threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Submission: On October 30 via api (October 30th 2020, 9:33:21 pm UTC) from US

Summary HTTP 253 Redirects Behaviour Indicators

Summary

This website contacted 64 IPs in 9 countries across 44 domains to perform 253 HTTP transactions. The main IP is 35.173.160.135, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is threatpost.com.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on June 10th 2020. Valid for: a year.

This is the only time threatpost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
18	35.173.160.135 35.173.160.135	14618 (AMAZON-AES) (AMAZON-AES)
11	65.9.20.101 65.9.20.101	16509 (AMAZON-02) (AMAZON-02)
7	2606:4700:e0:... 2606:4700:e0::ac40:621c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:824::2002	15169 (GOOGLE) (GOOGLE)
8	2600:9000:215... 2600:9000:2156:4c00:2:9275:3d40:93a1	16509 (AMAZON-02) (AMAZON-02)
10	2600:9000:20e... 2600:9000:20eb:e000:0:5c46:4f40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:817::2004	15169 (GOOGLE) (GOOGLE)
2 11	2a00:1450:400... 2a00:1450:4001:81a::2004	15169 (GOOGLE) (GOOGLE)
7	172.217.21.226 172.217.21.226	15169 (GOOGLE) (GOOGLE)
3	65.9.24.128 65.9.24.128	16509 (AMAZON-02) (AMAZON-02)
1 4	151.101.114.137 151.101.114.137	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:80b::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:814::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:816::200e	15169 (GOOGLE) (GOOGLE)
1 3	2620:116:800d... 2620:116:800d:21:5a23:9c4e:e774:96c1	16509 (AMAZON-02) (AMAZON-02)
1	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:4001:806::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c07::9d	15169 (GOOGLE) (GOOGLE)
1	2600:9000:20d... 2600:9000:20d7:7a00:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
1	2a00:1450:400... 2a00:1450:4001:801::2003	15169 (GOOGLE) (GOOGLE)
9	52.14.222.78 52.14.222.78	16509 (AMAZON-02) (AMAZON-02)
1	35.158.194.251 35.158.194.251	16509 (AMAZON-02) (AMAZON-02)
2 6	185.33.221.91 185.33.221.91	29990 (ASN-APPNEX) (ASN-APPNEX)
1	54.246.70.54 54.246.70.54	16509 (AMAZON-02) (AMAZON-02)
1 2	72.251.249.14 72.251.249.14	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
1	104.111.215.135 104.111.215.135	16625 (AKAMAI-AS) (AKAMAI-AS)
6	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1	165.227.252.242 165.227.252.242	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
3	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
10 15	2606:2800:233... 2606:2800:233:97b6:26be:138a:cba8:bb01	15133 (EDGECAST) (EDGECAST)
5	136.144.59.88 136.144.59.88	54825 (PACKET) (PACKET)
4	69.173.144.140 69.173.144.140	26667 (RUBICONPR...) (RUBICONPROJECT)
1	64.140.160.2 64.140.160.2	18450 (WEBNX) (WEBNX)
1	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
1 2	52.95.124.170 52.95.124.170	16509 (AMAZON-02) (AMAZON-02)
11	151.101.194.137 151.101.194.137	54113 (FASTLY) (FASTLY)
1 9	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80b::2001	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f02... 2a03:2880:f02d:e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	199.232.53.140 199.232.53.140	54113 (FASTLY) (FASTLY)
1	3.124.44.162 3.124.44.162	16509 (AMAZON-02) (AMAZON-02)
1 6	23.210.249.164 23.210.249.164	16625 (AKAMAI-AS) (AKAMAI-AS)
31	2a00:1450:400... 2a00:1450:4001:800::2001	15169 (GOOGLE) (GOOGLE)
16	2a00:1450:400... 2a00:1450:4001:814::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81f::200a	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:820::200a	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:815::2003	15169 (GOOGLE) (GOOGLE)
7	65.9.20.54 65.9.20.54	16509 (AMAZON-02) (AMAZON-02)
3	23.210.249.92 23.210.249.92	16625 (AKAMAI-AS) (AKAMAI-AS)
3	23.210.249.83 23.210.249.83	16625 (AKAMAI-AS) (AKAMAI-AS)
2 3	54.229.128.207 54.229.128.207	16509 (AMAZON-02) (AMAZON-02)
2 6	35.156.106.231 35.156.106.231	16509 (AMAZON-02) (AMAZON-02)
2 2	151.101.14.49 151.101.14.49	54113 (FASTLY) (FASTLY)
2	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1288:110... 2a00:1288:110:c305::8000	34010 (YAHOO-IRD) (YAHOO-IRD)
1 1	172.217.22.98 172.217.22.98	15169 (GOOGLE) (GOOGLE)
1	2620:1ec:bdf::10 2620:1ec:bdf::10	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	134.209.131.220 134.209.131.220	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	205.185.216.42 205.185.216.42	20446 (HIGHWINDS3) (HIGHWINDS3)
1	104.111.230.142 104.111.230.142	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	52.58.138.20 52.58.138.20	16509 (AMAZON-02) (AMAZON-02)
1	37.157.2.237 37.157.2.237	198622 (ADFORM) (ADFORM)
1 1	185.86.138.131 185.86.138.131	201081 (SMARTADSE...) (SMARTADSERVER)
1	2a02:fa8:8806... 2a02:fa8:8806:20::2010	41041 (VCLK-EU-) (VCLK-EU-)
253	64

18 35.173.160.135 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-160-135.compute-1.amazonaws.com

threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
kasperskycontenthub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 65.9.20.101 (Seattle, United States)

ASN16509 (AMAZON-02, US)

tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700:e0::ac40:621c (United States)

ASN13335 (CLOUDFLARENET, US)

qd.admetricspro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:824::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:2156:4c00:2:9275:3d40:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2600:9000:20eb:e000:0:5c46:4f40:93a1 (United States)

ASN16509 (AMAZON-02, US)

media.threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:817::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:81a::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 172.217.21.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s13-in-f226.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 65.9.24.128 (Seattle, United States)

ASN16509 (AMAZON-02, US)

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.114.137 (Frankfurt am Main, Germany) 1 redirects

ASN54113 (FASTLY, US)

cd.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cds.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:816::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:116:800d:21:5a23:9c4e:e774:96c1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c07::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20d7:7a00:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 52.14.222.78 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-14-222-78.us-east-2.compute.amazonaws.com

capi.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.158.194.251 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-158-194-251.eu-central-1.compute.amazonaws.com

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 185.33.221.91 (Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.246.70.54 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-246-70-54.eu-west-1.compute.amazonaws.com

ads.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 72.251.249.14 (Amsterdam, Netherlands) 1 redirects

ASN29791 (VOXEL-DOT-NET, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.215.135 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-135.deploy.static.akamaitechnologies.com

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 35.244.159.8 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

teachingaids-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eu-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 165.227.252.242 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

e.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2606:2800:233:97b6:26be:138a:cba8:bb01 (United States) 10 redirects

ASN15133 (EDGECAST, US)

adserver-us.adtech.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 136.144.59.88 (United States)

ASN54825 (PACKET, US)

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 69.173.144.140 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.140.160.2 (Los Angeles, United States)

ASN18450 (WEBNX, US)

geo.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.95.124.170 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

aax-eu.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 151.101.194.137 (United States)

ASN54113 (FASTLY, US)

vid.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ddfc2cf2e1ffe31253d42116313ebe73.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f02d:e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.53.140 (United States)

ASN54113 (FASTLY, US)

www.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.124.44.162 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-44-162.eu-central-1.compute.amazonaws.com

ads.adaptv.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 23.210.249.164 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-249-164.deploy.static.akamaitechnologies.com

as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

31 2a00:1450:4001:800::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:814::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:820::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:815::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 65.9.20.54 (Seattle, United States)

ASN16509 (AMAZON-02, US)

math-aids-threatpost-tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.210.249.92 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-249-92.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.210.249.83 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-249-83.deploy.static.akamaitechnologies.com

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.229.128.207 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-229-128-207.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 35.156.106.231 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-156-106-231.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.14.49 (Frankfurt am Main, Germany) 2 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.126.56.137 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:110:c305::8000 (United Kingdom)

ASN34010 (YAHOO-IRD, GB)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.22.98 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s18-in-f98.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:bdf::10 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

public.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 134.209.131.220 (North Bergen, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

sync.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.216.42 (Phoenix, United States)

ASN20446 (HIGHWINDS3, US)
PTR: map2.hwcdn.net

serverbid-sync.nyc3.cdn.digitaloceanspaces.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.230.142 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-230-142.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.58.138.20 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.2.237 (Denmark)

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.86.138.131 (France) 1 redirects

ASN201081 (SMARTADSERVER, FR)

ssbsync-global.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:20::2010 (Sweden)

ASN41041 (VCLK-EU-, SE)

aol-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
36	googlesyndication.com ddfc2cf2e1ffe31253d42116313ebe73.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	411 KB
35	threatpost.com threatpost.com assets.threatpost.com media.threatpost.com	714 KB
24	connatix.com 1 redirects cd.connatix.com cds.connatix.com capi.connatix.com vid.connatix.com img.connatix.com	1 MB
22	advertising.com 12 redirects adserver-us.adtech.advertising.com ads.adaptv.advertising.com pixel.advertising.com	11 KB
18	adlightning.com tagan.adlightning.com math-aids-threatpost-tagan.adlightning.com	256 KB
16	ampproject.org cdn.ampproject.org	336 KB
13	google.com 2 redirects www.google.com adservice.google.com	3 KB
12	doubleclick.net 2 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net	127 KB
9	adnxs.com 2 redirects ib.adnxs.com acdn.adnxs.com	5 KB
9	gstatic.com www.gstatic.com fonts.gstatic.com	351 KB
7	admetricspro.com qd.admetricspro.com	293 KB
6	googleapis.com fonts.googleapis.com	4 KB
6	pubmatic.com hbopenbid.pubmatic.com ads.pubmatic.com	233 B
6	openx.net teachingaids-d.openx.net u.openx.net eu-u.openx.net	1 KB
5	rubiconproject.com fastlane.rubiconproject.com eus.rubiconproject.com	7 KB
5	a-mo.net prebid.a-mo.net	1 KB
5	amazon-adsystem.com 1 redirects c.amazon-adsystem.com aax-eu.amazon-adsystem.com	34 KB
4	casalemedia.com 1 redirects htlb.casalemedia.com as-sec.casalemedia.com ssum.casalemedia.com	4 KB
3	yahoo.com ups.analytics.yahoo.com pr-bh.ybp.yahoo.com	3 KB
3	adsrvr.org 2 redirects match.adsrvr.org	1 KB
3	indexww.com js-sec.indexww.com
3	3lift.com 1 redirects tlx.3lift.com eb2.3lift.com	621 B
3	quantserve.com 1 redirects secure.quantserve.com pixel.quantserve.com	9 KB
3	google-analytics.com www.google-analytics.com	19 KB
3	googletagservices.com www.googletagservices.com	73 KB
2	everesttech.net 2 redirects sync-tm.everesttech.net	652 B
2	serverbid.com 1 redirects e.serverbid.com sync.serverbid.com	267 B
2	lijit.com 1 redirects ap.lijit.com	1 KB
2	servenobid.com ads.servenobid.com public.servenobid.com	475 B
2	google.de www.google.de adservice.google.de	938 B
1	dotomi.com aol-match.dotomi.com	103 B
1	smartadserver.com 1 redirects ssbsync-global.smartadserver.com	355 B
1	adform.net c1.adform.net	187 B
1	digitaloceanspaces.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1	reddit.com www.reddit.com	1 KB
1	linkedin.com www.linkedin.com
1	facebook.com graph.facebook.com	412 B
1	twitter.com analytics.twitter.com	653 B
1	ipify.org geo.ipify.org	1 KB
1	t.co t.co	449 B
1	quantcount.com rules.quantcount.com	358 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	googletagmanager.com www.googletagmanager.com	49 KB
1	kasperskycontenthub.com kasperskycontenthub.com	399 B
253	44

