3da8659682a9daaf863b96f59567e7550b7a1812a4f97e1

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14561
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1788
x-xss-protection: 0
server: sffe
date: Mon, 31 Aug 2020 17:08:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0cdd699146251721"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:08:44 GMT

GET
H3-Q050 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame 12BC 47 KB
14 KB 13ms
10ms Script
text/javascript 2a00:1450:4001:824::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-form-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05148a217f01f1d6b7a9e90813a2c58d0dbbd947f76cbcbba24e4c0411463b08

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14561
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14592
x-xss-protection: 0
server: sffe
date: Mon, 31 Aug 2020 17:08:44 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "c6e61a9007c16120"
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 17:08:44 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 12BC 2 KB
2 KB 14ms
10ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 31 Aug 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 36147
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Tue, 01 Sep 2020 11:08:58 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 12BC 295 B
319 B 14ms
10ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 Aug 2020 21:26:58 GMT
x-content-type-options: nosniff
server: cafe
age: 85467
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Mon, 31 Aug 2020 21:26:58 GMT

GET
H3-Q050 200 9899392262825195304
tpc.googlesyndication.com/simgad/ Frame 12BC 29 KB
29 KB 14ms
11ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9899392262825195304?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qlf30fRF8REfa7coP2dVQ1ci8Kirw

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8fb7717faf61efb8c271691ba84ec01ea107b6946783ded26fb313c2b9a17760

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 09:14:03 GMT
x-content-type-options: nosniff
last-modified: Thu, 10 Oct 2019 19:49:56 GMT
server: sffe
age: 43042
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29458
x-xss-protection: 0
expires: Tue, 31 Aug 2021 09:14:03 GMT

GET
H3-Q050

200

B23768030.267046029;dc_pre=CJ3FqsOtxusCFcOt3god7D8Nuw;dc_trk_aid=461813821;dc_trk_cid=106332843;ord=530025646;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=
ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/ Frame 12BC
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/B23768030.267046029;dc_trk_aid=461813821;dc_trk_cid=106332843;ord=530025646;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
https://ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/B23768030.267046029;dc_pre=CJ3FqsOtxusCFcOt3god7D8Nuw;dc_trk_aid=461813821;dc_trk_cid=106332843;ord=530025646;dc_lat=;dc_rdid=;tag_...

42 B
523 B

98ms
49ms

Image
image/gif

172.217.18.102
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/B23768030.267046029;dc_pre=CJ3FqsOtxusCFcOt3god7D8Nuw;dc_trk_aid=461813821;dc_trk_cid=106332843;ord=530025646;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.18.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s42-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:26 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:26 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 302
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/B23768030.267046029;dc_pre=CJ3FqsOtxusCFcOt3god7D8Nuw;dc_trk_aid=461813821;dc_trk_cid=106332843;ord=530025646;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 12BC 0
0 63ms
60ms Image
text/html 172.217.18.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CJaeofWdNX_rGFKaH3gOVsppYsNWE017Q4YKHpAvQsurbjw4QASDRh9IgYLnovoDUAaAB7_WO2wPIAQLgAgCoAwHIAwiqBJ4CT9Az0oJuTZ7BtOon99OPEFfg5lMELh9HdYVkqAISQ3d9ok14oOAELes_U63g6abbTv5QrphjLYJCgUYwLQJPOvpcwYjC7bopdCYtUqnfuUa5UHMF-qfzoZK41ywGupyQqmVhjHZr5x86JKzNCCeburYslPmiQGyuzxequ3C85IzxwZ352H1_UJHp9hxq3IlB8E3Z7iBqKSdBXfzJ35QskgYx6CShfd9IkTEqKwcdfMXQym-qEJoeiR3mU3Igvxnx2MjfMhAk_miOEB_lT1aQXIptu02aA2JAQpYXelwP6DcF9L10DQkYpkhDGsgdDXXpYmG4At1Hm_cs8lCok__CZ6mlNAdV4FVs-Wj4AZD7QGcQX99GgnhAaVixJa2FZsAE-f_-2bkC4AQBkgUECAQYAZIFBAgFGASgBgKAB562mymoB47OG6gH1ckbqAeT2BuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwHyBwQQlc8d0ggHCIBhEAEYHfIIG2FkeC1zdWJzeW4tNzI2MzU3MzQ0NjgwNDA3OIAKA8gLAdgTDA&sigh=Ieg2LHlaiwQ&tpd=AGWhJmspuwYTWjaCW7KRdgaf_mooVX24kxt4RsKOWG4dRW0ebA
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 172.217.18.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra15s29-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 12BC 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 42af7e6e349fe67a3cc672c2c0883d751822f8281c9d6a6889657c3ff5fa01b1

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 16806927080161313538
tpc.googlesyndication.com/daca_images/simgad/ Frame 78B8 45 KB
45 KB 8ms
6ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/16806927080161313538

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

09794436cc7c3ecbf18b516311d783648da5fc8a3f53253b634253e517785ca0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 13:46:35 GMT
x-content-type-options: nosniff
age: 26690
x-dns-prefetch-control: off
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45829
x-xss-protection: 0
last-modified: Thu, 30 Jan 2020 03:36:29 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 13:46:35 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 78B8 2 KB
2 KB 7ms
7ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 31 Aug 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 36147
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Tue, 01 Sep 2020 11:08:58 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 78B8 295 B
319 B 7ms
7ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 30 Aug 2020 21:26:58 GMT
x-content-type-options: nosniff
server: cafe
age: 85467
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Mon, 31 Aug 2020 21:26:58 GMT

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame 2FBD 0
0 97ms
28ms Document
text/html 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Server: Apache
Last-Modified: Mon, 19 Jun 2017 19:18:19 GMT
ETag: "74087b-112-55254ff6699bb"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 211
Date: Mon, 31 Aug 2020 21:11:26 GMT
Connection: keep-alive

GET
H2 200 pd
u.openx.net/w/1.0/ Frame 7A60 0
0 57ms
55ms Document
text/html 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd?gdpr=1&gdpr_consent=
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: OXGW/16.192.1 /
Resource Hash

Request headers

:method: GET
:authority: u.openx.net
:scheme: https
:path: /w/1.0/pd?gdpr=1&gdpr_consent=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=fb386291-f968-0f79-3a62-c321c0598fe5|1598908284
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=fb386291-f968-0f79-3a62-c321c0598fe5|1598908284; Version=1; Expires=Tue, 31-Aug-2021 21:11:26 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1598908286|gekin0vNiygu; Version=1; Expires=Tue, 15-Sep-2020 21:11:26 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.192.1
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 31 Aug 2020 21:11:26 GMT
content-type: text/html
content-length: 419
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame F1D7 0
0 53ms
52ms Document
text/html 104.111.215.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.68 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-68.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: KTPCACOOKIE=YES; KCCH=YES; pi=159196:2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Last-Modified: Sat, 01 Aug 2020 14:58:34 GMT
ETag: "13006b6-94fd-5abd223c2ac92"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=76984
Expires: Tue, 01 Sep 2020 18:34:30 GMT
Date: Mon, 31 Aug 2020 21:11:26 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame 5758 0
0 99ms
24ms Document
text/html 104.111.230.142
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?gdpr=1&gdpr_consent=
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.230.142 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-230-142.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: khaos=KEJ0PJY1-V-6OHF; rsid=1|G9C2NkZC7frDQSirzNt8MRPvuJlRI6aSli1gEtfhZ1co9sDCaATiL5HZCune56eVAXOxtVOqDmOpFCjAXSP/K1XE6wBU121TpS94OfHaS3J5oG+vEPIAYMXyJPObaA/FUuvBwH9kPDDxy5Azea4+qJ5CVbysEVH+Jg==; ses2=; vis2=300372^1; audit=1|hLZGFuTafB1tdq5F+hjgq81+1ZYfrZ/a9V3F2DOYmxkUEr1+oqfOX0D3pCcW8TpHcpj76PKZXj8oT2OqK/B16qwRNgFmLHdP
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 19 Aug 2020 18:23:01 GMT
Content-Encoding: gzip
Content-Length: 9455
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=22599
Expires: Tue, 01 Sep 2020 03:28:05 GMT
Date: Mon, 31 Aug 2020 21:11:26 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 9222 0
0 84ms
33ms Document
text/html 104.111.215.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.68 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-68.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: KTPCACOOKIE=YES; KCCH=YES; pi=159196:2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Last-Modified: Sat, 01 Aug 2020 14:58:34 GMT
ETag: "13006b6-94fd-5abd223c2ac92"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=76984
Expires: Tue, 01 Sep 2020 18:34:30 GMT
Date: Mon, 31 Aug 2020 21:11:26 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame 209C 0
0 144ms
58ms Document
text/html 104.111.215.51
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.51 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-51.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Last-Modified: Fri, 20 May 2016 02:07:09 GMT
ETag: "573e714d-3e3"
Server: nginx/1.13.10
Access-Control-Allow-Origin: *
Content-Type: text/html
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 506
Cache-Control: max-age=31536000
Expires: Tue, 31 Aug 2021 21:11:26 GMT
Date: Mon, 31 Aug 2020 21:11:26 GMT
Connection: keep-alive

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/57304/ Frame AE5F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc
https://pixel.advertising.com/ups/57304/sync?uid=CAESEFo0CyTVzOAJPuq0x33PyI8&google_cver=1
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEFo0CyTVzOAJPuq0x33PyI8&google_cver=1&apid=1A86a23b40-ebce-11ea-984a-12dcd5311714
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEFo0CyTVzOAJPuq0x33PyI8&google_cver=1&apid=1A86a23b40-ebce-11ea-984a-12dcd5311714&verify=true

0
506 B

27ms
27ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEFo0CyTVzOAJPuq0x33PyI8&google_cver=1&apid=1A86a23b40-ebce-11ea-984a-12dcd5311714&verify=true

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.156.0.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/7.1.2.113 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 31 Aug 2020 21:11:27 GMT
Server: ATS/7.1.2.113
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