	Domain	Requested by
31	tpc.googlesyndication.com	tagan.adlightning.com threatpost.com cdn.ampproject.org
17	threatpost.com	threatpost.com
16	cdn.ampproject.org	threatpost.com
15	adserver-us.adtech.advertising.com	10 redirects threatpost.com
12	www.google.com	2 redirects threatpost.com tagan.adlightning.com
11	tagan.adlightning.com	threatpost.com tagan.adlightning.com
10	media.threatpost.com	threatpost.com
9	vid.connatix.com	cd.connatix.com
9	capi.connatix.com	cd.connatix.com
8	assets.threatpost.com	threatpost.com assets.threatpost.com
7	math-aids-threatpost-tagan.adlightning.com	tagan.adlightning.com
7	fonts.gstatic.com	fonts.googleapis.com
7	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net threatpost.com
7	qd.admetricspro.com	threatpost.com qd.admetricspro.com
6	pixel.advertising.com	2 redirects
6	fonts.googleapis.com	threatpost.com
6	ib.adnxs.com	2 redirects qd.admetricspro.com cds.connatix.com
5	prebid.a-mo.net	qd.admetricspro.com
4	pagead2.googlesyndication.com	securepubads.g.doubleclick.net
4	fastlane.rubiconproject.com	qd.admetricspro.com
3	match.adsrvr.org	2 redirects
3	acdn.adnxs.com	cds.connatix.com qd.admetricspro.com
3	js-sec.indexww.com	cds.connatix.com qd.admetricspro.com
3	ads.pubmatic.com	cds.connatix.com qd.admetricspro.com
3	hbopenbid.pubmatic.com	qd.admetricspro.com cds.connatix.com
3	teachingaids-d.openx.net	qd.admetricspro.com cds.connatix.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com threatpost.com
3	cds.connatix.com	threatpost.com tagan.adlightning.com cd.connatix.com
3	c.amazon-adsystem.com	qd.admetricspro.com c.amazon-adsystem.com
3	www.googletagservices.com	threatpost.com tagan.adlightning.com securepubads.g.doubleclick.net
2	eb2.3lift.com	1 redirects qd.admetricspro.com
2	cm.g.doubleclick.net	2 redirects
2	ups.analytics.yahoo.com
2	sync-tm.everesttech.net	2 redirects
2	u.openx.net	cds.connatix.com
2	googleads.g.doubleclick.net	threatpost.com
2	as-sec.casalemedia.com	cds.connatix.com
2	img.connatix.com	threatpost.com
2	aax-eu.amazon-adsystem.com	1 redirects tagan.adlightning.com
2	ap.lijit.com	1 redirects qd.admetricspro.com
2	pixel.quantserve.com	1 redirects threatpost.com
2	www.gstatic.com	www.google.com
1	ssum.casalemedia.com	1 redirects
1	aol-match.dotomi.com
1	ssbsync-global.smartadserver.com	1 redirects
1	c1.adform.net
1	eu-u.openx.net	qd.admetricspro.com
1	eus.rubiconproject.com	qd.admetricspro.com
1	serverbid-sync.nyc3.cdn.digitaloceanspaces.com	qd.admetricspro.com
1	sync.serverbid.com	1 redirects
1	public.servenobid.com	qd.admetricspro.com
1	pr-bh.ybp.yahoo.com
1	ads.adaptv.advertising.com	cds.connatix.com
1	www.reddit.com	threatpost.com
1	www.linkedin.com	threatpost.com
1	graph.facebook.com	threatpost.com
1	ddfc2cf2e1ffe31253d42116313ebe73.safeframe.googlesyndication.com	tagan.adlightning.com
1	adservice.google.com	tagan.adlightning.com
1	adservice.google.de	tagan.adlightning.com
1	analytics.twitter.com	tagan.adlightning.com
1	geo.ipify.org	qd.admetricspro.com
1	e.serverbid.com	qd.admetricspro.com
1	htlb.casalemedia.com	qd.admetricspro.com
1	ads.servenobid.com	qd.admetricspro.com
1	tlx.3lift.com	qd.admetricspro.com
1	www.google.de	threatpost.com
1	t.co	threatpost.com
1	rules.quantcount.com	secure.quantserve.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	static.ads-twitter.com	www.googletagmanager.com
1	secure.quantserve.com	www.googletagmanager.com
1	www.googletagmanager.com	threatpost.com
1	kasperskycontenthub.com	threatpost.com
1	cd.connatix.com	1 redirects
253	74

This site contains no links.

Subject Issuer	Validity	Valid
threatpost.com DigiCert SHA2 Secure Server CA	`2020-06-10` - `2021-06-15`	a year	crt.sh
*.adlightning.com Amazon	`2020-07-22` - `2021-08-22`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-10` - `2021-08-10`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
assets.threatpost.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
media.threatpost.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2020-08-04` - `2021-08-02`	a year	crt.sh
*.connatix.com Go Daddy Secure Certificate Authority - G2	`2020-09-29` - `2021-10-19`	a year	crt.sh
kasperskycontenthub.com DigiCert SHA2 Secure Server CA	`2020-06-01` - `2021-06-09`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
www.google.de GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.3lift.com Amazon	`2020-07-04` - `2021-08-05`	a year	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.servenobid.com Amazon	`2020-03-12` - `2021-04-12`	a year	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2020-03-11` - `2021-05-10`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2020-06-18` - `2021-08-17`	a year	crt.sh
e.serverbid.com Let's Encrypt Authority X3	`2020-09-18` - `2020-12-17`	3 months	crt.sh
*.pubmatic.com Sectigo RSA Organization Validation Secure Server CA	`2019-02-22` - `2021-02-21`	2 years	crt.sh
*.adtech.advertising.com DigiCert SHA2 Secure Server CA	`2020-04-16` - `2022-04-21`	2 years	crt.sh
*.a-mo.net Let's Encrypt Authority X3	`2020-10-07` - `2021-01-05`	3 months	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
*.ipify.org COMODO RSA Domain Validation Secure Server CA	`2018-01-24` - `2021-01-23`	3 years	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
aax-eu.amazon-adsystem.com Amazon	`2020-06-15` - `2021-06-15`	a year	crt.sh
*.google.de GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.googleusercontent.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2020-10-02` - `2021-04-02`	6 months	crt.sh
*.reddit.com DigiCert SHA2 Secure Server CA	`2020-08-26` - `2021-02-22`	6 months	crt.sh
*.v.ssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-07-29` - `2021-01-25`	6 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
misc-sni.google.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
cdn.adnxs.com GeoTrust RSA CA 2018	`2020-01-02` - `2021-04-02`	a year	crt.sh
pixel.advertising.com DigiCert SHA2 High Assurance Server CA	`2020-10-04` - `2021-03-31`	6 months	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-10-24` - `2021-04-20`	6 months	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-06-02` - `2020-11-29`	6 months	crt.sh
public.servenobid.com DigiCert SHA2 Secure Server CA	`2020-08-26` - `2021-08-25`	a year	crt.sh
*.nyc3.cdn.digitaloceanspaces.com DigiCert SHA2 Secure Server CA	`2020-03-11` - `2021-04-14`	a year	crt.sh
track.adform.net DigiCert SHA2 Secure Server CA	`2019-09-16` - `2021-09-20`	2 years	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2019-06-19` - `2021-08-31`	2 years	crt.sh

This page contains 28 frames:

Primary Page: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Frame ID: D44C5C5711CFDACBFC0E783B878E000A
Requests: 112 HTTP requests in this frame

Frame: https://cds.connatix.com/p/72327/connatix.player.dc.js
Frame ID: 52B6CF0E00A2EAC66BC1F00DC97CE37F
Requests: 30 HTTP requests in this frame

Frame: https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=cnv_an-db5&dcc=t
Frame ID: 57E2EDEE2536A2015FCD69B3037CC8A8
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&theme=standard&size=normal&cb=pnszvq2ytjl2
Frame ID: F96B2F4986E61A75F22DC29DB7DBD790
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&theme=light&size=normal&cb=xmkv503p0w6u
Frame ID: 1E3A7419DD7386188C6EC78F5E1417C6
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=h0e8beelimqh
Frame ID: D866763B8FF25FFC5D0246F8E3886A1F
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=jfsh24orl9f
Frame ID: AD0A8968BB32CD21E405E623AF3AE7F9
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-bb7a25fb.js
Frame ID: 29CEFC553681A7C4095BA4450883704D
Requests: 24 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-bb7a25fb.js
Frame ID: 5535E1F89C764CA50F34A58B63C5197D
Requests: 23 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-bb7a25fb.js
Frame ID: 1DA5264C6786B4FB362D90899BE7F2BE
Requests: 26 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-bb7a25fb.js
Frame ID: B4A2357244050FC3E18B7EDC78CB7206
Requests: 17 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html
Frame ID: EF5D8BE55D453186E85AB5BABBB11E8B
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 7072DA1E29941614ED17DC6358896DD0
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd
Frame ID: DBC8F0EB8357C49616C4A1C34F7B9E8E
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: F31368B207CEE209E4B6A88528F741A3
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd
Frame ID: 0862AC80DC06FB60FDDDE2B942536EE1
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: FF24851998D7DA391F13245C755E453F
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 0D4C16FD149F4D3B1F8EA4BD5CC2BFAE
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: AB474E676BAE6C352E123BF2AD0B309D
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 94057FE4A00DDD6763D353CFDB46D749
Requests: 1 HTTP requests in this frame

Frame: https://public.servenobid.com/sync.html
Frame ID: 6D2001844FC622483F2A67BD046A362C
Requests: 1 HTTP requests in this frame

Frame: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Frame ID: FC30F090CB4FCC29A0459CBC8480A00C
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: 281E031DEAF5E158DF9341689DF53183
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: C98B2E929D04816985BE05D364A7F1C1
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Frame ID: AB26F3D758E5D95053B97A40D6C8FD1C
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 3318348DC6FF67E6913A5F1CB9560ECB
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: C313D94EAEBAD9F62D09E0C75D7948A6
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 393818CBAE9F16A29B68C440732D741A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

253
Requests

100 %
HTTPS

42 %
IPv6

44
Domains

74
Subdomains

64
IPs

9
Countries

3879 kB
Transfer

8774 kB
Size

8
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 25

https://cd.connatix.com/connatix.player.js HTTP 302
https://cds.connatix.com/p/72327/connatix.player.dc.js

Request Chain 75

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=580df98f9fe16e1;misc=1604093584987; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;cfp=1;rndc=1604093584;v=2;cmd=bid;cors=yes;alias=580df98f9fe16e1;misc=1604093584987 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A7ecd6cfc-1af7-11eb-b364-126de4777bf4;cfp=1;rndc=1604093584;v=2;cmd=bid;cors=yes;alias=580df98f9fe16e1;misc=1604093584987