Date: Mon, 31 Aug 2020 21:11:27 GMT
Server: ATS/7.1.2.113
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEFo0CyTVzOAJPuq0x33PyI8&google_cver=1&apid=1A86a23b40-ebce-11ea-984a-12dcd5311714&verify=true
Connection: keep-alive
Content-Length: 0

GET
H2 200 %7Bcombo_uid%7D
pr-bh.ybp.yahoo.com/sync/adaptv_ortb/ Frame AE5F 43 B
839 B 158ms
55ms Image
image/gif 2a00:1288:110:c305::8000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/adaptv_ortb/%7Bcombo_uid%7D

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:26 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

204

sync
pixel.advertising.com/ups/55986/ Frame AE5F
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=1&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=1&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=1&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=1&gdpr_consent=&_...
https://pixel.advertising.com/ups/55986/sync?uid=X01nfgAAAJpQvXfk&_origin=0&gdpr=1&gdpr_consent=&_test=X01nfgAAAJpQvXfk

0
124 B

24ms
24ms

Image
text/plain

52.28.239.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55986/sync?uid=X01nfgAAAJpQvXfk&_origin=0&gdpr=1&gdpr_consent=&_test=X01nfgAAAJpQvXfk

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.28.239.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Mon, 31 Aug 2020 21:11:26 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:26 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1598908286.330612,VS0,VE0
x-served-by: cache-fra19157-FRA
status: 302
x-cache: HIT
location: https://pixel.advertising.com/ups/55986/sync?uid=X01nfgAAAJpQvXfk&_origin=0&gdpr=1&gdpr_consent=&_test=X01nfgAAAJpQvXfk
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

204

sync
pixel.advertising.com/ups/55953/ Frame AE5F
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1
https://pixel.advertising.com/ups/55953/sync?uid=2c6ce771-420d-48a2-ba21-ac2bb2c9e71d&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=2c6ce771-420d-48a2-ba21-ac2bb2c9e71d

0
124 B

29ms
23ms

Image
text/plain

52.28.239.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55953/sync?uid=2c6ce771-420d-48a2-ba21-ac2bb2c9e71d&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=2c6ce771-420d-48a2-ba21-ac2bb2c9e71d

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.28.239.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Mon, 31 Aug 2020 21:11:26 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:26 GMT
x-aspnet-version: 4.0.30319
status: 302
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.advertising.com/ups/55953/sync?uid=2c6ce771-420d-48a2-ba21-ac2bb2c9e71d&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=2c6ce771-420d-48a2-ba21-ac2bb2c9e71d
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 369

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame 48BA 0
44 B 110ms
107ms Image
image/gif 172.217.18.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstTLsYRKjUFhRfX8lrjbOSVCkDiI0bUMn9dipCDnvBKv3Ka6P8_sskzyOcNG6q2Kumf45PpytshFNPONOGd32saZw-hznwhADID2Y1uFCXdhwO6990ODDg0svXOwUnAeDL1CIJx5YoE0RXjACHhbmCaoOEy3xIqPIjuw1QvR14dLt1g4US5li33Wrt0Y3tqw1T3Ua5xC07zA7CN-2UNGCgOic_3EB7PL-nGpsQy41Dsakg65p_Vx_Ot7p_eJQw4zf7soWcnW8nEbsGr3jBanfrB&sai=AMfl-YQjaL1S821tSLy7CCp-gh766nxL6h2Z6nUy9mc-IUMIvF9Atu0hO0dWklmrTbFEKoPUf7MZVapjvUWTCMWUX9QPCpa_qvs-mUhR9GVmVtK63NZ7gT84aFYe_mDyWCk&sig=Cg0ArKJSzK4n8CmTbUU_EAE&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.18.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s29-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 31 Aug 2020 21:11:26 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 7464639028652035684
tpc.googlesyndication.com/simgad/ Frame 48BA 330 B
360 B 67ms
58ms Image
image/png 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7464639028652035684

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 13:08:26 GMT
x-content-type-options: nosniff
age: 28980
x-dns-prefetch-control: off
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 330
x-xss-protection: 0
last-modified: Tue, 28 Jan 2020 23:02:00 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 13:08:26 GMT

GET
H3-Q050

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 12BC
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

39ms
39ms

Image
text/html

2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date: Mon, 31 Aug 2020 21:11:26 GMT
x-content-type-options: nosniff
server: safe
status: 302
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 0
353 B 22ms
21ms Image
text/html 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=36&serverTime=1598908284&vid_playerVer=3.1.0&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=ABT%20%2F%20DynamicFloor%20%2F%202%20%2F%20Active&isApp=0&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f4d677bccfc9&contentFileId=0&mediaPlayListId=0&cbuster=1598908286382&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f4d677c02a85&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:25 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame FDF9 42 B
268 B 41ms
40ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvDjyIADrXnvhXGVQOQzJkCLWB8jN1ys3QjOE9_LzvcyXmk0mjAFZGaC3CLxxuuKuix5peHTkVyNnoDRnGimplFieYp8EUpaEjG3rN5q8BNreE308EB1hVjfp5UZA&sai=AMfl-YRJCb3dyX82JIaPd54tNB8uY4o8V5OPtF8ooKTLhaCLc0p8l2ktW7AbQM3EeZGfrCHvofQSXYrzw-LL4H4AwUwDQt9pT0KQqxgFIhmMqQJTS9-UvrRwFjKTOiTSsNk&sig=Cg0ArKJSzGQ081nl5uSqEAE&cid=CAASPeRoVtTFX75RHS6tHK9GZ6EKkF4VNeEbRg_VozBGgRGmi8yzjOp8n2xlfKFldNcuLDPf97mL9wFgbP7swn8&id=ampim&o=315,10&d=970,120&ss=1600,1200&bs=1600,1200&mcvt=1002&mtos=0,0,1002,1002,1002&tos=0,0,1002,0,0&tfs=507&tls=1509&g=100&h=100&tt=1509&r=v&avms=ampa&adk=1015519800

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 48BA 42 B
211 B 40ms
39ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss_Bbh1JqquRfg7PKHggwzPBEz9pKKYrNQ294XQkjjK0VMRHc2HekKti4reMfwOC4KJgv7RuG8WOnKJmzhTRILg8L87mE2UfQLk9UKoQ9s&sig=Cg0ArKJSzFt6cvBVNrZrEAE&id=ampim&o=0,0&d=2,2&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=343&tls=1344&g=100&h=100&tt=1344&r=v&avms=ampa&adk=3385906655

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 78B8 42 B
65 B 41ms
40ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuJBAYo6pLT9Rr6vVUzN4ih6oiqyw4rNa8WKJIw_Cs4M--_PLVJpzqvYKMeT-hvQOSfvQTgN3BZUwD4evT3lcwMCbOLC5gAec1mENksnIcz0ece8AMgTsAn_woPPg&sai=AMfl-YSxkNnAyf1sL1FiSZvASFBcRja-wMvALRvkZaBwbctJHDEwihoNvlforGzGZQgpTvB7ax7NEX6RF_o1-0YXd-JcyTVmYyqC18i5G5GQBU0hUewNfPFAMK5exijtwyo&sig=Cg0ArKJSzIZJhUch_I5JEAE&cid=CAASPeRos6rTNsOVN8sNdGgeT8lbhFF_nG4mlFOZ5Su7Ijh5cmnfjqDWvQGqIwEB_LSMwN1_JHpRkxW-84IX5ak&id=ampim&o=1064,287&d=336,280&ss=1600,1200&bs=1600,1200&mcvt=1002&mtos=0,0,1002,1002,1002&tos=0,0,1002,0,0&tfs=415&tls=1417&g=100&h=100&tt=1418&r=v&avms=ampa&adk=654286612

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:27 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 9B0E 0
0 30ms
30ms Document
text/html 104.111.215.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.68 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-68.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: KTPCACOOKIE=YES; pi=159196:2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Last-Modified: Sat, 01 Aug 2020 14:58:34 GMT
ETag: "13006b6-94fd-5abd223c2ac92"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=76983
Expires: Tue, 01 Sep 2020 18:34:30 GMT
Date: Mon, 31 Aug 2020 21:11:27 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame 42F6 0
0 27ms
26ms Document
text/html 104.111.230.142
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.230.142 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-230-142.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: khaos=KEJ0PJY1-V-6OHF; rsid=1|G9C2NkZC7frDQSirzNt8MRPvuJlRI6aSli1gEtfhZ1co9sDCaATiL5HZCune56eVAXOxtVOqDmOpFCjAXSP/K1XE6wBU121TpS94OfHaS3J5oG+vEPIAYMXyJPObaA/FUuvBwH9kPDDxy5Azea4+qJ5CVbysEVH+Jg==; ses2=; vis2=300372^1; audit=1|hLZGFuTafB1tdq5F+hjgq81+1ZYfrZ/a9V3F2DOYmxkUEr1+oqfOX0D3pCcW8TpHcpj76PKZXj8oT2OqK/B16qwRNgFmLHdP; pux=1512%3D93502%262231%3D93502%262974%3D93502%263778%3D93502%26goog%3D93502%262249-DV360-Hosted%3D93502%26idl%3D93502%26brx%3D93502%26
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 19 Aug 2020 18:23:01 GMT
Content-Encoding: gzip
Content-Length: 9455
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=22598
Expires: Tue, 01 Sep 2020 03:28:05 GMT
Date: Mon, 31 Aug 2020 21:11:27 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2

200

sync
eb2.3lift.com/ Frame D931
Redirect Chain

https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

0
0

26ms
24ms

Document
text/html

54.93.147.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.93.147.19 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: eb2.3lift.com
:scheme: https
:path: /sync?&ld=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: tluid=17750885082926629483
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
date: Mon, 31 Aug 2020 21:11:27 GMT
content-type: text/html; charset=utf-8
content-length: 467
set-cookie: sync=CgoIgQIQppbxssQuCgoIoQEQppbxssQuCgoI4gEQppbxssQuCgoI5gEQppbxssQuCgoI1gEQppbxssQuCgoIhwIQppbxssQuCgkIOhCmlvGyxC4KCQgLEKaW8bLELgoJCF8QppbxssQuCgkIHxCmlvGyxC4=; Max-Age=7776000; Expires=Sun, 29 Nov 2020 21:11:27 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=17750885082926629483; Max-Age=7776000; Expires=Sun, 29 Nov 2020 21:11:27 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
content-encoding: gzip
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control: no-cache, no-store, must-revalidate