Request Chain 76

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=597f4bc464a3fe;misc=1604093584987; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1604093584;v=2;cmd=bid;cors=yes;alias=597f4bc464a3fe;misc=1604093584987 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A7ecdb1d0-1af7-11eb-9d42-126272b4dea0;cfp=1;rndc=1604093585;v=2;cmd=bid;cors=yes;alias=597f4bc464a3fe;misc=1604093584987

Request Chain 77

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=60db2c6d533c3fd;misc=1604093584987; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1604093584;v=2;cmd=bid;cors=yes;alias=60db2c6d533c3fd;misc=1604093584987 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A7ecdc18e-1af7-11eb-a525-12eca44d2d72;cfp=1;rndc=1604093584;v=2;cmd=bid;cors=yes;alias=60db2c6d533c3fd;misc=1604093584987

Request Chain 78

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=61c8029ad8cac3d;misc=1604093584987; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1604093584;v=2;cmd=bid;cors=yes;alias=61c8029ad8cac3d;misc=1604093584987 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A7ecdc242-1af7-11eb-aed9-126272b4dea0;cfp=1;rndc=1604093585;v=2;cmd=bid;cors=yes;alias=61c8029ad8cac3d;misc=1604093584987

Request Chain 79

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=627ab418d335cdf;misc=1604093584987; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;cfp=1;rndc=1604093584;v=2;cmd=bid;cors=yes;alias=627ab418d335cdf;misc=1604093584987 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A7ecdc954-1af7-11eb-8221-12724de64e5e;cfp=1;rndc=1604093585;v=2;cmd=bid;cors=yes;alias=627ab418d335cdf;misc=1604093584987

Request Chain 91

https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=cnv_an-db5 HTTP 302
https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=cnv_an-db5&dcc=t

Request Chain 193

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 200

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 232

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://pixel.advertising.com/ups/55953/sync?uid=e029b187-f4c1-4d31-9bd9-9100b93ce7cb&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=e029b187-f4c1-4d31-9bd9-9100b93ce7cb

Request Chain 233

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent= HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_test=X5yGlQAAALBxxSzr HTTP 302
https://pixel.advertising.com/ups/55986/sync?uid=X5yGlQAAALBxxSzr&_origin=0&gdpr=0&gdpr_consent=&_test=X5yGlQAAALBxxSzr HTTP 302
https://ups.analytics.yahoo.com/ups/55986/sync?uid=X5yGlQAAALBxxSzr&_origin=0&gdpr=0&gdpr_consent=&_test=X5yGlQAAALBxxSzr&apid=1A7ecdc954-1af7-11eb-8221-12724de64e5e

Request Chain 235

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc HTTP 302
https://pixel.advertising.com/ups/57304/sync?uid=CAESEMxggaSNfnTNzKp1f4N_Qr0&google_cver=1 HTTP 302
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEMxggaSNfnTNzKp1f4N_Qr0&google_cver=1&apid=1A7ecdc954-1af7-11eb-8221-12724de64e5e

Request Chain 237

https://sync.serverbid.com/ss/2000891.html HTTP 302
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Request Chain 239

https://eb2.3lift.com/sync HTTP 302
https://eb2.3lift.com/sync?&ld=1

Request Chain 244

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D86b9a153-a242-4608-9453-d46185baaaf3%26D%3D%26bidder%3Dappnexus%26uid%3D%24UID HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fprebid.a-mo.net%252Fsetuid%253FA%253D86b9a153-a242-4608-9453-d46185baaaf3%2526D%253D%2526bidder%253Dappnexus%2526uid%253D%2524UID HTTP 302
https://prebid.a-mo.net/setuid?A=86b9a153-a242-4608-9453-d46185baaaf3&D=&bidder=appnexus&uid=9101200317742800161

Request Chain 246

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent= HTTP 302
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=vzQNhbJkDdanN1WC62QZ1e8zAoWnNgzesmRcpsZF

Request Chain 249

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=false&gdpr_consent=&us_privacy=1---&redirectUri=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D86b9a153-a242-4608-9453-d46185baaaf3%26D%3D%26bidder%3Dsmartadserver%26uid%3D%5Bssb_sync_pid%5D HTTP 302
https://prebid.a-mo.net/setuid?A=86b9a153-a242-4608-9453-d46185baaaf3&D=&bidder=smartadserver&uid=8212392075593889733

Request Chain 251

https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D86b9a153-a242-4608-9453-d46185baaaf3%26D%3D%26bidder%3Dindex_rtb%26uid%3D HTTP 302
https://prebid.a-mo.net/setuid?A=86b9a153-a242-4608-9453-d46185baaaf3&D=&bidder=index_rtb&uid=X5yGkeyUorqmdH4ySV0EAQAA%261208

Request Chain 252

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D86b9a153-a242-4608-9453-d46185baaaf3%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID HTTP 307
https://prebid.a-mo.net/setuid?A=86b9a153-a242-4608-9453-d46185baaaf3&D=&bidder=sovrn&uid=2a7dc972243b036c5b9bef9b

Request Chain 253

https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_cm&google_hm=MUE3ZWNkNmNmYy0xYWY3LTExZWItYjM2NC0xMjZkZTQ3NzdiZjQ%3D&gdpr=1&gdpr_consent=&_origin=0 HTTP 302
https://pixel.advertising.com/ups/55946/sync?uid=CAESEH0SDcnxNvaLIvFsWoyJbj8&gdpr=1&gdpr_consent=&_origin=0&google_cver=1

253 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/ 79 KB
21 KB 1062ms
653ms Document
text/html 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-160-135.compute-1.amazonaws.com

Software

nginx /

Resource Hash

6bf0418d93ba354d8bcfd041b6ee0916e99999350ca92ab6eed7849efc07b71f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Host: threatpost.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: nginx
Date: Fri, 30 Oct 2020 21:33:03 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Link: <https://threatpost.com/wp-json/>; rel="https://api.w.org/" <https://threatpost.com/wp-json/wp/v2/posts/156669>; rel="alternate"; type="application/json" <https://threatpost.com/?p=156669>; rel=shortlink
X-Frame-Options: SAMEORIGIN
X-Debug-Auth: off
X-Request-Host: threatpost.com
x-cache-hit: MISS
Content-Encoding: gzip

GET
H/1.1 200
OK main.css
threatpost.com/wp-content/themes/threatpost-2018/assets/css/ 253 KB
39 KB 390ms
129ms Stylesheet
text/css 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 41f3222c29889fb48f5dca1d481858e5339a759655510c256ef4edf56c80f7f5

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Fri, 30 Oct 2020 21:33:03 GMT
Content-Encoding: gzip
Last-Modified: Mon, 26 Oct 2020 10:43:09 GMT
Server: nginx
ETag: W/"5f96a83d-3f2b8"
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=604800, public
Connection: close
Expires: Fri, 06 Nov 2020 21:33:03 GMT

GET
H2 200 op.js Show response
tagan.adlightning.com/math-aids-threatpost/ 37 KB
14 KB 202ms
79ms Script
application/javascript 65.9.20.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.20.101 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4f558393e128fdda4f7e8cbbc093344c70d0872364c1c0a68de9910ed31b6399

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 20:50:00 GMT
content-encoding: gzip
age: 2584
x-cache: Hit from cloudfront
status: 200
content-length: 13448
x-amz-meta-git_commit: 9a4f7ce
last-modified: Fri, 30 Oct 2020 16:49:13 GMT
server: AmazonS3
etag: "32d49cd05695907d965952d85cb84b58"
x-amz-version-id: jRYbxfoEDnkEJc_xRZWu9ouht7bHeloK
via: 1.1 b8c21c40c485a68c7663b93787f93464.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: KcumDxFKjWwl76gbQaXmUPZvg25J6XPr28rZ0utqAQaU7P3X1xmhcQ==

GET
H2 200 ros-layout.js Show response
qd.admetricspro.com/js/threatpost/ 22 KB
3 KB 59ms
17ms Script
application/javascript 2606:4700:e0::ac40:621c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:621c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e2b472509d9e149690aba45c5917ebdd2f52471b98d414c2726301b90e08f21

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:03 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 486
status: 200
cf-request-id: 061d06b8f00000c26d3bac8000000001
last-modified: Thu, 06 Aug 2020 02:14:13 GMT
server: cloudflare
etag: W/"579e-5ac2c0b6aa2e7-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=yHPIXGXfxeo4POALrmjoiri3hfkqymHi3kjrW0J6geDPPcmVDF7qFIIrSguNswsC819OvEELeGiJWbJcGBYPDwY17KZ3sJHuubpR8MRsfiM%2FEdUt16hNwtJc%2F20LRZ8k"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5ea840a17f2ec26d-FRA
expires: Fri, 30 Oct 2020 21:29:41 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 53 KB
18 KB 22ms
14ms Script
text/javascript 2a00:1450:4001:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ddebf92941e44fb51a5a2c46eabc1238735a5f7ea170fe7387cd7ce5c83025d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "679 / 986 of 1000 / last-modified: 1604087662"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 17880
x-xss-protection: 0
expires: Fri, 30 Oct 2020 21:33:03 GMT

GET
H2 200 cmp.js Show response
qd.admetricspro.com/js/threatpost/ 305 KB
82 KB 80ms
40ms Script
application/javascript 2606:4700:e0::ac40:621c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:621c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 73339d824e344121a3039b2e0e9c9353fb8132e005bb6d53249814c213520d5d

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:03 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 486
status: 200
cf-request-id: 061d06b8f00000c26d4dae7000000001
last-modified: Tue, 06 Oct 2020 19:53:29 GMT
server: cloudflare
etag: W/"4c426-5b105f3f297c7-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=HsXP37%2Bu6BHNPLDahpvhrBTUnvQg6bxjtM8CGj7fJQMYJYZPAltoeeuQtaorYq0IaYd5EYmRkcgBtKjXoT09zqduoCZp%2Fd5VtVFxAIb1XrNW3FxtXm%2BeTFc%2BiF4nSN2v"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5ea840a17f31c26d-FRA
expires: Fri, 30 Oct 2020 21:29:40 GMT

GET
H2 200 uspcmp.js Show response
qd.admetricspro.com/js/threatpost/ 148 KB
55 KB 74ms
34ms Script
application/javascript 2606:4700:e0::ac40:621c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:621c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:03 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 486
status: 200
cf-request-id: 061d06b8f10000c26d2e974000000001
last-modified: Sat, 08 Aug 2020 22:40:07 GMT
server: cloudflare
etag: W/"24e50-5ac65673cef1c-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=lzo%2Bgo%2BRpsdRvjUQI9HTWsAZABXmR04Eozwfkp9cJQQTRoEjLCkrJ41Q0CHfNYE052Cs%2FwIKWhwJ1py5pF5TQKxOi9X67FiEHzFkZeBI8bTPt2Quzj%2B7pThmHmZ1icjU"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5ea840a17f34c26d-FRA
expires: Fri, 30 Oct 2020 21:29:40 GMT

GET
H2 200 targeting.js Show response
qd.admetricspro.com/js/threatpost/ 275 B
463 B 59ms
20ms Script
application/javascript 2606:4700:e0::ac40:621c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/targeting.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:621c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:03 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 486
status: 200
cf-request-id: 061d06b8f10000c26d3c898000000001
last-modified: Sat, 08 Feb 2020 20:49:18 GMT
server: cloudflare
etag: W/"113-59e16a3cfb471-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=28xKXwqwMFp3AUfbctSSl4deu4YN88ahNDC0HZjHG6aG9dKCZLmr8FP6geYQFTWtRs%2BIBbEzvfhybnm9vXZW1HbhGt7SfntfrkIrIpBHmLKoCIFu3%2BoBIiFfOW3jmU0n"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5ea840a17f37c26d-FRA
expires: Fri, 30 Oct 2020 21:26:44 GMT