Redirect headers

status: 302
date: Mon, 31 Aug 2020 21:11:27 GMT
content-length: 0
set-cookie: tluid=17750885082926629483; Max-Age=7776000; Expires=Sun, 29 Nov 2020 21:11:27 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
location: /sync?&ld=1
cache-control: no-cache, no-store, must-revalidate
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 pd
eu-u.openx.net/w/1.0/ Frame C955 0
0 31ms
30ms Document
text/html 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: OXGW/16.192.1 /
Resource Hash

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=fb386291-f968-0f79-3a62-c321c0598fe5|1598908284; pd=v2|1598908286|gekin0vNiygu
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=fb386291-f968-0f79-3a62-c321c0598fe5|1598908284; Version=1; Expires=Tue, 31-Aug-2021 21:11:27 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1598908286.1|kiiygevNgun0.mWgqsLommOns; Version=1; Expires=Tue, 15-Sep-2020 21:11:27 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.192.1
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 31 Aug 2020 21:11:27 GMT
content-type: text/html
content-length: 315
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame 210E 0
0 38ms
38ms Document
text/html 104.111.215.51
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.51 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-51.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Last-Modified: Tue, 24 Mar 2020 15:52:19 GMT
ETag: "5e7a2cb3-cefd"
Server: nginx/1.13.10
Content-Type: text/html
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 17037
Cache-Control: max-age=86402
Expires: Tue, 01 Sep 2020 21:11:29 GMT
Date: Mon, 31 Aug 2020 21:11:27 GMT
Connection: keep-alive

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame 59F8 0
0 33ms
33ms Document
text/html 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Server: Apache
Last-Modified: Mon, 19 Jun 2017 19:18:19 GMT
ETag: "74087b-112-55254ff6699bb"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 211
Date: Mon, 31 Aug 2020 21:11:27 GMT
Connection: keep-alive

GET
H/1.1

200
OK

Cookie set beacon
ap.lijit.com/ Frame 3818
Redirect Chain

https://ap.lijit.com/beacon?informer=13394437
https://ap.lijit.com/beacon?informer=13394437&dnr=1

0
0

113ms
20ms

Document
text/html

72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon?informer=13394437&dnr=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx / raptor
Resource Hash

Request headers

Host: ap.lijit.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: ljt_reader=8dd10de7c2ba378922c9409c
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Server: nginx
Date: Mon, 31 Aug 2020 21:11:27 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Vary: Accept-Encoding
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Set-Cookie: ljtrtbexp=eJxlkDsSxDAIQ%2B%2Fieguw%2BYi9WiZ3j9ezDUrnp7GE4Bo6vuqFKgvkZ7jCtxIiqomfMjtGdF4dUzv7fnZFpXNV0cSM06lclxzHfDnypYCmUE3QVFBvGDF1AuVN9lOjGf%2B7utrh7DstyjPKs6I70n%2FnfaU3uh8x0lzz;Path=/;Domain=.lijit.com;Expires=Tue, 31-Aug-2021 21:11:27 GMT;Max-Age=31536000;Secure;SameSite=None ljt_reader=8dd10de7c2ba378922c9409c;Path=/;Domain=.lijit.com;Max-Age=31536000;Secure;SameSite=None
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
X-Powered-By: raptor
Content-Encoding: gzip
X-Sovrn-Pod: ad_ap1ams1

Redirect headers

Server: nginx
Date: Mon, 31 Aug 2020 21:11:27 GMT
Content-Length: 0
Set-Cookie: ljt_reader=8dd10de7c2ba378922c9409c;Path=/;Domain=.lijit.com;Max-Age=31536000;Secure;SameSite=None
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ap.lijit.com/beacon?informer=13394437&dnr=1
X-Powered-By: raptor
X-Sovrn-Pod: ad_ap1ams1

GET
H2 200 sync.html
public.servenobid.com/ Frame 55E6 0
0 121ms
15ms Document
text/html 2620:1ec:bdf::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

:method: GET
:authority: public.servenobid.com
:scheme: https
:path: /sync.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
cache-control: max-age=86400
content-type: text/html
content-encoding: br
last-modified: Wed, 26 Aug 2020 18:24:34 GMT
accept-ranges: bytes
etag: "202461a171f44cd9bf99b8a0f91a6c12"
x-cache: TCP_HIT
server: AmazonS3
x-amz-id-2: AsE5L9ClCMJSwFA56/0NBuzOHRy9zgsPbazoXKqJ9v8GrKme+FIN0yTdBLl1jWneZR/38ixqPiU=
x-amz-request-id: 3B48A387B976ACAE
x-azure-ref: 0f2dNXwAAAABcWIcuj5cJSrUwFw6002ZoQU1TRURHRTA1MjEAODRlN2RmYTItMTQ0Mi00MzM0LWIzNGYtZTQyZDNmN2RkYWQ5
date: Mon, 31 Aug 2020 21:11:27 GMT

GET
H/1.1

200
OK

2000891.html
serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/ Frame 3895
Redirect Chain

https://sync.serverbid.com/ss/2000891.html
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

0
0

154ms
69ms

Document
text/html

205.185.216.42
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US),

Reverse DNS

map2.hwcdn.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Date: Mon, 31 Aug 2020 21:11:29 GMT
Connection: Keep-Alive
Cache-Control: max-age=39417
Content-Length: 4947
Content-Type: text/html
Last-Modified: Wed, 20 Nov 2019 20:29:05 GMT
Accept-Ranges: bytes
ETag: "1b0ebac83fe30af80513039edbdf566f"
x-amz-request-id: tx000000000000042ab9745-005f4caffa-38bfd94-nyc3a
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
Vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW: 1598908289.dop027.pa1.t,1598908289.cds015.pa1.shn,1598908289.cds015.pa1.c

Redirect headers

status: 302
content-length: 0
location: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
cache-control: no-cache

GET
H2

204

sync
pixel.advertising.com/ups/55965/
Redirect Chain

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent=
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=GfN0LhqidykB9nJ9T6FtfEigeXsB9Hh8HqJBJTS3

0
124 B

82ms
81ms

Image
text/plain

52.28.239.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=GfN0LhqidykB9nJ9T6FtfEigeXsB9Hh8HqJBJTS3

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.28.239.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Mon, 31 Aug 2020 21:11:27 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:27 GMT
status: 302
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=GfN0LhqidykB9nJ9T6FtfEigeXsB9Hh8HqJBJTS3
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

204

setuid
aas.dc-1.net/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Faas.dc-1.net%2Fsetuid%3FA%3Da7d145d5-2cde-47fd-85d7-2411a4822681%26D%3D%26bidder%3Dpubmatic%26uid%3D%23PM_USER_ID
https://aas.dc-1.net/setuid?A=a7d145d5-2cde-47fd-85d7-2411a4822681&D=&bidder=pubmatic&uid=CDBA1DFF-C06B-4BF1-9578-80470A06B1AA

0
198 B

306ms
104ms

Image
text/plain

100.24.218.250
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aas.dc-1.net/setuid?A=a7d145d5-2cde-47fd-85d7-2411a4822681&D=&bidder=pubmatic&uid=CDBA1DFF-C06B-4BF1-9578-80470A06B1AA
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.24.218.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Cowboy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Mon, 31 Aug 2020 21:11:29 GMT
cache-control: max-age=0, private, must-revalidate
server: Cowboy

Redirect headers

Location: https://aas.dc-1.net/setuid?A=a7d145d5-2cde-47fd-85d7-2411a4822681&D=&bidder=pubmatic&uid=CDBA1DFF-C06B-4BF1-9578-80470A06B1AA
Date: Mon, 31 Aug 2020 21:11:28 GMT
X-Cnection: close
Server: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6
Content-Length: 458
Content-Type: text/html; charset=iso-8859-1

GET
H2 403 /
c1.adform.net/serving/cookie/match/ 0
187 B 99ms
90ms Image
text/plain 37.157.6.252
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match/?CC=1&party=15&gdpr=1&gdpr_consent=&curl=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55944%2Fsync%3Fuid%3D%24UID%26_origin%3D0%26gdpr%3d1%26gdpr_consent%3d

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.252 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

s1.adform.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:27 GMT
server: nginx
status: 403
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
expires: -1

GET
H2 204 current
aol-match.dotomi.com/match/bounce/ 0
104 B 121ms
13ms Image
text/plain 2a02:fa8:8806:13::1430
VCLK-EU-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aol-match.dotomi.com/match/bounce/current?networkId=60&version=1&nuid=1A86a1e050-ebce-11ea-b7be-12dfe7d1818c&gdpr=1&gdpr_consent=&rurl=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55853%2Fsync%3Fuid%3D%24UID%26_origin%3D0%26gdpr%3D1%26gdpr_consent%3D
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:13::1430 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Mon, 31 Aug 2020 21:11:27 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2

204

setuid
aas.dc-1.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Faas.dc-1.net%2Fsetuid%3FA%3Da7d145d5-2cde-47fd-85d7-2411a4822681%26D%3D%26bidder%3Dappnexus%26uid%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Faas.dc-1.net%252Fsetuid%253FA%253Da7d145d5-2cde-47fd-85d7-2411a4822681%2526D%253D%2526bidder%253Dappnexus%2526uid%253D%2524UID
https://aas.dc-1.net/setuid?A=a7d145d5-2cde-47fd-85d7-2411a4822681&D=&bidder=appnexus&uid=7637719079026289740

0
193 B

1430ms
102ms

Image
text/plain

100.24.218.250
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aas.dc-1.net/setuid?A=a7d145d5-2cde-47fd-85d7-2411a4822681&D=&bidder=appnexus&uid=7637719079026289740
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.24.218.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Cowboy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Mon, 31 Aug 2020 21:11:29 GMT
cache-control: max-age=0, private, must-revalidate
server: Cowboy