GET
H2 200 prebid.js Show response
qd.admetricspro.com/js/threatpost/ 399 KB
114 KB 87ms
48ms Script
application/javascript 2606:4700:e0::ac40:621c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:621c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 25d6fd3b4dcdc05593cab2b4157e21194ada84e5b0de832011246e65d15fe8a9

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:03 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 486
status: 200
cf-request-id: 061d06b8f10000c26d3736c000000001
last-modified: Fri, 02 Oct 2020 04:32:28 GMT
server: cloudflare
etag: W/"63c0e-5b0a89ec6a525-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=P1Mx5Kg5SgIH1KAIdxEtVhtad%2BBjXsvaDMwIepDf50LcUPlqtWDB3yDfLoWCLSVCArYctjim6luFuQO8I1DplCtZ%2BkLO3hhFOLVA91PdF75oug6o6nYUmh2C91z0FL2w"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5ea840a17f39c26d-FRA
expires: Fri, 30 Oct 2020 21:26:44 GMT

GET
H2 200 engine.js Show response
qd.admetricspro.com/js/threatpost/ 28 KB
8 KB 60ms
22ms Script
application/javascript 2606:4700:e0::ac40:621c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/engine.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:621c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 747a03fee397ff9cf8a76308966b2cc28f4dd00160af7610bc81ccfcb2836fab

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:03 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 486
status: 200
cf-request-id: 061d06b8f20000c26d651d7000000001
last-modified: Fri, 09 Oct 2020 03:25:52 GMT
server: cloudflare
etag: W/"6e56-5b1348179d4a3-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=OprnE5LC14aId076gmkilyGLxSzQVn9hnzPhWD%2BrrNCyezCN3lQDbdwFMlLjq6Mp%2Bx0MJKA63%2Bmr%2BoiMRNFajv7wmKPWlF98rEZ2FkJcx%2FU6Ltm4Kj2HCpCPLech%2B0m9"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5ea840a18f3bc26d-FRA
expires: Fri, 30 Oct 2020 21:28:24 GMT

GET
H2 200 /
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 89 KB
18 KB 407ms
369ms Stylesheet
text/css 2600:9000:2156:4c00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=c3405af2

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:4c00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

392cc23864e1d5ec27dc6db139581ea3da476624b962fb3b1f866248f554ae64

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:03 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 18335
x-cache-hit: HIT
last-modified: Mon, 26 Oct 2020 10:43:08 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 e6d97713eb9b65f883e0f86b833878dd.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: 8FKf0l0PQV7XB_DfkvIRR6_riN9gVye8jwZlE5D2JjTU0ySd7SLszg==
expires: Sat, 31 Oct 2020 20:12:25 GMT

GET
H/1.1 200
OK jquery.js Show response
threatpost.com/wp-includes/js/jquery/ 95 KB
37 KB 395ms
134ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Fri, 30 Oct 2020 21:33:03 GMT
Content-Encoding: gzip
Last-Modified: Tue, 01 Sep 2020 19:07:35 GMT
Server: nginx
ETag: W/"5f4e9bf7-17a69"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Fri, 06 Nov 2020 21:33:03 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 177 KB
55 KB 407ms
371ms Script
application/x-javascript 2600:9000:2156:4c00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-cookies-notification/scripts/alert_text.js,wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js,wp-content/plugins/honeypot-comments/public/assets/js/public.js,wp-content/plugins/kspr_twitter_pullquote/js/kaspersky-twitter-pullquote.js,wp-content/themes/threatpost-2018/assets/js/main.js,wp-content/themes/threatpost-2018/assets/js/loadmore.js,wp-content/plugins/kaspersky-social-sharing/assets/js/social-share.js&ver=c3405af2

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:4c00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b0209d39595432d762f6ba2a81dc0bffa6a6e1ed9021ba24ffa06c3c7e4bcb02

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:03 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 56256
x-cache-hit: HIT
last-modified: Mon, 26 Oct 2020 10:43:09 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 e6d97713eb9b65f883e0f86b833878dd.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: d5-Wn-ca7nxiJrpMqELgF6t6XQWi1b4UDKaZ_f10FxdlYBPB3Z5-Fg==
expires: Sat, 31 Oct 2020 20:12:24 GMT

GET
H2 200 trojan-malware.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/01/22100148/ 126 KB
126 KB 59ms
33ms Image
image/jpeg 2600:9000:20eb:e000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/01/22100148/trojan-malware.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:e000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4edf4e4d19fa8ec8abf42e728012fb704a7d8e49a25bbf778b77abd20d90b8ce

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 17 Oct 2020 20:21:34 GMT
via: 1.1 1277de71b2472d19ca0bfc510db9ec54.cloudfront.net (CloudFront), 1.1 24c299c0a6423c6f96984a85fb014109.cloudfront.net (CloudFront)
last-modified: Wed, 22 Jan 2020 15:01:49 GMT
server: AmazonS3
age: 1127491
etag: "3f035e1c9c491a99670f6755b2e8e29f"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1, FRA2-C1
accept-ranges: bytes
content-length: 128905
x-amz-cf-id: uMXLzgUVGsVPIeczf50369bqtwoN-7eKeWFyOIrLQz3fMU_p93IsNw==
expires: Thu, 21 Jan 2021 15:01:48 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 850 B
728 B 26ms
25ms Script
text/javascript 2a00:1450:4001:817::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

ba94eaf90519494de4ee847524ee2d3567f8518dbd66dcb0a5f610cee321976d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 554
x-xss-protection: 1; mode=block
expires: Fri, 30 Oct 2020 21:33:04 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 2 KB
1 KB 276ms
276ms Script
application/x-javascript 2600:9000:2156:4c00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/jquery.json.min.js&ver=c3405af2

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:4c00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:04 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 926
x-cache-hit: HIT
last-modified: Mon, 26 Oct 2020 10:43:07 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 e6d97713eb9b65f883e0f86b833878dd.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: KpU4qNDT4XI1mEJO1254BSI5GZqXL_apAejQtkITCXNHhN7w6jVy8w==
expires: Sat, 31 Oct 2020 20:12:24 GMT

GET
H/1.1 200
OK gravityforms.min.js Show response
threatpost.com/wp-content/plugins/gravityforms/js/ 34 KB
12 KB 998ms
127ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.4.17.15
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Fri, 30 Oct 2020 21:33:05 GMT
Content-Encoding: gzip
Last-Modified: Mon, 26 Oct 2020 10:43:07 GMT
Server: nginx
ETag: W/"5f96a83b-88c2"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Fri, 06 Nov 2020 21:33:05 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 7 KB
3 KB 279ms
276ms Script
application/x-javascript 2600:9000:2156:4c00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/conditional_logic.min.js&ver=c3405af2

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:4c00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:04 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 2685
x-cache-hit: HIT
last-modified: Mon, 26 Oct 2020 10:43:18 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 e6d97713eb9b65f883e0f86b833878dd.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: 6ZHc1glyxuriroDzdSIQUDP-0x0ByDUXKldG1aqPYeEscSyBNfJTBw==
expires: Sat, 31 Oct 2020 20:12:27 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 5 KB
2 KB 369ms
366ms Script
application/x-javascript 2600:9000:2156:4c00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/placeholders.jquery.min.js&ver=c3405af2

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:4c00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:04 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 1747
x-cache-hit: HIT
last-modified: Mon, 26 Oct 2020 10:43:07 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 e6d97713eb9b65f883e0f86b833878dd.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: g2Eh2nBiw0J-ZxXBEvEgpYq1LpC8ak-Pq-W06mIfF7j9ARheluQP7Q==
expires: Sat, 31 Oct 2020 20:12:25 GMT

GET
H3-Q050 200 api.js Show response
www.google.com/recaptcha/ 852 B
745 B 19ms
16ms Script
text/javascript 2a00:1450:4001:81a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en&render=explicit&ver=5.5.1

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

4473451078db552a3e4c47e578a385fee86f57ba923d26d0516e2231a81e2a9e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 555
x-xss-protection: 1; mode=block
expires: Fri, 30 Oct 2020 21:33:04 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 2 KB
1 KB 367ms
364ms Script
application/x-javascript 2600:9000:2156:4c00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/js/wp-embed.min.js,wp-content/plugins/akismet/_inc/form.js&ver=c3405af2

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2156:4c00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

21e46fe44c6929876f5a413c843ae516c0ddfd1aad3e8e33446b7bc0a6781b08

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:04 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 973
x-cache-hit: HIT
last-modified: Tue, 01 Sep 2020 19:07:35 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 e6d97713eb9b65f883e0f86b833878dd.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: ljsNEW82dzJlEg7T89oAfO7rM1VcC9Kh0-_V0KvI5Gcr_BdAroeFCQ==
expires: Sat, 31 Oct 2020 20:12:25 GMT

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ 61 KB
21 KB 62ms
60ms Script
application/javascript 65.9.20.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.20.101 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 04:31:24 GMT
content-encoding: gzip
age: 752501
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 b8c21c40c485a68c7663b93787f93464.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: GhiBkDaEYG6y-eMwoxYlRt2xwTmG9rS5qqKi5aOy7DiozYRucwLrQA==

GET
H2 200 bl-04a3385-bb7a25fb.js Show response
tagan.adlightning.com/math-aids-threatpost/ 94 KB
27 KB 83ms
81ms Script
application/javascript 65.9.20.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-bb7a25fb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.20.101 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f40b40ca5f8e9d73bbe3d3c0097d15681646fe084ecfb05d8e02b8f851570048

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 16:49:42 GMT
content-encoding: gzip
age: 17003
x-cache: Hit from cloudfront
status: 200
content-length: 27345
x-amz-meta-git_commit: 04a3385
last-modified: Fri, 30 Oct 2020 16:48:54 GMT
server: AmazonS3
etag: "47670cc31dbcdee64801850ce4f3d0ad"
x-amz-version-id: qaf1kCx.vAnyoj3z.jichs6F9nN3gldQ
via: 1.1 b8c21c40c485a68c7663b93787f93464.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: on5H3z7VIFrlBxh6UN838qga26DuPMb1VeHWi2uN7haC2ZkZ2XIsMg==

GET
H2 200 pubads_impl_2020102601.js Show response
securepubads.g.doubleclick.net/gpt/ 273 KB
96 KB 125ms
44ms Script
text/javascript 172.217.21.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020102601.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.21.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s13-in-f226.1e100.net

Software

sffe /

Resource Hash

3dc07588699fb0adc2702b0e8734bfabdbe45c1838e4fb2884511264bb9ef0a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Fri, 30 Oct 2020 21:33:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 26 Oct 2020 08:41:19 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 98213
x-xss-protection: 0
expires: Fri, 30 Oct 2020 21:33:04 GMT

GET
H2 200 vendor-list.json Show response
qd.admetricspro.com/js/cmp2/ 286 KB
30 KB 178ms
161ms XHR
application/json 2606:4700:e0::ac40:621c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/cmp2/vendor-list.json
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:621c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec95a631650981cd2ff2eecd07118042dee23fc0a3fd6ed70926fa3d94e4e5d3

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:04 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-request-id: 061d06bbfc00001f5549b21000000001
last-modified: Tue, 06 Oct 2020 19:31:27 GMT
server: cloudflare
etag: W/"4773b-5b105a5302c6b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=cbhcVxqx8UscSyHRD77fnl%2FiiT%2BhUddVv3dWp22ekim7AX%2BP9dH5AqDB1kGssZ9SGXJcNyGehTM3s4SgINR5UDUcFoCztrFBASkVGE%2F9JYqFqJHkaQzeuGxADeozRFH0"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=600
cf-ray: 5ea840a6585a1f55-FRA
expires: Fri, 30 Oct 2020 21:43:04 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 114 KB
30 KB 179ms
63ms Script
application/javascript 65.9.24.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/engine.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.24.128 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash: c7714be5150899442faf570cab4e7846a794e81d6b420300148d1f5a9a405c7a

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 19:16:47 GMT
content-encoding: gzip
server: Server
age: 8177
etag: 14b87a812615d68493a97e70b7b323fb
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: jvU76boqH6YHWjnQse4cHVUzxkjwrxsLFZkHXyTzwWtxKDrIxDlfrA==
via: 1.1 924bf9febd74cef2bda62c15c8441e00.cloudfront.net (CloudFront)

GET
H2

200

connatix.player.dc.js Show response
cds.connatix.com/p/72327/ Frame 52B6
Redirect Chain

https://cd.connatix.com/connatix.player.js
https://cds.connatix.com/p/72327/connatix.player.dc.js

893 KB
220 KB

36ms
34ms

Script
application/javascript

151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/72327/connatix.player.dc.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 851acc60822c66c626065b3b7e8f4ff8b465e8b36d27370624adaf04f8b0751e

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:04 GMT
content-encoding: gzip
age: 6023
x-cache: HIT, HIT
status: 200
content-length: 225314
x-served-by: cache-dca17770-DCA, cache-hhn4037-HHN
access-control-allow-origin: *
last-modified: Fri, 30 Oct 2020 19:38:06 GMT
x-timer: S1604093585.563621,VS0,VE0
etag: "fb49ec2899e4190422b221202a633775"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 472

Redirect headers

date: Fri, 30 Oct 2020 21:33:04 GMT
via: 1.1 varnish
server: Varnish
age: 0
x-served-by: cache-hhn4037-HHN
status: 302
x-cache: HIT
location: https://cds.connatix.com/p/72327/connatix.player.dc.js
cache-control: no-cache, no-store, must-revalidate, max-age=0
accept-ranges: bytes
x-timer: S1604093585.503911,VS0,VE0
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1 200
OK / Show response
kasperskycontenthub.com/ 0
399 B 573ms
175ms Script
application/javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://kasperskycontenthub.com/?dm=ed1f9e435dc885292eab65620c51f3fb&action=load&blogid=103&siteid=1&t=773882171&back=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-160-135.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 30 Oct 2020 21:33:04 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: SAMEORIGIN
Connection: close
Content-Type: application/javascript
x-cache-hit: MISS
Transfer-Encoding: chunked
X-Debug-Auth: off
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Request-Host: kasperskycontenthub.com
X-XSS-Protection: 1; mode=block

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 152 KB
49 KB 29ms
27ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

960d6f50ac3a8e11b5ab68b5a561e0b330a5a9faec638023b9c8d3f1a4465711

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:04 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49584
x-xss-protection: 0
last-modified: Fri, 30 Oct 2020 21:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 30 Oct 2020 21:33:04 GMT

GET
H/1.1 200
OK icons.svg
threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/ 13 KB
5 KB 886ms
126ms Other
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/icons.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Fri, 30 Oct 2020 21:33:05 GMT
Content-Encoding: gzip
Last-Modified: Mon, 26 Oct 2020 10:43:08 GMT
Server: nginx
ETag: W/"5f96a83c-3496"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Fri, 06 Nov 2020 21:33:05 GMT

GET
H/1.1 200
OK icons.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/ 13 KB
5 KB 886ms
132ms Other
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Fri, 30 Oct 2020 21:33:05 GMT
Content-Encoding: gzip
Last-Modified: Mon, 26 Oct 2020 10:43:20 GMT
Server: nginx
ETag: W/"5f96a848-3496"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Fri, 06 Nov 2020 21:33:05 GMT

GET
H/1.1 200
OK logo.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 19 KB
19 KB 909ms
137ms Image
image/png 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Fri, 30 Oct 2020 21:33:05 GMT
Last-Modified: Mon, 26 Oct 2020 10:43:20 GMT
Server: nginx
ETag: "5f96a848-4a32"
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 18994
Expires: Fri, 06 Nov 2020 21:33:05 GMT

GET
H/1.1 200
OK museosans-700-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 270ms
135ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Fri, 30 Oct 2020 21:33:04 GMT
Last-Modified: Mon, 26 Oct 2020 10:43:08 GMT
Server: nginx
ETag: "5f96a83c-51a4"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20900
Expires: Sat, 30 Oct 2021 21:33:04 GMT

GET
H/1.1 200
OK museosans-100-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 470ms
224ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Fri, 30 Oct 2020 21:33:04 GMT
Last-Modified: Mon, 26 Oct 2020 10:43:08 GMT
Server: nginx
ETag: "5f96a83c-50c8"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20680
Expires: Sat, 30 Oct 2021 21:33:04 GMT

GET
H/1.1 200
OK museosans-300-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 378ms
132ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Fri, 30 Oct 2020 21:33:04 GMT
Last-Modified: Mon, 26 Oct 2020 10:43:08 GMT
Server: nginx
ETag: "5f96a83c-51b8"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20920
Expires: Sat, 30 Oct 2021 21:33:04 GMT

GET
H/1.1 200
OK museosans-500-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 491ms
236ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Fri, 30 Oct 2020 21:33:04 GMT
Last-Modified: Mon, 26 Oct 2020 10:43:08 GMT
Server: nginx
ETag: "5f96a83c-5194"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20884
Expires: Sat, 30 Oct 2021 21:33:04 GMT

GET
H/1.1 200
OK museosans-700italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 15 KB
16 KB 484ms
228ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Fri, 30 Oct 2020 21:33:04 GMT
Last-Modified: Mon, 26 Oct 2020 10:43:08 GMT
Server: nginx
ETag: "5f96a83c-3dcc"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 15820
Expires: Sat, 30 Oct 2021 21:33:04 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/ 343 KB
135 KB 25ms
6ms Script
text/javascript 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84aff23bb47fbea74e9c9944cc840a4c17dbf1c32fc9f6a5c4717417e02751c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:15:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1072
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 137574
x-xss-protection: 0
last-modified: Mon, 26 Oct 2020 04:07:53 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 30 Oct 2021 21:15:12 GMT

GET
H/1.1 200
OK mail-plane-light.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 828 B
722 B 794ms
130ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-light.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Fri, 30 Oct 2020 21:33:05 GMT
Content-Encoding: gzip
Last-Modified: Mon, 26 Oct 2020 10:43:20 GMT
Server: nginx
ETag: W/"5f96a848-33c"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Fri, 06 Nov 2020 21:33:05 GMT

GET
H/1.1 200
OK twitter-blue.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 868 B
847 B 704ms
130ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/twitter-blue.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Fri, 30 Oct 2020 21:33:05 GMT
Content-Encoding: gzip
Last-Modified: Mon, 26 Oct 2020 10:43:08 GMT
Server: nginx
ETag: W/"5f96a83c-364"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Fri, 06 Nov 2020 21:33:05 GMT

GET
H/1.1 200
OK museosans-300italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 23 KB
23 KB 337ms
130ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300italic-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Fri, 30 Oct 2020 21:33:04 GMT
Last-Modified: Mon, 26 Oct 2020 10:43:08 GMT
Server: nginx
ETag: "5f96a83c-5bac"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 23468
Expires: Sat, 30 Oct 2021 21:33:04 GMT

GET
H2 200 Tara-headshot.jpg
media.threatpost.com/wp-content/uploads/sites/103/2018/08/15114841/ 13 KB
13 KB 12ms
10ms Image
image/jpeg 2600:9000:20eb:e000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2018/08/15114841/Tara-headshot.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:e000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 89ce08431545cd3c6d42419d99ee0152027a68c1d0c7c82838cc9a51d9d52451

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 01 Oct 2020 00:04:39 GMT
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront), 1.1 24c299c0a6423c6f96984a85fb014109.cloudfront.net (CloudFront)
last-modified: Fri, 17 Aug 2018 16:22:08 GMT
server: AmazonS3
age: 2582906
etag: "dee18dfeea6de13bec60c1e5237eb723"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, FRA2-C1
accept-ranges: bytes
content-length: 13097
x-amz-cf-id: 5Q49ISoKzg_WJI7QbDlvw08ISGPHT2vyNiHZR2MeHq0yB7UB-Of7uw==
expires: Sat, 17 Aug 2019 16:22:07 GMT

GET
H2 200 subscribe2.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/ 8 KB
9 KB 12ms
10ms Image
image/jpeg 2600:9000:20eb:e000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:e000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 08:11:35 GMT
via: 1.1 1e498d046330e15095a1a2a958463bf5.cloudfront.net (CloudFront), 1.1 24c299c0a6423c6f96984a85fb014109.cloudfront.net (CloudFront)
last-modified: Tue, 19 Feb 2019 20:14:58 GMT
server: AmazonS3
age: 3331290
etag: "5ba45563f793f39ef6baf02645651654"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, FRA2-C1
accept-ranges: bytes
content-length: 8281
x-amz-cf-id: UlAvCgCPkXc_DPrTijhZnvINf44vXJPaSKd5IRKvSHzI7cAPk-PVcQ==
expires: Wed, 19 Feb 2020 20:14:57 GMT

GET
H2 200 FinSpy-malware-macOS-Linux-500x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/09/28134930/ 40 KB
41 KB 15ms
14ms Image
image/jpeg 2600:9000:20eb:e000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/28134930/FinSpy-malware-macOS-Linux-500x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:e000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 83a54ca49bf0094abcede64710d7ad5b3f11ba6be51f0c4bf39c99229d5fa703

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 12:27:30 GMT
via: 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront), 1.1 24c299c0a6423c6f96984a85fb014109.cloudfront.net (CloudFront)
last-modified: Mon, 28 Sep 2020 17:49:33 GMT
server: AmazonS3
age: 723935
etag: "2d8b0e66ccea1a307ee72e0d1c8488d2"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1, FRA2-C1
accept-ranges: bytes
content-length: 41110
x-amz-cf-id: vPd45KcpwN8bqrDXAr5KfDPIJ-1qoBFTC228v9pVajn6vsUlEcqF7w==
expires: Tue, 28 Sep 2021 17:49:32 GMT

GET
H2 200 Rat3-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/10/19124728/ 13 KB
14 KB 15ms
13ms Image
image/jpeg 2600:9000:20eb:e000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/10/19124728/Rat3-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:e000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e2d7133e621e56f0d57a39f36ec3fa2a93fd5e33cf167d01fe9cf56fb4d04eed

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 19 Oct 2020 17:35:52 GMT
via: 1.1 62dc260e32d7b9197a4511447f6a264a.cloudfront.net (CloudFront), 1.1 24c299c0a6423c6f96984a85fb014109.cloudfront.net (CloudFront)
last-modified: Mon, 19 Oct 2020 17:02:58 GMT
server: AmazonS3
age: 964633
etag: "97ae4939075f0b09ddb9dcd2f5eea335"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1, FRA2-C1
accept-ranges: bytes
content-length: 13618
x-amz-cf-id: V3TZDHYCIh8hjzc8698B0vsjyUJPABAtFNAua8UtDOpyDnbctL88pA==
expires: Tue, 19 Oct 2021 17:02:55 GMT