Redirect headers

Pragma: no-cache
Date: Mon, 31 Aug 2020 21:11:27 GMT
X-Proxy-Origin: 82.102.19.136; 82.102.19.136; 690.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.16:80
AN-X-Request-Uuid: af5c6505-dd4a-45b1-bc2c-e89d958add38
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://aas.dc-1.net/setuid?A=a7d145d5-2cde-47fd-85d7-2411a4822681&D=&bidder=appnexus&uid=7637719079026289740
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

204

setuid
aas.dc-1.net/
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Faas.dc-1.net%2Fsetuid%3FA%3Da7d145d5-2cde-47fd-85d7-2411a4822681%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID
https://ap.lijit.com/pixel?redir=https%3A%2F%2Faas.dc-1.net%2Fsetuid%3FA%3Da7d145d5-2cde-47fd-85d7-2411a4822681%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID&sovrn_retry=true
https://aas.dc-1.net/setuid?A=a7d145d5-2cde-47fd-85d7-2411a4822681&D=&bidder=sovrn&uid=78d1288ed99d8a8c2d1f5c16

0
193 B

1228ms
103ms

Image
text/plain

100.24.218.250
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aas.dc-1.net/setuid?A=a7d145d5-2cde-47fd-85d7-2411a4822681&D=&bidder=sovrn&uid=78d1288ed99d8a8c2d1f5c16
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.24.218.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Cowboy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Mon, 31 Aug 2020 21:11:29 GMT
cache-control: max-age=0, private, must-revalidate
server: Cowboy

Redirect headers

Date: Mon, 31 Aug 2020 21:11:27 GMT
Server: nginx
Location: https://aas.dc-1.net/setuid?A=a7d145d5-2cde-47fd-85d7-2411a4822681&D=&bidder=sovrn&uid=78d1288ed99d8a8c2d1f5c16
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H2 204 sync
pixel.advertising.com/ups/56465/ 0
124 B 31ms
22ms Image
text/plain 52.28.239.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/56465/sync?_origin=0&redir=true&gdpr=1&gdpr_consent=

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.28.239.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Mon, 31 Aug 2020 21:11:27 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 generic
match.adsrvr.org/track/cmf/ 70 B
264 B 98ms
90ms Image
image/gif 54.229.128.207
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=aoladtech&gdpr=1&gdpr_consent=
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.229.128.207 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:27 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
status: 200
cache-control: private,no-cache, must-revalidate
content-type: image/gif
content-length: 70

GET
H2

204

setuid
aas.dc-1.net/
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Faas.dc-1.net%2Fsetuid%3FA%3Da7d145d5-2cde-47fd-85d7-2411a4822681%26D%3D%26bidder%3Dindex_rtb%26uid%3D
https://aas.dc-1.net/setuid?A=a7d145d5-2cde-47fd-85d7-2411a4822681&D=&bidder=index_rtb&uid=X01nflVbLiIAAHyI004AAAAW%26326

0
193 B

103ms
103ms

Image
text/plain

100.24.218.250
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aas.dc-1.net/setuid?A=a7d145d5-2cde-47fd-85d7-2411a4822681&D=&bidder=index_rtb&uid=X01nflVbLiIAAHyI004AAAAW%26326
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.24.218.250 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Cowboy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Mon, 31 Aug 2020 21:11:30 GMT
cache-control: max-age=0, private, must-revalidate
server: Cowboy

Redirect headers

Pragma: no-cache
Date: Mon, 31 Aug 2020 21:11:30 GMT
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://aas.dc-1.net/setuid?A=a7d145d5-2cde-47fd-85d7-2411a4822681&D=&bidder=index_rtb&uid=X01nflVbLiIAAHyI004AAAAW%26326
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 317
Expires: Mon, 31 Aug 2020 21:11:30 GMT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 0
353 B 21ms
21ms Image
text/html 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1598908284&vid_playerVer=3.1.0&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=ABT%20%2F%20DynamicFloor%20%2F%202%20%2F%20Active&isApp=0&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f4d677bccfc9&contentFileId=0&mediaPlayListId=0&dur=500&viewPct={%22w%22:0,%22h%22:0}&cbuster=1598908289408&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f4d677c02a85&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:29 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame AE5F 0
215 B 33ms
33ms XHR
application/json 52.28.38.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.28.38.201 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame AE5F 0
59 B 20ms
20ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Mon, 31 Aug 2020 21:11:32 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame AE5F 19 B
710 B 26ms
26ms XHR
application/json 37.252.172.38
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.38 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

690.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 31 Aug 2020 21:11:32 GMT
X-Proxy-Origin: 82.102.19.136; 82.102.19.136; 690.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.198:80
AN-X-Request-Uuid: 15ac8bc5-d48a-4712-b06f-6e71caed04d2
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ Frame AE5F 25 B
673 B 87ms
86ms XHR
application/json 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=435871&v=8.1&r={%22id%22:%2228d24c4e8569854%22,%22imp%22:[{%22id%22:%2229f2c2114b323d7%22,%22ext%22:{%22siteID%22:%22435871%22,%22sid%22:%22320x180%22},%22bidfloor%22:2.7,%22bidfloorcur%22:%22USD%22,%22video%22:{%22mimes%22:[%22video/mp4%22,%22application/javascript%22],%22minduration%22:1,%22maxduration%22:200,%22api%22:[1,2],%22protocols%22:[1,2,3,4,5,6],%22linearity%22:1,%22startdelay%22:0,%22skip%22:1,%22w%22:320,%22h%22:180,%22placement%22:1}},{%22id%22:%22305aa33cf45ae68%22,%22ext%22:{%22siteID%22:%22435870%22,%22sid%22:%22320x180%22},%22bidfloor%22:2.7,%22bidfloorcur%22:%22USD%22,%22video%22:{%22mimes%22:[%22video/mp4%22,%22application/javascript%22],%22minduration%22:1,%22maxduration%22:200,%22api%22:[1,2],%22protocols%22:[1,2,3,4,5,6],%22linearity%22:1,%22startdelay%22:0,%22skip%22:1,%22w%22:320,%22h%22:180,%22placement%22:1}}],%22site%22:{%22page%22:%22https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue%22},%22ext%22:{%22source%22:%22prebid%22},%22source%22:{%22ext%22:{%22schain%22:{%22ver%22:%221.0%22,%22complete%22:1,%22nodes%22:[{%22asi%22:%22admetricspro.com%22,%22sid%22:%221005%22,%22hp%22:1}]}}},%22regs%22:{%22ext%22:{%22gdpr%22:1}},%22user%22:{%22ext%22:{%22consent%22:%22%22}}}&ac=j&sd=1&nf=1
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a610e3bd55d5bcb3b0f963d7a4fb42d59197e8e9a4203112ad83029e19e437e8

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 31 Aug 2020 21:11:32 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 45
Expires: Mon, 31 Aug 2020 21:11:32 GMT

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame AE5F 92 B
282 B 36ms
36ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=b395db4c-6834-47e4-8d08-1863ecd900d8&nocache=1598908291998&gdpr_consent=&gdpr=1&schain=1.0,1!admetricspro.com,1005,1,,,&skip=1&auid=540882778&vwd=320&vht=180
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: OXGW/16.192.1 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:32 GMT
via: 1.1 google
server: OXGW/16.192.1
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame AE5F 173 B
380 B 23ms
23ms XHR
application/json 3.120.9.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.9.189 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 5c4f481a2b4b498ce33f15ad00e55a53aeda4642dfc2a4bf4f29b7a3e252149e

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:32 GMT
content-encoding: gzip
status: 200
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 167
expires: 0

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame AE5F 0
59 B 19ms
19ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Mon, 31 Aug 2020 21:11:32 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 0
353 B 24ms
24ms Image
text/html 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=25&serverTime=1598908284&vid_playerVer=3.1.0&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=ABT%20%2F%20DynamicFloor%20%2F%202%20%2F%20Active&isApp=0&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f4d677bccfc9&contentFileId=0&mediaPlayListId=0&dur=1000&cbuster=1598908294166&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f4d677c02a85&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:33 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame AE5F 92 B
283 B 38ms
37ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=111e7254-db7c-4b8e-9967-76430c1b2828&nocache=1598908294417&gdpr_consent=&gdpr=1&schain=1.0,1!admetricspro.com,1005,1,,,&skip=1&auid=540882778&vwd=320&vht=180
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: OXGW/16.192.1 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:34 GMT
via: 1.1 google
server: OXGW/16.192.1
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame AE5F 19 B
710 B 26ms
26ms XHR
application/json 37.252.172.38
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.38 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

690.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 31 Aug 2020 21:11:34 GMT
X-Proxy-Origin: 82.102.19.136; 82.102.19.136; 690.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.110:80
AN-X-Request-Uuid: 42ae3d65-436a-46e5-b731-cfdad2288898
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame AE5F 0
59 B 24ms
23ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Mon, 31 Aug 2020 21:11:34 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ Frame AE5F 25 B
673 B 119ms
118ms XHR
application/json 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=435871&v=8.1&r={%22id%22:%22433608455746463%22,%22imp%22:[{%22id%22:%224486df845154309%22,%22ext%22:{%22siteID%22:%22435871%22,%22sid%22:%22320x180%22},%22bidfloor%22:2.4,%22bidfloorcur%22:%22USD%22,%22video%22:{%22mimes%22:[%22video/mp4%22,%22application/javascript%22],%22minduration%22:1,%22maxduration%22:200,%22api%22:[1,2],%22protocols%22:[1,2,3,4,5,6],%22linearity%22:1,%22startdelay%22:0,%22skip%22:1,%22w%22:320,%22h%22:180,%22placement%22:1}},{%22id%22:%22457655818d04318%22,%22ext%22:{%22siteID%22:%22435870%22,%22sid%22:%22320x180%22},%22bidfloor%22:2.4,%22bidfloorcur%22:%22USD%22,%22video%22:{%22mimes%22:[%22video/mp4%22,%22application/javascript%22],%22minduration%22:1,%22maxduration%22:200,%22api%22:[1,2],%22protocols%22:[1,2,3,4,5,6],%22linearity%22:1,%22startdelay%22:0,%22skip%22:1,%22w%22:320,%22h%22:180,%22placement%22:1}}],%22site%22:{%22page%22:%22https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue%22},%22ext%22:{%22source%22:%22prebid%22},%22source%22:{%22ext%22:{%22schain%22:{%22ver%22:%221.0%22,%22complete%22:1,%22nodes%22:[{%22asi%22:%22admetricspro.com%22,%22sid%22:%221005%22,%22hp%22:1}]}}},%22regs%22:{%22ext%22:{%22gdpr%22:1}},%22user%22:{%22ext%22:{%22consent%22:%22%22}}}&ac=j&sd=1&nf=1
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b89c70f243bf2708487850e04dc26ad122a648ed1e0f40a0a5ad246edcaa7269