GET
H2 200 cash-1-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/07/06130944/ 64 KB
65 KB 16ms
15ms Image
image/jpeg 2600:9000:20eb:e000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/07/06130944/cash-1-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:e000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e6e8da7667cb5883b577c5d18614e703eacbe633b38112033220fe53c33d4009

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 19:02:16 GMT
via: 1.1 89c822bb1ce1445a7be6d1057088cfbf.cloudfront.net (CloudFront), 1.1 24c299c0a6423c6f96984a85fb014109.cloudfront.net (CloudFront)
last-modified: Mon, 06 Jul 2020 17:10:03 GMT
server: AmazonS3
age: 1477849
etag: "0bb8f0633c395c7e98740bf6ef0be2ec"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1, FRA2-C1
accept-ranges: bytes
content-length: 66028
x-amz-cf-id: 9SthrPYpXgh9Ry_oJIPqKPglU6I2W2TgW4XAfiYbXYk7FQPcPg2vLA==
expires: Tue, 06 Jul 2021 17:09:59 GMT

GET
H2 200 Trump-Biden-Cyberattacks-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/09/10160904/ 3 KB
3 KB 13ms
12ms Image
image/jpeg 2600:9000:20eb:e000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/10160904/Trump-Biden-Cyberattacks-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:e000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e9508ba7940744f67cae3678cec9deeb32fa61111365ff6366fd7e28dbb4c00b

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 28 Oct 2020 13:33:00 GMT
via: 1.1 51054083366f59cdc509361d23d873eb.cloudfront.net (CloudFront), 1.1 24c299c0a6423c6f96984a85fb014109.cloudfront.net (CloudFront)
last-modified: Thu, 10 Sep 2020 20:09:08 GMT
server: AmazonS3
age: 201605
etag: "02d819dba7c37960134535d631118aeb"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1, FRA2-C1
accept-ranges: bytes
content-length: 2847
x-amz-cf-id: jZoGVm7TU20inawieYL4ejoD8M3C6MOTxI4Z74V2UnFPuhRi1sqKVQ==
expires: Fri, 10 Sep 2021 20:09:07 GMT

GET
H2 200 voting-64x64.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2020/08/20152536/ 2 KB
2 KB 12ms
11ms Image
image/jpeg 2600:9000:20eb:e000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/08/20152536/voting-64x64.jpeg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:e000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 680c268c211b81fee63bd2133ddeca118e1bb9ba9f5ad107e98b3c4d230bf28c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 13:48:50 GMT
via: 1.1 21da0a66bafe2c8de8be4a4d8039346b.cloudfront.net (CloudFront), 1.1 24c299c0a6423c6f96984a85fb014109.cloudfront.net (CloudFront)
last-modified: Thu, 20 Aug 2020 19:26:03 GMT
server: AmazonS3
age: 805455
etag: "9293f3ef83c25d01935212cace875cd7"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1, FRA2-C1
accept-ranges: bytes
content-length: 2112
x-amz-cf-id: FGDiIgBXliQ1mxfzqwjIZhWxGtkxajH4VhshCphGX4aitanxnyQfSQ==
expires: Fri, 20 Aug 2021 19:26:00 GMT

GET
H2 200 QR-Code-64x64.png
media.threatpost.com/wp-content/uploads/sites/103/2020/09/15133828/ 8 KB
9 KB 12ms
11ms Image
image/png 2600:9000:20eb:e000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/15133828/QR-Code-64x64.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:e000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9f4d5cca9c79886cc27246836d97c89aaf7853b2a42b09801660cb9a3df67424

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 15 Oct 2020 20:15:01 GMT
via: 1.1 3c2fca5c3988bc152e874a83fac74f4a.cloudfront.net (CloudFront), 1.1 24c299c0a6423c6f96984a85fb014109.cloudfront.net (CloudFront)
last-modified: Tue, 15 Sep 2020 17:58:41 GMT
server: AmazonS3
age: 1300684
etag: "f2a1360e4c2d784aff00a9f87f6bb703"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1, FRA2-C1
accept-ranges: bytes
content-length: 8421
x-amz-cf-id: PdSjdn6mYTTcwA6U0yPZmqzR2y0tADeRXwSeChuuYok4fu1aDptrqg==
expires: Wed, 15 Sep 2021 17:58:37 GMT

GET
H2 200 botnet-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/11/14090552/ 2 KB
2 KB 13ms
13ms Image
image/jpeg 2600:9000:20eb:e000:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/11/14090552/botnet-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:e000:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6ceb2be119d08740867f19d7f3e5c2230050de29e4eb48a588b86af1a5b7db57

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 15 Oct 2020 18:02:17 GMT
via: 1.1 04599a8a3c6eb66f23e5ae02d1ec4cf2.cloudfront.net (CloudFront), 1.1 24c299c0a6423c6f96984a85fb014109.cloudfront.net (CloudFront)
last-modified: Thu, 14 Nov 2019 14:06:22 GMT
server: AmazonS3
age: 1308648
etag: "985f90dddb9367ad3b074a54645a8bc3"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1, FRA2-C1
accept-ranges: bytes
content-length: 1866
x-amz-cf-id: FLuS7gYFX-baJZP-rGsZYasLzYJ7fKqTO-opUjYVFMk2-cebxM06Tg==
expires: Fri, 13 Nov 2020 14:06:19 GMT

GET
H/1.1 200
OK mail-plane-large-dark.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 812 B
722 B 404ms
135ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-large-dark.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Fri, 30 Oct 2020 21:33:05 GMT
Content-Encoding: gzip
Last-Modified: Mon, 26 Oct 2020 10:43:08 GMT
Server: nginx
ETag: W/"5f96a83c-32c"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Fri, 06 Nov 2020 21:33:05 GMT

GET
H/1.1 200
OK logo-white.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 10 KB
10 KB 395ms
132ms Image
image/png 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo-white.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603708989
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Fri, 30 Oct 2020 21:33:05 GMT
Last-Modified: Mon, 26 Oct 2020 10:43:08 GMT
Server: nginx
ETag: "5f96a83c-260a"
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 9738
Expires: Fri, 06 Nov 2020 21:33:05 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 23 Oct 2020 03:00:57 GMT
server: Golfe2
age: 1036
date: Fri, 30 Oct 2020 21:15:48 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18817
expires: Fri, 30 Oct 2020 23:15:48 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 23 KB
9 KB 22ms
6ms Script
application/javascript 2620:116:800d:21:5a23:9c4e:e774:96c1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 87d73170be9a2e277c57d324c4e05ec0ac60ed3c0191fa29e7a31133b4c4c119

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:04 GMT
content-encoding: gzip
etag: "O/+l6c17R2TQ0JQMJXOiXA=="
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Fri, 06 Nov 2020 21:33:04 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 34ms
33ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:04 GMT
content-encoding: gzip
age: 29
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1958
x-served-by: cache-hhn4032-HHN
last-modified: Wed, 21 Oct 2020 21:46:56 GMT
x-timer: S1604093585.688556,VS0,VE0
etag: "a4cc3f907681b24a3efd540acd5d2996+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 164ms
54ms XHR
application/javascript 65.9.24.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.24.128 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 16:45:07 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin
age: 17278
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Wed, 30 Sep 2020 05:43:29 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 32e17fe5a1e4cb77ad8ac75ddb0c4584.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: ZAG50-C1
x-amz-cf-id: GVUqrdDST_2ra4pk0yLOF4LQ_PjS-H94kizklEP7qztaj6vukoUn-A==

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
67 B 13ms
13ms XHR
text/plain 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j87&aip=1&a=40877623&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ul=en-us&de=UTF-8&dt=Shlayer%20Mac%20Malware%20Returns%20with%20Extra%20Sneakiness%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=898215641&gjid=1450013122&cid=746451303.1604093585&tid=UA-35676203-21&_gid=341230511.1604093585&_r=1&gtm=2wgal2PM29HLF&z=778331453

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:04 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
122 B 6ms
6ms Image
image/gif 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j87&aip=1&a=40877623&t=event&ni=0&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ul=en-us&de=UTF-8&dt=Shlayer%20Mac%20Malware%20Returns%20with%20Extra%20Sneakiness%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=VISIBILITY&ea=elementVisibility%20%2F%20%5BHeader%5D%20%2F%20Social%20Networks%20View&_u=YEDAAEABAAAAAC~&jid=&gjid=&cid=746451303.1604093585&tid=UA-35676203-21&_gid=341230511.1604093585&gtm=2wgal2PM29HLF&z=173883910

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Oct 2020 13:09:23 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 30221
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 connatix.player.css
cds.connatix.com/p/72327/ 54 KB
9 KB 35ms
35ms Stylesheet
text/css 151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/72327/connatix.player.css
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 9c4740903ba9c8accf0a82a96c4553065510bc6b1a486715c2cfd79b8cfd3f6c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:04 GMT
content-encoding: gzip
age: 6023
x-cache: HIT, HIT
status: 200
content-length: 8796
x-served-by: cache-dca17742-DCA, cache-hhn4037-HHN
access-control-allow-origin: *
last-modified: Fri, 30 Oct 2020 19:38:06 GMT
x-timer: S1604093585.753056,VS0,VE0
etag: "cd4d821b09e618e8a4f16a309d185bcc"
vary: Accept-Encoding
content-type: text/css
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 3, 496

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
87 B 15ms
14ms XHR
text/plain 2a00:1450:400c:c07::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j87&tid=UA-35676203-21&cid=746451303.1604093585&jid=898215641&gjid=1450013122&_gid=341230511.1604093585&_u=YEBAAEAAAAAAAC~&z=1952813614

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c07::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Fri, 30 Oct 2020 21:33:04 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-_7kVx0t9Jqj90.js Show response
rules.quantcount.com/ 3 B
358 B 186ms
135ms Script
application/x-javascript 2600:9000:20d7:7a00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-_7kVx0t9Jqj90.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20d7:7a00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:30:18 GMT
via: 1.1 7fbfed9453edeb4b5dca9173a3f5f8dd.cloudfront.net (CloudFront)
last-modified: Fri, 03 Mar 2017 23:52:35 GMT
server: AmazonS3
age: 167
etag: "8a80554c91d9fca8acb82f023de02f11"
x-cache: Error from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=300
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
content-length: 3
x-amz-cf-id: 3SzE8wCvMK8d-sKrR_HIhQljywtWeDaDrKAm4v4NR9cPHXy43Y4VCg==

GET
H2 200 adsct
t.co/i/ 43 B
449 B 263ms
160ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 109
pragma: no-cache
last-modified: Fri, 30 Oct 2020 21:33:04 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 28848728f8602d7728ea892ac66492d7
x-transaction: 0086699a00ef5f79
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H3-Q050 200 ga-audiences
www.google.com/ads/ 42 B
378 B 20ms
20ms Image
image/gif 2a00:1450:4001:81a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-35676203-21&cid=746451303.1604093585&jid=898215641&_u=YEBAAEAAAAAAAC~&z=1424759789

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
106 B 17ms
17ms Image
image/gif 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j87&tid=UA-35676203-21&cid=746451303.1604093585&jid=898215641&_u=YEBAAEAAAAAAAC~&z=1424759789

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK pls Show response
capi.connatix.com/core/ Frame 52B6 6 KB
2 KB 584ms
152ms XHR
multipart/form-data 52.14.222.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/pls?v=72327
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.14.222.78 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-14-222-78.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: d92942df06524e01550c4ceb00940a09c15bf0dae50003332280a73d3d3316e9

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Fri, 30 Oct 2020 21:33:05 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
transfer-encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: true

POST
H/1.1 200
OK e Show response
capi.connatix.com/tr/ Frame 52B6 0
323 B 589ms
148ms XHR
multipart/form-data 52.14.222.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/e
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.14.222.78 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-14-222-78.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Fri, 30 Oct 2020 21:33:05 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 pixel;r=1434602473;source=gtm;rf=0;uh=65ce955d6ae6;uht=2;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue;fpan=1;fpa=P0-186396...
pixel.quantserve.com/ 35 B
371 B 15ms
13ms Image
image/gif 2620:116:800d:21:5a23:9c4e:e774:96c1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1434602473;source=gtm;rf=0;uh=65ce955d6ae6;uht=2;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue;fpan=1;fpa=P0-1863969756-1604093584932;ns=0;ce=1;qjs=1;qv=3364aec3-20201006003021;cm=;gdpr=0;ref=;d=threatpost.com;je=0;sr=1600x1200x24;dst=1;et=1604093584932;tzo=-60;ogl=image.https%3A%2F%2Fmedia%252Ethreatpost%252Ecom%2Fwp-content%2Fuploads%2Fsites%2F103%2F2020%2F01%2F22100148%2Ftroja%2Ctype.article%2Ctitle.Shlayer%20Mac%20Malware%20Returns%20with%20Extra%20Sneakiness%2Cdescription.Spreading%20via%20poisoned%20Google%20search%20results%252C%20this%20new%20version%20of%20Mac's%20No%252E%201%20th%2Curl.https%3A%2F%2Fthreatpost%252Ecom%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:04 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
status: 200
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
311 B 124ms
55ms XHR
application/json 35.158.194.251
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=4.10.0&referrer=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&tmax=1200&gdpr=false

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.158.194.251 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-158-194-251.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:05 GMT
x-auction-status: 12, 12, 12
status: 200
content-type: application/json; charset=utf-8
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
713 B 139ms
47ms XHR
application/json 185.33.221.91
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.91 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 30 Oct 2020 21:33:05 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 721.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.49:80
AN-X-Request-Uuid: 78b5fb0c-33a3-4b33-bda7-52cdfa25933f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 adreq Show response
ads.servenobid.com/ 317 B
475 B 220ms
102ms XHR
application/json 54.246.70.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=5625
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.246.70.54 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-70-54.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: bd0a39feedb7e330264305916e2381653c10702bdb909ec82d1bab35f08b3b9c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 30 Oct 2020 21:33:05 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
status: 200
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
access-control-allow-credentials: true

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 24 B
755 B 129ms
47ms XHR
application/json 72.251.249.14
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.10.0
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx /
Resource Hash: fad3898155c6342c45352367604af27c0e094701b8dcc4c4b1e05047d658bcbb

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 30 Oct 2020 21:33:05 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding, Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 25 B
683 B 236ms
137ms XHR
application/json 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=438654&v=7.2&r=%7B%22id%22%3A%22191ed3a43fb4444%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2220d78d9070685b6%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2221ce1f180e8291b%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2222e81923e3174ec%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2220d78d9070685b6%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2220d78d9070685b6%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2221ce1f180e8291b%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22336x280%22%7D%2C%22banner%22%3A%7B%22w%22%3A336%2C%22h%22%3A280%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2222e81923e3174ec%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22sid%22%3A%221005%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 009664fccba2f9c378a86456d781825bb46a121105299f6364e314b8f472bd18

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 30 Oct 2020 21:33:05 GMT
content-encoding: gzip
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
status: 200
x-cs-client-geo: 12
content-length: 43
x-ak-client-geo: 12
pragma: no-cache
x-ak-initial-geo: CC:[CH], RC:[ZH], CN:[EU], CIP:[185.156.175.107], XFF:[]
server: Apache
vary: Is-Traffic-Invalid,Accept-Encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
expires: Fri, 30 Oct 2020 21:33:05 GMT

GET
H2 200 arj Show response
teachingaids-d.openx.net/w/1.0/ 174 B
560 B 291ms
219ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=37016cd5-8376-4e0e-8570-f0262cbfe081%2C37016cd5-8376-4e0e-8570-f0262cbfe081%2C736daddd-edb7-4366-b8d1-80a234c035df%2C4c2e51e3-75fa-4fd1-ba81-051b82e30542%2C4c2e51e3-75fa-4fd1-ba81-051b82e30542&nocache=1604093584982&gdpr=0&x_gdpr_f=1&pubcid=7b2fc8f0-53df-4b51-b703-126c2014a712&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&aus=728x90%2C970x250%2C970x90%7C728x90%2C970x250%2C970x90%7C300x250%2C336x280%7C300x250%2C300x600%7C300x250%2C300x600&divIds=div-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-3%2Cdiv-gpt-ad-6794670-5%2Cdiv-gpt-ad-6794670-5&auid=540932704%2C540932709%2C540932713%2C540932715%2C540932720
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.197.0 /
Resource Hash: 95ed6b50d55c80e58d81b408dacf34374035d55a4aa60c382af65cb2e5414e77

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:05 GMT
content-encoding: gzip
server: OXGW/16.197.0
status: 200
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 165
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 v2 Show response
e.serverbid.com/api/ 16 B
168 B 369ms
123ms XHR
application/json 165.227.252.242
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://e.serverbid.com/api/v2
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 165.227.252.242 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 200
date: Fri, 30 Oct 2020 21:33:05 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com
content-length: 16
vary: Origin
content-type: application/json

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
115 B 199ms
114ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Fri, 30 Oct 2020 21:33:05 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
713 B 148ms
55ms XHR
application/json 185.33.221.91
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.91 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 30 Oct 2020 21:33:05 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 721.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.45:80
AN-X-Request-Uuid: c470a175-0acf-40b9-a224-fb04d5123d80
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

ADTECH;apid=1A7ecd6cfc-1af7-11eb-b364-126de4777bf4;cfp=1;rndc=1604093584;v=2;cmd=bid;cors=yes;alias=580df98f9fe16e1;misc=1604093584987 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=580df98f9fe16e1;misc=1604093584987;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;cfp=1;rndc=1604093584;v=2;cmd=bid;cors=yes;alias=580df98f9fe16e1;misc=1604093584987
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A7ecd6cfc-1af7-11eb-b364-126de4777bf4;cfp=1;rndc=1604093584;v=2;cmd=bid;cors=yes;alias=580df98f9fe16e1;misc=16...

1 KB
1 KB

146ms
146ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A7ecd6cfc-1af7-11eb-b364-126de4777bf4;cfp=1;rndc=1604093584;v=2;cmd=bid;cors=yes;alias=580df98f9fe16e1;misc=1604093584987
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: ef6f7ae704dbab0a0bdf98ae84088f1fa6601fb61021f63c1078b098beca3c8f

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:05 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 1468
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:05 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A7ecd6cfc-1af7-11eb-b364-126de4777bf4;cfp=1;rndc=1604093584;v=2;cmd=bid;cors=yes;alias=580df98f9fe16e1;misc=1604093584987
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A7ecdb1d0-1af7-11eb-9d42-126272b4dea0;cfp=1;rndc=1604093585;v=2;cmd=bid;cors=yes;alias=597f4bc464a3fe;misc=1604093584987 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=597f4bc464a3fe;misc=1604093584987;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1604093584;v=2;cmd=bid;cors=yes;alias=597f4bc464a3fe;misc=1604093584987
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A7ecdb1d0-1af7-11eb-9d42-126272b4dea0;cfp=1;rndc=1604093585;v=2;cmd=bid;cors=yes;alias=597f4bc464a3fe;misc=160...

1 KB
1 KB

153ms
153ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A7ecdb1d0-1af7-11eb-9d42-126272b4dea0;cfp=1;rndc=1604093585;v=2;cmd=bid;cors=yes;alias=597f4bc464a3fe;misc=1604093584987
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 9b6b261d5457f85d2f3dcdf75068f904351814b5ce9e53683647190acdfa8167

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:05 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 1468
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:05 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A7ecdb1d0-1af7-11eb-9d42-126272b4dea0;cfp=1;rndc=1604093585;v=2;cmd=bid;cors=yes;alias=597f4bc464a3fe;misc=1604093584987
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A7ecdc18e-1af7-11eb-a525-12eca44d2d72;cfp=1;rndc=1604093584;v=2;cmd=bid;cors=yes;alias=60db2c6d533c3fd;misc=1604093584987 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=60db2c6d533c3fd;misc=1604093584987;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1604093584;v=2;cmd=bid;cors=yes;alias=60db2c6d533c3fd;misc=1604093584987
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A7ecdc18e-1af7-11eb-a525-12eca44d2d72;cfp=1;rndc=1604093584;v=2;cmd=bid;cors=yes;alias=60db2c6d533c3fd;misc=16...

1 KB
1 KB

144ms
144ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A7ecdc18e-1af7-11eb-a525-12eca44d2d72;cfp=1;rndc=1604093584;v=2;cmd=bid;cors=yes;alias=60db2c6d533c3fd;misc=1604093584987
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 749776f38757ca0750b01d5196331b9557fda4b4f990ff134ea32e01eb3ca128

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:05 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 1469
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:05 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A7ecdc18e-1af7-11eb-a525-12eca44d2d72;cfp=1;rndc=1604093584;v=2;cmd=bid;cors=yes;alias=60db2c6d533c3fd;misc=1604093584987
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A7ecdc242-1af7-11eb-aed9-126272b4dea0;cfp=1;rndc=1604093585;v=2;cmd=bid;cors=yes;alias=61c8029ad8cac3d;misc=1604093584987 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=61c8029ad8cac3d;misc=1604093584987;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1604093584;v=2;cmd=bid;cors=yes;alias=61c8029ad8cac3d;misc=1604093584987
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A7ecdc242-1af7-11eb-aed9-126272b4dea0;cfp=1;rndc=1604093585;v=2;cmd=bid;cors=yes;alias=61c8029ad8cac3d;misc=16...

1 KB
2 KB

145ms
144ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A7ecdc242-1af7-11eb-aed9-126272b4dea0;cfp=1;rndc=1604093585;v=2;cmd=bid;cors=yes;alias=61c8029ad8cac3d;misc=1604093584987
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 36d8519b4bfc2a5ddf91ced4070562e108e5552475b78aa6fd4b702383f97466

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:05 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
x-adtech-meta: {"Debug": {"IP": "0.0.0.0", "Selector": "pri-select006c.us-east-1.prod.adtech.aolcloud.net", "UserId": "BCD9A7010716531C60EA10A5F4065865"}}
content-length: 1469
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:05 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A7ecdc242-1af7-11eb-aed9-126272b4dea0;cfp=1;rndc=1604093585;v=2;cmd=bid;cors=yes;alias=61c8029ad8cac3d;misc=1604093584987
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A7ecdc954-1af7-11eb-8221-12724de64e5e;cfp=1;rndc=1604093585;v=2;cmd=bid;cors=yes;alias=627ab418d335cdf;misc=1604093584987 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=627ab418d335cdf;misc=1604093584987;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;cfp=1;rndc=1604093584;v=2;cmd=bid;cors=yes;alias=627ab418d335cdf;misc=1604093584987
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A7ecdc954-1af7-11eb-8221-12724de64e5e;cfp=1;rndc=1604093585;v=2;cmd=bid;cors=yes;alias=627ab418d335cdf;misc=16...