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 31 Aug 2020 21:11:34 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 45
Expires: Mon, 31 Aug 2020 21:11:34 GMT

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame AE5F 0
215 B 34ms
28ms XHR
application/json 52.28.38.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.28.38.201 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 0
353 B 22ms
21ms Image
text/html 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1598908284&vid_playerVer=3.1.0&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=ABT%20%2F%20DynamicFloor%20%2F%202%20%2F%20Active&isApp=0&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f4d677bccfc9&contentFileId=0&mediaPlayListId=0&dur=504&viewPct={%22w%22:0,%22h%22:0}&cbuster=1598908294443&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f4d677c02a85&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:33 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame AE5F 0
59 B 24ms
24ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Mon, 31 Aug 2020 21:11:34 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame AE5F 173 B
380 B 24ms
23ms XHR
application/json 3.120.9.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.9.189 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: cfc8b919967894b754312da7e21d0d474b50d0ec70d460c012ffb16715f4e63a

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:34 GMT
content-encoding: gzip
status: 200
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 167
expires: 0

GET
H/1.1 200
OK chunklist_640.m3u8 Show response
video.sekindo.com/uploads/cn16/video/users/hls/24485/video1523972806/vid5f453c65006a7774132681.mp4/ 2 KB
2 KB 96ms
25ms XHR
application/vnd.apple.mpegurl 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn16/video/users/hls/24485/video1523972806/vid5f453c65006a7774132681.mp4/chunklist_640.m3u8
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: d09700ad37082ae7ce7d4875fa8538f95ac9e08709c337cd6e5f60532359c29b

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 31 Aug 2020 21:11:14 GMT
last-modified: Tue, 25 Aug 2020 16:41:06 GMT
Server: Tengine
etag: "5f453f22-67f"
Content-Type: application/vnd.apple.mpegurl
access-control-allow-origin: *
expires: Mon, 07 Sep 2020 21:11:14 GMT
cache-control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 1663
X-Proxy-Cache: HIT

GET
H/1.1 200
OK w_640_000.ts Show response
video.sekindo.com/uploads/cn16/video/users/hls/24485/video1523972806/vid5f453c65006a7774132681.mp4/ 417 KB
417 KB 35ms
35ms XHR
video/mp2t 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn16/video/users/hls/24485/video1523972806/vid5f453c65006a7774132681.mp4/w_640_000.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 4efe5d6f90e0203eb1f365604736fb95f4e18e6d8d548245bd8808562ce2a243

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 31 Aug 2020 21:11:14 GMT
last-modified: Tue, 25 Aug 2020 16:40:29 GMT
Server: Tengine
etag: "5f453efd-6824c"
Content-Type: video/mp2t
access-control-allow-origin: *
expires: Mon, 07 Sep 2020 21:11:14 GMT
cache-control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 426572
X-Proxy-Cache: HIT

GET
BLOB 200
OK c2df1531-1da5-47d1-bc10-29b5b9225d9f
https://threatpost.com/ 65 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://threatpost.com/c2df1531-1da5-47d1-bc10-29b5b9225d9f
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d2dffba8a31eb663c59a5494783cbf197c182104edc58f0c0a17b7992429d7af

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Length: 66258
Content-Type: text/javascript

GET
H/1.1 200
OK w_640_001.ts Show response
video.sekindo.com/uploads/cn16/video/users/hls/24485/video1523972806/vid5f453c65006a7774132681.mp4/ 441 KB
442 KB 26ms
26ms XHR
video/mp2t 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn16/video/users/hls/24485/video1523972806/vid5f453c65006a7774132681.mp4/w_640_001.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: e55607ba6a15203972d2a7f281f079acd1049128d4759180086f49e5f3ab8b86

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 31 Aug 2020 21:11:14 GMT
last-modified: Tue, 25 Aug 2020 16:40:30 GMT
Server: Tengine
etag: "5f453efe-6e4b4"
Content-Type: video/mp2t
access-control-allow-origin: *
expires: Mon, 07 Sep 2020 21:11:14 GMT
cache-control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 451764
X-Proxy-Cache: HIT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 0
353 B 28ms
22ms Image
text/html 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=16&serverTime=1598908284&vid_playerVer=3.1.0&s=0&sta=12348808&x=320&y=180&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=ABT%20%2F%20DynamicFloor%20%2F%202%20%2F%20Active&isApp=0&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f4d677bccfc9&contentFileId=974903&mediaPlayListId=5946&contentMatchType=&isExcludeFromOpt=0&cbuster=1598908294974&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f4d677c02a85&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:35 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK w_640_002.ts Show response
video.sekindo.com/uploads/cn16/video/users/hls/24485/video1523972806/vid5f453c65006a7774132681.mp4/ 387 KB
388 KB 27ms
25ms XHR
video/mp2t 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn16/video/users/hls/24485/video1523972806/vid5f453c65006a7774132681.mp4/w_640_002.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: abc031154335b4c802fa8f2d9214751597b2c09163afeab39240701c873d119f

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 31 Aug 2020 21:11:15 GMT
last-modified: Tue, 25 Aug 2020 16:40:31 GMT
Server: Tengine
etag: "5f453eff-60d88"
Content-Type: video/mp2t
access-control-allow-origin: *
expires: Mon, 07 Sep 2020 21:11:15 GMT
cache-control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 396680
X-Proxy-Cache: HIT

GET
H/1.1 200
OK w_640_003.ts Show response
video.sekindo.com/uploads/cn16/video/users/hls/24485/video1523972806/vid5f453c65006a7774132681.mp4/ 230 KB
231 KB 26ms
24ms XHR
video/mp2t 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn16/video/users/hls/24485/video1523972806/vid5f453c65006a7774132681.mp4/w_640_003.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 717bb01febc9cfc40f2a3da0e3d7bcbfc9ddac8282b86f7bfc688dfe570bd3ee

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 31 Aug 2020 21:11:15 GMT
last-modified: Tue, 25 Aug 2020 16:40:32 GMT
Server: Tengine
etag: "5f453f00-398e8"
Content-Type: video/mp2t
access-control-allow-origin: *
expires: Mon, 07 Sep 2020 21:11:15 GMT
cache-control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 235752
X-Proxy-Cache: HIT

GET
H/1.1 200
OK w_640_004.ts Show response
video.sekindo.com/uploads/cn16/video/users/hls/24485/video1523972806/vid5f453c65006a7774132681.mp4/ 209 KB
210 KB 26ms
25ms XHR
video/mp2t 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn16/video/users/hls/24485/video1523972806/vid5f453c65006a7774132681.mp4/w_640_004.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 2de8d4a456ba1bf6861e18a1ccd8ff064417a40033413d8463c3b00cc6220aa5

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 31 Aug 2020 21:11:15 GMT
last-modified: Tue, 25 Aug 2020 16:40:32 GMT
Server: Tengine
etag: "5f453f00-345ec"
Content-Type: video/mp2t
access-control-allow-origin: *
expires: Mon, 07 Sep 2020 21:11:15 GMT
cache-control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 214508
X-Proxy-Cache: HIT

GET
H/1.1 200
OK w_640_005.ts Show response
video.sekindo.com/uploads/cn16/video/users/hls/24485/video1523972806/vid5f453c65006a7774132681.mp4/ 221 KB
221 KB 25ms
24ms XHR
video/mp2t 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn16/video/users/hls/24485/video1523972806/vid5f453c65006a7774132681.mp4/w_640_005.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: cca788a33c8ee66e80e4295e6c315dc2e27bbb2bf301aff87f5ceb77a74b35f2

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 31 Aug 2020 21:11:15 GMT
last-modified: Tue, 25 Aug 2020 16:40:33 GMT
Server: Tengine
etag: "5f453f01-37374"
Content-Type: video/mp2t
access-control-allow-origin: *
expires: Mon, 07 Sep 2020 21:11:15 GMT
cache-control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 226164
X-Proxy-Cache: HIT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
7 KB 37ms
18ms XHR
application/json 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020082701&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020082701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

adb40e5f349b6c3ed3d876a1c07e5820b35d6c1b05d0d2a258de355d48d8a77b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 31 Aug 2020 21:11:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6281
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 14 KB
6 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 21:11:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1591403518460474"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5540
x-xss-protection: 0
expires: Mon, 31 Aug 2020 21:11:37 GMT

GET
H3-Q050 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/210/ Frame 897D 0
0 9ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/210/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 4590
date: Mon, 31 Aug 2020 20:07:41 GMT
expires: Tue, 31 Aug 2021 20:07:41 GMT
last-modified: Wed, 26 Feb 2020 19:47:50 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3836
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
55 B 41ms
40ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=210&t=2&li=gpt_2020082701&jk=3776165179607908&bg=!vr2lvaVYaX_2Uete2DYCAAAAbFIAAAAQCgE_Gt1gEwUsQVzRSoeG0WUgrgwGSl1dGG3hW9FVU7UON9eCwbL1ojF2s99-e1o0H0V42SJNosverILoJ-h1exafDyLN5ymYHFZDpR4XEotUaNohSgZlllSWJfgRfvZTHmOvY8-WtPV6GhmzF0XvHdbSamlfiBqNJFxNcBQgRKCowk1JReUfJBrPsjdzbS6Wf4jLfCu30_FFJHn9LvDLIStW6szKSrfWbqCwKam3nrpbMSuEgP1XpIcGUo8f58aWSbY-hgw-AuF_sPlJzVqeLnDnnVwlea9F7U3ZEdxxKeWe_usQNvbtT4hyhLuqMZRpYXYNg-Q24lnypJChM11kuFMBD8FO1g3x1F0Vr8EPAZvkcjXxz_SUg3yB3DhZGohrRdbjDAlH0H9jalqFoh-M36rvWhW7wyRm0m6Z9SOQHNIagZkBpUBc7h8I1C4I9Ehi4OasgNkkYFoBhLwpOb3EbJ7uU43Y_PuxouQFTZHscYrqfg8HXdGLxvpMCKEHJ_fTloHb9oAJtgf4QiZS05fm01_kyH8p0cgs7J-IpLCOXHDedDm9O48FUaqt5I8qtwj4rhxA_Ij616o_8FvZlZujNfFcwlKiydClKeu3tcJfENH9WSabmr2jvRJ_Yeqf-y6qxIPMJf-dFNDDhks1fTwDmjUvooO_lOVuRlBa3YmtUM1lKUa5rtPN-hcJSJ-3IJg1qKFDExyeNSINpqwFZz4G6mtYIsU0pFKHtrLJQAmauc_x-Dz1ypVuWvYNnCYu41KPh8fkEWDvaTbJezvEz9J1lohv6Vd_tI2YtD7B3oOfpYNqUqSsRpp_B4ZE3o5Wl8Hx8skwnfXmlKQ6bCo37cigpVTmkkaaFk4jE79uSLSo7Xyo5EGLtdDSC-nc9Y8qo5PI0zJHUs-g2f1fTNDs3UHCgxZpD6bk_kOicuOK5x45-yqq3OdSjCQ0oVsm9vR2B8X_PVlUa3KDIiJgo4UPHFUtu9_JP1nHei7YE-U

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 0
353 B 22ms
22ms Image
text/html 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1598908284&vid_playerVer=3.1.0&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=ABT%20%2F%20DynamicFloor%20%2F%202%20%2F%20Active&isApp=0&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f4d677bccfc9&contentFileId=0&mediaPlayListId=0&dur=497&viewPct={%22w%22:0,%22h%22:0}&cbuster=1598908299409&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f4d677c02a85&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:38 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK w_640_006.ts Show response
video.sekindo.com/uploads/cn16/video/users/hls/24485/video1523972806/vid5f453c65006a7774132681.mp4/ 224 KB
224 KB 35ms
34ms XHR
video/mp2t 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn16/video/users/hls/24485/video1523972806/vid5f453c65006a7774132681.mp4/w_640_006.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 036da9c739400adac4fb95ee612610976d65e0714cddbe4358e6d1380c5655c5

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 31 Aug 2020 21:11:21 GMT
last-modified: Tue, 25 Aug 2020 16:40:34 GMT
Server: Tengine
etag: "5f453f02-37e78"
Content-Type: video/mp2t
access-control-allow-origin: *
expires: Mon, 07 Sep 2020 21:11:21 GMT
cache-control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 228984
X-Proxy-Cache: HIT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 0
353 B 22ms
21ms Image
text/html 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=25&serverTime=1598908284&vid_playerVer=3.1.0&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=ABT%20%2F%20DynamicFloor%20%2F%202%20%2F%20Active&isApp=0&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f4d677bccfc9&contentFileId=0&mediaPlayListId=0&dur=1000&cbuster=1598908304166&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f4d677c02a85&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:43 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 0
353 B 21ms
21ms Image
text/html 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1598908284&vid_playerVer=3.1.0&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=ABT%20%2F%20DynamicFloor%20%2F%202%20%2F%20Active&isApp=0&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f4d677bccfc9&contentFileId=0&mediaPlayListId=0&dur=500&viewPct={%22w%22:0,%22h%22:0}&cbuster=1598908304408&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f4d677c02a85&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:44 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame AE5F 0
59 B 24ms
23ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Mon, 31 Aug 2020 21:11:45 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame AE5F 92 B
282 B 35ms
35ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=fe99bff1-a3a4-4a45-86f9-20b38290ec1b&nocache=1598908305603&gdpr_consent=&gdpr=1&schain=1.0,1!admetricspro.com,1005,1,,,&skip=1&auid=540882778&vwd=320&vht=180
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: OXGW/16.192.1 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:45 GMT
via: 1.1 google
server: OXGW/16.192.1
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame AE5F 19 B
710 B 73ms
26ms XHR
application/json 37.252.172.38
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.38 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

690.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 31 Aug 2020 21:11:45 GMT
X-Proxy-Origin: 82.102.19.136; 82.102.19.136; 690.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.119:80
AN-X-Request-Uuid: 19de81a3-4ac9-466d-9573-33cea8378059
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame AE5F 0
215 B 74ms
29ms XHR
application/json 52.28.38.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.28.38.201 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ Frame AE5F 25 B
673 B 99ms
99ms XHR
application/json 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=435871&v=8.1&r={%22id%22:%22609d17fa9684fc8%22,%22imp%22:[{%22id%22:%2261ad913931cb74b%22,%22ext%22:{%22siteID%22:%22435871%22,%22sid%22:%22320x180%22},%22bidfloor%22:2.1,%22bidfloorcur%22:%22USD%22,%22video%22:{%22mimes%22:[%22video/mp4%22,%22application/javascript%22],%22minduration%22:1,%22maxduration%22:200,%22api%22:[1,2],%22protocols%22:[1,2,3,4,5,6],%22linearity%22:1,%22startdelay%22:0,%22skip%22:1,%22w%22:320,%22h%22:180,%22placement%22:1}},{%22id%22:%2262a3b90b267fa1d%22,%22ext%22:{%22siteID%22:%22435870%22,%22sid%22:%22320x180%22},%22bidfloor%22:2.1,%22bidfloorcur%22:%22USD%22,%22video%22:{%22mimes%22:[%22video/mp4%22,%22application/javascript%22],%22minduration%22:1,%22maxduration%22:200,%22api%22:[1,2],%22protocols%22:[1,2,3,4,5,6],%22linearity%22:1,%22startdelay%22:0,%22skip%22:1,%22w%22:320,%22h%22:180,%22placement%22:1}}],%22site%22:{%22page%22:%22https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue%22},%22ext%22:{%22source%22:%22prebid%22},%22source%22:{%22ext%22:{%22schain%22:{%22ver%22:%221.0%22,%22complete%22:1,%22nodes%22:[{%22asi%22:%22admetricspro.com%22,%22sid%22:%221005%22,%22hp%22:1}]}}},%22regs%22:{%22ext%22:{%22gdpr%22:1}},%22user%22:{%22ext%22:{%22consent%22:%22%22}}}&ac=j&sd=1&nf=1
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 0180f73dbf429ab285b305c4945a9fe3e11fb8d602e8bcd3ccf0a993ed70c09c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 31 Aug 2020 21:11:45 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 45
Expires: Mon, 31 Aug 2020 21:11:45 GMT

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame AE5F 173 B
381 B 23ms
22ms XHR
application/json 3.120.9.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.9.189 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 9a3a0ff2ca4b723412a155acf56aee728a463ed5c50a141f09faee8410420cf1

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:45 GMT
content-encoding: gzip
status: 200
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 168
expires: 0

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame AE5F 0
59 B 20ms
20ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Mon, 31 Aug 2020 21:11:45 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H/1.1 200
OK w_640_007.ts Show response
video.sekindo.com/uploads/cn16/video/users/hls/24485/video1523972806/vid5f453c65006a7774132681.mp4/ 217 KB
217 KB 34ms
33ms XHR
video/mp2t 63.250.60.138
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn16/video/users/hls/24485/video1523972806/vid5f453c65006a7774132681.mp4/w_640_007.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.250.60.138 , United States, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 93d0b3452bd52a5043e6e742588534746392ec0019b4b9b7dff6d8faa164e090

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 31 Aug 2020 21:11:27 GMT
last-modified: Tue, 25 Aug 2020 16:40:35 GMT
Server: Tengine
etag: "5f453f03-36290"
Content-Type: video/mp2t
access-control-allow-origin: *
expires: Mon, 07 Sep 2020 21:11:27 GMT
cache-control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 221840
X-Proxy-Cache: HIT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 0
353 B 23ms
23ms Image
text/html 185.220.204.220
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1598908284&vid_playerVer=3.1.0&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=ABT%20%2F%20DynamicFloor%20%2F%202%20%2F%20Active&isApp=0&userIpAddr=82.102.19.136&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f4d677bccfc9&contentFileId=0&mediaPlayListId=0&dur=500&viewPct={%22w%22:0,%22h%22:0}&cbuster=1598908309408&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f4d677c02a85&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.220 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 31 Aug 2020 21:11:48 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

254 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

16 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.adsrvr.org/	1970-01-19 20:54:04	Name: TDCPM Value: CAEYBSABKAIyCwiU9-rIpf_mOBAFOAE.
.adsrvr.org/	1970-01-19 20:54:04	Name: TDID Value: 0215dcd3-8bc5-4347-afd5-fba013d1132d
.gumgum.com/	1970-01-19 20:54:04	Name: vst Value: e_6b9b5dfe-adbc-4811-80a3-efdd5649944d
.casalemedia.com/	1970-01-19 20:54:04	Name: CMID Value: X01nflVbLiIAAHyI004AAAAW
.casalemedia.com/	1970-01-19 12:09:54	Name: CMDD Value: AAamQAE*
.servenobid.com/	1970-01-19 12:18:33	Name: pid_309 Value: e_6b9b5dfe-adbc-4811-80a3-efdd5649944d
.casalemedia.com/	1970-01-19 14:18:04	Name: CMPS Value: 4352
.casalemedia.com/	1970-01-19 14:18:04	Name: CMPRO Value: 326
.casalemedia.com/	1970-01-19 20:54:04	Name: CMRUM3 Value: 825f4d67852760AAL30U6-ms8AAA_cfVCPcA&5a5f4d67802760BE6A65412B674DAF9DCC2C43FE7BF8C2&ce5f4d677f05a00&f15f4d677e05a00&585f4d677e2760X01nfgAAAJpQvXfk&2e5f4d678505a0&485f4d678505a00&9d5f4d67852760QnXe0g6Q7Nr3dxrL&415f4d678705a0&695f4d678105a00&275f4d67870b40&395f4d67822760875739028206434041&035f4d678027604dd25f4d-677d-4900-8f54-b1f07e592f3c&9c5f4d678705a00&405f4d67872760no-consent&6f5f4d678527603154244353277244203&e65f4d677e27600&335f4d67872760caded864-a99e-4249-93f2-8f1988227148&295f4d677e05a00&b05f4d678705a00&2f5f4d67852760Asjfm1Ql1KcR5m5&515f4d6785276067QrbOjlJzzz6y457Lcya7i3Ljrz5Sls7eoZ3j4Y&265f4d677f4ec00&045f4d678727603250244603503838176&495f4d677f05a00&2d5f4d677e2760CAESEDxZKuvrhz_1N4Fu3eI6on0&c45f4d678505a00&c35f4d67892760av-5cf7e077-e194-4a44-8e32-dda1f7200df7
.pubmatic.com/	1970-01-19 12:51:40	Name: SPugT Value: 1598908293
.lijit.com/	1970-01-19 20:54:04	Name: ljt_reader Value: ad44e19b3c255c75a74ba6d3
.doubleclick.net/	1970-01-19 12:08:29	Name: test_cookie Value: CheckForPermission
.pubmatic.com/	1970-01-19 14:18:04	Name: KTPCACOOKIE Value: YES
.openx.net/	1970-01-19 20:54:04	Name: i Value: 8dde789c-a5b7-06e8-0b13-df7fd383f8be\|1598908294
.casalemedia.com/	1970-01-19 12:09:54	Name: CMST Value: X01nhl9NZ4kB
.pubmatic.com/	1970-01-19 12:09:54	Name: pi Value: 2:4

41 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 372) Message: gBrowserWidth =1600
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-970x250-ATF div-gpt-ad-6794670-2
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-300x250-ATF div-gpt-ad-6794670-3
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-300x600-ATF div-gpt-ad-6794670-5
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-2x2-Skin div-gpt-ad-6794670-1
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: Startup v238
console-api	warning	URL: https://qd.admetricspro.com/js/threatpost/prebid.js(Line 3) Message: fun-hooks: referenced 'registerAdserver' but it was never created
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: ENGINE: gSChainNodes found, prebid configured with 1 supply chain object(s)
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: ENGINE: final pbjs config
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: Initial Ad Load
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: __uspLaunch begin
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: No existing consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: checking non TCF vendor cookie
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: No existing non-TCF consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: __uspLaunch(): addEventListener:
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: Locale=en-us gdpr= false
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: GDPR does not apply
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: __uspLaunch(): addEventListener:
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests() gPBJSTimeoutTimer=null pbjs.adserverRequestSent=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: Amazon bids returned, count=4
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object],[object Object],[object Object],[object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs bids returned
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: gPBJSTimeoutTimer cleared
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest(): pbjsBidsBack
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest()
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs.getAdserverTargeting: >> Amazon >> Prebid
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs.getBidResponses:
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: gThisRefreshSlots=
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object],[object Object],[object Object],[object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest(): ---> Calling googletag.pubads().refresh()
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: console.groupEnd
console-api	info	URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js(Line 420) Message: Powered by AMP ⚡ HTML – Version 2008242301000 https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
console-api	info	URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js(Line 420) Message: Powered by AMP ⚡ HTML – Version 2008242301000 https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
console-api	info	URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js(Line 420) Message: Powered by AMP ⚡ HTML – Version 2008242301000 https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
console-api	info	URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js(Line 420) Message: Powered by AMP ⚡ HTML – Version 2008242301000 https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
console-api	warning	URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js(Line 21) Message: [amp-analytics/transport] Response unparseable or failed to send image request https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstTLsYRKjUFhRfX8lrjbOSVCkDiI0bUMn9dipCDnvBKv3Ka6P8_sskzyOcNG6q2Kumf45PpytshFNPONOGd32saZw-hznwhADID2Y1uFCXdhwO6990ODDg0svXOwUnAeDL1CIJx5YoE0RXjACHhbmCaoOEy3xIqPIjuw1QvR14dLt1g4US5li33Wrt0Y3tqw1T3Ua5xC07zA7CN-2UNGCgOic_3EB7PL-nGpsQy41Dsakg65p_Vx_Ot7p_eJQw4zf7soWcnW8nEbsGr3jBanfrB&sai=AMfl-YQjaL1S821tSLy7CCp-gh766nxL6h2Z6nUy9mc-IUMIvF9Atu0hO0dWklmrTbFEKoPUf7MZVapjvUWTCMWUX9QPCpa_qvs-mUhR9GVmVtK63NZ7gT84aFYe_mDyWCk&sig=Cg0ArKJSzK4n8CmTbUU_EAE&adurl=

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

54d623ab6ca75f98feb0b16010cc1ec0.safeframe.googlesyndication.com
aas.dc-1.net
acdn.adnxs.com
ad.doubleclick.net
ads.adaptv.advertising.com
ads.pubmatic.com
ads.servenobid.com
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
analytics.twitter.com
aol-match.dotomi.com
ap.lijit.com
as-sec.casalemedia.com
assets.threatpost.com
c.amazon-adsystem.com
c1.adform.net
cdn.ampproject.org
cm.g.doubleclick.net
csync.loopme.me
e.serverbid.com
eb2.3lift.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
graph.facebook.com
hbopenbid.pubmatic.com
ib.adnxs.com
image2.pubmatic.com
js-sec.indexww.com
kasperskycontenthub.com
live.sekindo.com
match.adsrvr.org
math-aids-threatpost-tagan.adlightning.com
media.threatpost.com
pagead2.googlesyndication.com
pixel.advertising.com
pixel.quantserve.com
pr-bh.ybp.yahoo.com
prebid-server.rubiconproject.com
prebid.a-mo.net
public.servenobid.com
qd.admetricspro.com
rules.quantcount.com
secure.quantserve.com
securepubads.g.doubleclick.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
ssum.casalemedia.com
static.ads-twitter.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.search.spotxchange.com
sync.serverbid.com
t.co
tagan.adlightning.com
teachingaids-d.openx.net
threatpost.com
tlx.3lift.com
tpc.googlesyndication.com
u.openx.net
ups.analytics.yahoo.com
video.sekindo.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.linkedin.com
www.reddit.com
x.bidswitch.net
100.24.218.250
104.111.215.135
104.111.215.51
104.111.215.68
104.111.230.142
104.244.42.3
104.244.42.69
13.224.193.4
143.204.201.95
151.101.12.157
151.101.14.49
172.217.18.102
172.217.18.162
178.128.135.80
18.156.0.31
18.157.242.30
185.220.204.220
185.64.189.110
185.64.189.112
185.94.180.125
195.201.246.119
199.232.53.140
205.185.216.42
216.58.205.226
2600:9000:2057:b200:6:44e3:f8c0:93a1
2600:9000:20eb:2800:0:5c46:4f40:93a1
2600:9000:2156:1400:2:9275:3d40:93a1
2606:2800:233:97b6:26be:138a:cba8:bb01
2606:4700:e2::ac40:861f
2620:116:800d:21:36a9:ecb:e518:b308
2620:1ec:21::14
2620:1ec:bdf::10
2a00:1288:110:c305::8000
2a00:1450:4001:808::2002
2a00:1450:4001:809::2001
2a00:1450:4001:816::2004
2a00:1450:4001:819::2003
2a00:1450:4001:81b::2003
2a00:1450:4001:81e::2003
2a00:1450:4001:81f::2001
2a00:1450:4001:81f::2008
2a00:1450:4001:821::200a
2a00:1450:4001:824::2001
2a00:1450:4001:825::200e
2a00:1450:400c:c0c::9c
2a02:fa8:8806:13::1430
2a03:2880:f02d:e:face:b00c:0:2
3.120.9.189
34.237.157.170
34.98.64.218
35.156.223.207
35.173.160.135
37.157.6.252
37.252.172.38
52.212.5.193
52.28.239.147
52.28.38.201
54.229.128.207
54.93.147.19
63.250.60.138
69.173.144.140
72.251.249.14
99.86.5.213
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14
00d4fbacbadc6ecbd73be323ec77febf3d856ce00dc5334d06462a315c7da8e7
0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c
011abf54e8eab6a7f72d61611287e7262133d36be666a2483fe27ce1dac2d222
0180f73dbf429ab285b305c4945a9fe3e11fb8d602e8bcd3ccf0a993ed70c09c
01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c
036da9c739400adac4fb95ee612610976d65e0714cddbe4358e6d1380c5655c5
03b306d39df447da9c6c78f918b64a454ebc20d242dc457c61289bc1640c31eb
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
05148a217f01f1d6b7a9e90813a2c58d0dbbd947f76cbcbba24e4c0411463b08
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7
08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c
09794436cc7c3ecbf18b516311d783648da5fc8a3f53253b634253e517785ca0
0aa2fbae07f7af328f1e000c19a2068cc0eb0928acfe77241cfbc1390c86b956
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
0cf25abe73b03e246c0a820c825a1f433e36949c2cf456ce889d86e8dd9ec427
0d87ca43d0a4d5909161c7f72d7b23e5309f1322912fb1dac0dfef951f19694c
10a79d7840ab8c64ce17acb504c6b22935b02c47f1f0d67a38d77b1ea56af01b
12771abe4371a61f019993da9d82819c5c68e8360220b062b467b253c1991be1
12c9acd2dd58cfe3cbab5c7be32c13431018977aafd9f03d3fe3cc05ee379f49
13ab06913444b6e3b4139e5487813073f11e082878ae8a5bf5213fdc6f95f5e0
152f44a1d127a5a4b87a08fa6b547da9628e8ad66c691f5180588a0a929b98a9
1554f794a0cc095ee381dee0971f1d1a8a9aaa55c743103e24913f07e18ec6b5
15e9840f31982980328598c38e5c60434072901f2c902713ef9c4d4900e05307
172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d
18b962cde0d4113b8e26e2492d0b9cbb6b47007d7b192080102dd084ed60a16e
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1f152c8879492dd153cf7a47ad195151e20491e60985d86f9ef7a7ddc85062f6
20b94b09df137bfa328a0ae017dc43cd17ce5e9190ab9155802245d833fc2ee8
21e46fe44c6929876f5a413c843ae516c0ddfd1aad3e8e33446b7bc0a6781b08
2568034b9d66c093730623e756fb7be1e3382eda3ea7f521188d0390bb61b07a
29257e6f0eaa20a411d881c29d9fdd181a811ec32b5fdd1cb46ec4bd4719861f
29980e248847fcc1f63b5e609b5ea0e02117834d55489c30694e5ae18b91da6e
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2dc46a5c066cf11fb55779d15805ef190c46451e30343e10483709d5f20e1900
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d
2de8d4a456ba1bf6861e18a1ccd8ff064417a40033413d8463c3b00cc6220aa5
3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838
30cfde8a99cbbfb145edbaee540db712a5c6e8efa9e0b8209d803a7d4ecbdbbb
3435531b595fb1b2b529346e1df8c979a1fd727f56ea8c0d792316035440cac5
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a
39f437357a2ffa0d788c9fc8563f3af59d73d529060cb407ac639513df958597
3af0a9272dae9060f2f7341372cb9b5a3ce1ad579a31c094ac5d499362bbff0e
4128d163becca8bccabd6a9f8fe8e603e630432f133fe67fd779cc64534bca27
41f3222c29889fb48f5dca1d481858e5339a759655510c256ef4edf56c80f7f5
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730
42af7e6e349fe67a3cc672c2c0883d751822f8281c9d6a6889657c3ff5fa01b1
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7
462b8152ba87fb0dcd4edd139611c1a42dc3eb3f29bdf729621399d70c9eb7a9
475129044e4b86e3cf9a942e7798a96c1eb24ee04a9b755f4a7bf2ebcc324310
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4b4d0717f8a966c6a6e30520057816bd8898e5a585d306fb9aba9f1b7ad0d7c2
4bc19dae6d5ddc5d386c463ba3917db2735da5c753511e65ae6e018e10b827e4
4edf4e4d19fa8ec8abf42e728012fb704a7d8e49a25bbf778b77abd20d90b8ce
4efe5d6f90e0203eb1f365604736fb95f4e18e6d8d548245bd8808562ce2a243
4f7cd55655bafca4db9b67255125ed52cd91d21b1727e9f28f71219aa1341de5
506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf
5bc007ee201fc5230153fffb0d9f029e10dbaab754cf9d0ac3e8094968e7ec3f
5c4f481a2b4b498ce33f15ad00e55a53aeda4642dfc2a4bf4f29b7a3e252149e
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
60fc2b06c8d3b39cc64b9026ab51eec19367b60947732bfa4d0a8ce9237ec8f9
6386762d086f1e6df4264ceed5479375126ada582a59ac90437d646d417a140c
673cc0ffa51cb60a5636bc1c2a53b8d2f1e4f4e334504aa8c56a7212d2dfee49
6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2
6d0a7e3c202fab883daa1728bee7f5edd21bc3895f7e535cf0c2bd751e78757d
717bb01febc9cfc40f2a3da0e3d7bcbfc9ddac8282b86f7bfc688dfe570bd3ee
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
7517792de8d4a1319afd85d8c3dcffe799ba5545129a650182e6c4b055302852
76102878c1198de858725194952ba1c6b35bdee0f870cc6a124e93d17385e64e
7860ef37e85676dcb81a99d7e5d6453bdacdf9d35aa45517a9ba9ea25bbd4c85
7ae5a850970a16eb3d4487568a5823f41c7f8b32a41851255a674c7f14794d0e
7ce1aa64937fb13d7a21fb0e014bf3fe7c4ff6f722a2e8b17b4907bcc8a36f14
7e2b472509d9e149690aba45c5917ebdd2f52471b98d414c2726301b90e08f21
7f1e08ac6923a0556e71798833aef7b749fb608eeb8668739b690af04fe335a4
7f8e1d0f78514ed9b034cbece69dd86d8733ee2bf4d45ca79e1363c1893508ab
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8130c2c72afad9d94581ef93aaa00524093103c47c71fce52f606d5ff693c3ce
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb
89ce08431545cd3c6d42419d99ee0152027a68c1d0c7c82838cc9a51d9d52451
8c665507e16736e1323acf89104e508e8cac863d30e8ca5ff5d6ac5303b25277
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8fb7717faf61efb8c271691ba84ec01ea107b6946783ded26fb313c2b9a17760
903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c
919ce225464d5e8d79944356fcaa74323a12f8fc847eec6c7a877f9e752f7fb9
93d0b3452bd52a5043e6e742588534746392ec0019b4b9b7dff6d8faa164e090
95d620d3536c6cab025e39204ce48e4e4fa1e2f7c5acdae3c88686e1692a19b0
9785fb7b221d3b9c2fe68d6058ff6326c010842bb699a411ecad99f16f65b2b0
98e43f2d7eb5341dfc6654d24c0a6adb0ae5dc2c3ae65557cc5a2af0229cbfb7
9a3a0ff2ca4b723412a155acf56aee728a463ed5c50a141f09faee8410420cf1
a01a07944c453db3669c07297d7b9a8680abef5ed9b457718a2c7fa3aa5342c9
a0b8d5f925cb1ad83c665488cf3d59c2b4acf9f0ec9f277db2441ca69d3900b0
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd
a447794ed71b2448144c6c6e0c052233e67b76eaaa71b21ec3174004fb72c38e
a610e3bd55d5bcb3b0f963d7a4fb42d59197e8e9a4203112ad83029e19e437e8
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22
aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7
aa90c2d77583dd25e7fbdc1411c8d718f29d9665ab48f985ffe6f3a38b34b6a7
abc031154335b4c802fa8f2d9214751597b2c09163afeab39240701c873d119f
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
adb40e5f349b6c3ed3d876a1c07e5820b35d6c1b05d0d2a258de355d48d8a77b
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be
af517de65e4d2beaa3da8659682a9daaf863b96f59567e7550b7a1812a4f97e1
b0209d39595432d762f6ba2a81dc0bffa6a6e1ed9021ba24ffa06c3c7e4bcb02
b08c92f2985a2cf85e942b566af89d0738cb22e14d0db5ddbefd6c4034a169e8
b37ebb4e83fa3916e2884835f4948a981b8faf9863703f30a840d7b290533745
b89c70f243bf2708487850e04dc26ad122a648ed1e0f40a0a5ad246edcaa7269
b8da2c33dd1f431194d4fa3edc5f0488e937fa6a0e6b6e97cdaea8248b546d38
c0159d71bfd21f50878f12b283950402c6364354bcd559af9accc22191dddb5b
c55fd3a48d3838d61dfc82410a2c440bea8ecb0b4bf1b451012ac04327ed4bd8
c80559d376a1d8e7e34807fb0fc827fa1c461121f55107100fe14c2c6560b6cc
c8bef2fe7b345380c0da251c82c7ea5aba5340d7ddd7e7d6927d628aad21d406
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ca52910307046d9132e3004d3b113d9e31601c2bc1c457bd3d7d02a2d468a091
cca788a33c8ee66e80e4295e6c315dc2e27bbb2bf301aff87f5ceb77a74b35f2
cfc8b919967894b754312da7e21d0d474b50d0ec70d460c012ffb16715f4e63a
d09700ad37082ae7ce7d4875fa8538f95ac9e08709c337cd6e5f60532359c29b
d2441096bd7de5d08f47b80e1406c927d0b19ab810c1ece78d5bdfb040a20d69
d2dffba8a31eb663c59a5494783cbf197c182104edc58f0c0a17b7992429d7af
d2e5434d730440add973e3d2c835b65c44e5be6f59180398b4ba620698085ace
d364e2aba777f75da1784ca6db6dd7515dd43bc82a490545896c57dfc5a2f01f
d5d0c35ba6c0f00e4a21d2c462c057ef34f20742942a4cbc2217883f09771923
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
d89d98593ac65c9f002b856f3e22a1479f3aea866f7fd15c85903c0a6d66f0e3
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0
e55607ba6a15203972d2a7f281f079acd1049128d4759180086f49e5f3ab8b86
ed1bd9b5fc31e624bb0b3ca2c510546c8a1bb6b41923e06768a735c75a9c704c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2
f2a4f376e4a84ff665f3d62282b266ca53e6e5aa28a899e0b896a5ec8a8f4fb3
f40e3d5b91387e92272b6d46fc83ce21041f130a29316d7216d3a1793d46c4f3
f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198
f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6
f891dac9017293579371cac81121c94a351bb090213c4609b8879465c498e3b7
f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955
ffa5d8fba25133fa1d5b7f4cb92f0e5daf9ec169103cfb23b7a7798fcaa10d36

threatpost.com Open in urlscan Pro 35.173.160.135 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

269 Requests

100 %HTTPS

37 %IPv6

46 Domains

74 Subdomains

58 IPs

9 Countries

5162 kBTransfer

9870 kBSize

16 Cookies

15 Outgoing links

Redirected requests

269 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Screenshot
Live screenshot

Full Image

269
Requests

100 %
HTTPS

37 %
IPv6

46
Domains

74
Subdomains

58
IPs

9
Countries

5162 kB
Transfer

9870 kB
Size

16
Cookies

269 HTTP transactions
4 data transactions