1 KB
1 KB

146ms
146ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A7ecdc954-1af7-11eb-8221-12724de64e5e;cfp=1;rndc=1604093585;v=2;cmd=bid;cors=yes;alias=627ab418d335cdf;misc=1604093584987
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: a3a444f6f0602a202e74ceaefd6f2223bb26123e65b6ea2a44833f85d3998159

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:05 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 1469
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:05 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A7ecdc954-1af7-11eb-8221-12724de64e5e;cfp=1;rndc=1604093585;v=2;cmd=bid;cors=yes;alias=627ab418d335cdf;misc=1604093584987
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

POST
H2 200 c Show response
prebid.a-mo.net/a/ 912 B
846 B 402ms
158ms XHR
application/json 136.144.59.88
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.144.59.88 , United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: aae7fdb303f6427bdb7785b66824128b954e8f899c47ee1b3bbbe55b600b1110

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 30 Oct 2020 21:33:04 GMT
content-encoding: gzip
server: envoy
status: 200
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://threatpost.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 40
content-length: 418

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 263 B
2 KB 397ms
282ms XHR
application/json 69.173.144.140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=2&alt_size_ids=55%2C57&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&tk_flint=pbjs_lite_v4.10.0&x_source.tid=37016cd5-8376-4e0e-8570-f0262cbfe081&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.8300788878529453
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 78eac66a1d3e542e4053246d901f10492cc2e4a39ca3cc11915bf123eb202417

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 30 Oct 2020 21:33:05 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 263
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 195ms
81ms XHR
application/json 69.173.144.140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=16&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&tk_flint=pbjs_lite_v4.10.0&x_source.tid=736daddd-edb7-4366-b8d1-80a234c035df&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.3050269932182128
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 0ad7287aa8d3ded883bae1d423809186572d23d758d6d7f160b076ddd04a665a

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 30 Oct 2020 21:33:05 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 311ms
195ms XHR
application/json 69.173.144.140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509506&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&tk_flint=pbjs_lite_v4.10.0&x_source.tid=4c2e51e3-75fa-4fd1-ba81-051b82e30542&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.40432786805554355
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 0b85e804fb251ae67618bd97df8472f3e43dd4af09857e5a2cc8a00f814facd2

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 30 Oct 2020 21:33:05 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 205ms
84ms XHR
application/json 69.173.144.140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&tk_flint=pbjs_lite_v4.10.0&x_source.tid=4c2e51e3-75fa-4fd1-ba81-051b82e30542&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.7459575642774308
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 52d33cbb9109d91e22b889db5c3a4da3f72144d1bde597061d198b9b58c579c3

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 30 Oct 2020 21:33:05 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 119 B
504 B 179ms
178ms XHR
text/javascript 65.9.24.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&pid=44FlpwMyHqgEm&cb=0&ws=1600x1200&v=7.57.00&t=1200&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-970x250-ATF%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-300x250-ATF%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-300x600-ATF%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%222x2%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-2x2-Skin%22%7D%5D&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.24.128 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash: c2fc358dbbf2a7c80b1f45be493848dc05b65a71a063ec4a8c620c65c0622bad

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:05 GMT
content-encoding: gzip
server: Server
x-amz-cf-pop: ZAG50-C1
status: 200
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 128
via: 1.1 924bf9febd74cef2bda62c15c8441e00.cloudfront.net (CloudFront)
x-amz-cf-id: YP2LF6kUQwPaTlP5t35sRcIy5GoRTRU2jK07-A-7_XcBVw1pkubamQ==

GET
H3-Q050 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/ 343 KB
134 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/4lbq4vBYAu25DMtzZ7GGbfAF/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en&render=explicit&ver=5.5.1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84aff23bb47fbea74e9c9944cc840a4c17dbf1c32fc9f6a5c4717417e02751c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 20:35:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3466
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 137574
x-xss-protection: 0
last-modified: Mon, 26 Oct 2020 04:07:53 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 30 Oct 2021 20:35:19 GMT

GET
H/1.1 200
OK v1 Show response
geo.ipify.org/api/ 438 B
1 KB 750ms
359ms XHR
application/json 64.140.160.2
WEBNX

General

Check archive.org

Show headers Download Go to

Full URL

https://geo.ipify.org/api/v1?apiKey=at_riPAQYz3EiQ6JhsH05bmtozma13RA

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

64.140.160.2 Los Angeles, United States, ASN18450 (WEBNX, US),

Reverse DNS

Software

nginx /

Resource Hash

448ca9555e0e11d8d459c0cda661886ae5ffcd271bd449a0ae4eddc1536dd7ff

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 30 Oct 2020 21:33:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Server: nginx
X-Frame-Options: SAMEORIGIN
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private
Transfer-Encoding: chunked
Connection: keep-alive

GET
H2 200 flipboard.svg
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/ 236 B
567 B 364ms
364ms Image
image/svg+xml 2600:9000:2156:4c00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/flipboard.svg
Requested by: Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=c3405af2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:4c00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70

Request headers

Referer: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=c3405af2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Fri, 30 Oct 2020 21:33:05 GMT
content-encoding: gzip
last-modified: Mon, 26 Oct 2020 10:43:07 GMT
server: nginx
x-amz-cf-pop: FRA50-C1
etag: W/"5f96a83b-ec"
x-cache: Miss from cloudfront
content-type: image/svg+xml
status: 200
cache-control: max-age=604800, public
x-amz-cf-id: 4Ki5qZCqEdmtnIewVTW5niy02cYCbfqv4m11D6LVUxWI8dGV1QN1pA==
via: 1.1 e6d97713eb9b65f883e0f86b833878dd.cloudfront.net (CloudFront)
expires: Fri, 06 Nov 2020 21:33:05 GMT

GET
H2 200 fontawesome-webfont.woff2
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/ 75 KB
76 KB 388ms
368ms Font
font/woff2 2600:9000:2156:4c00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=c3405af2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:4c00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Origin: https://threatpost.com
Referer: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=c3405af2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:05 GMT
via: 1.1 1d87c34bb2f20fda8e0841bc33179769.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 77160
pragma: public
last-modified: Mon, 26 Oct 2020 10:43:20 GMT
server: nginx
etag: "5f96a848-12d68"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
x-amz-cf-id: QMhoHoAVZbK1ynfZ3ALUETKW_rR8utv6pWDh6b_Ok5QamO1h0kWoRA==
expires: Sat, 30 Oct 2021 21:33:05 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
653 B 267ms
165ms Script
application/javascript 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 111
pragma: no-cache
last-modified: Fri, 30 Oct 2020 21:33:05 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 5b2953fa858c78abb06855d659266b6b
x-transaction: 00c755670018ff3a
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1

200
OK

Cookie set iu3
aax-eu.amazon-adsystem.com/s/ Frame 57E2
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=cnv_an-db5
https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=cnv_an-db5&dcc=t

0
0

247ms
247ms

Document
text/html

52.95.124.170
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=cnv_an-db5&dcc=t
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.95.124.170 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash

Request headers

Host: aax-eu.amazon-adsystem.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: ad-id=A5e7-Abn-0YasHcEo8Q6Sbs|t
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Server: Server
Date: Fri, 30 Oct 2020 21:33:05 GMT
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 193
Connection: keep-alive
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Set-Cookie: ad-id=A5e7-Abn-0YasHcEo8Q6Sbs; Domain=.amazon-adsystem.com; Expires=Thu, 01-Jul-2021 21:33:05 GMT; Path=/; Secure; HttpOnly; SameSite=None ad-privacy=0; Domain=.amazon-adsystem.com; Expires=Thu, 01-Jan-2026 21:33:05 GMT; Path=/; Secure; HttpOnly; SameSite=None
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip

Redirect headers

Server: Server
Date: Fri, 30 Oct 2020 21:33:05 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=cnv_an-db5&dcc=t
Set-Cookie: ad-id=A5e7-Abn-0YasHcEo8Q6Sbs|t; Domain=.amazon-adsystem.com; Expires=Thu, 01-Jul-2021 21:33:05 GMT; Path=/; Secure; HttpOnly; SameSite=None
Vary: User-Agent

GET
H3-Q050 200 anchor
www.google.com/recaptcha/api2/ Frame F96B 0
0 26ms
26ms Document
text/html 2a00:1450:4001:81a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&theme=standard&size=normal&cb=pnszvq2ytjl2

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-k6Wc04oeogsEc1xAkCpzGQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&theme=standard&size=normal&cb=pnszvq2ytjl2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 30 Oct 2020 21:33:05 GMT
content-security-policy: script-src 'report-sample' 'nonce-k6Wc04oeogsEc1xAkCpzGQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10682
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H/1.1 200
OK sr Show response
capi.connatix.com/tr/ Frame 52B6 0
323 B 250ms
147ms XHR
multipart/form-data 52.14.222.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/sr?v=72327
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.14.222.78 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-14-222-78.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Fri, 30 Oct 2020 21:33:05 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 3_media.bin Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 52B6 232 B
468 B 111ms
35ms XHR
application/octet-stream 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/3_media.bin
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 1e6cc52bffa814d7c7912cd64a2ef303e6a2f2387b428173dca05f032bfa5788

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:05 GMT
content-encoding: gzip
age: 2803306
x-cache: HIT, HIT
status: 200
content-length: 204
x-served-by: cache-bwi5138-BWI, cache-hhn4073-HHN
last-modified: Thu, 17 Sep 2020 01:42:41 GMT
x-timer: S1604093586.647936,VS0,VE1
etag: "796c77896c9738780ae744fd3eb73483"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 1

GET
H2 200 1.png
img.connatix.com/c2ecd04f-0dca-4ffa-8761-d93b34717380/ 4 KB
5 KB 113ms
34ms Image
image/webp 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/c2ecd04f-0dca-4ffa-8761-d93b34717380/1.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 98170098ad5b9e0e27bc80b4fab39889cb6437246979ee85680f64bb77d03a08

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:05 GMT
via: 1.1 varnish, 1.1 varnish
age: 3064792
x-cache: HIT, HIT
fastly-io-info: ifsz=8114 idim=288x42 ifmt=png ofsz=4328 odim=288x42 ofmt=webp
status: 200
fastly-stats: io=1
content-encoding: gzip
content-length: 4351
x-served-by: cache-dca17721-DCA, cache-hhn4025-HHN
x-timer: S1604093586.659946,VS0,VE1
etag: "E00cBQTrMvE7BFKf7WtTa6oGFTVX3QMTXtfExBtu+i8"
vary: Accept
x-amz-request-id: 73558CDC7A440D38
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 1, 1

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
832 B 35ms
15ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 30 Oct 2020 21:33:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
832 B 35ms
15ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 30 Oct 2020 21:33:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 183 KB
30 KB 543ms
500ms XHR
text/plain 172.217.21.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1906112477480722&correlator=4124666222043429&output=ldjh&impl=fifs&eid=21067994&vrg=2020102601&gdpr=0&us_privacy=1---&tfua=0&tfcd=0&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201030&iu_parts=21707124336%2CThreatPost-970x250-ATF%2CThreatPost-300x250-ATF%2CThreatPost-300x600-ATF%2CThreatPost-2x2-Skin&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%7C970x250%7C970x90%2C300x250%7C336x280%2C300x250%7C300x600%2C2x2&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2&eri=1&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Fshlayer-mac-malware-extra-sneakiness%252F156669%252F%26urlquery%3Dgoogfc%26contentid%3D156669%26category%3Deditors-picks%26contenttags%3Danti-evasion%252Cfake-adobe-flash-installer%252Cgoogle-search%252Cintego%252Cmac-malware%252Cmalware-analysis%252Cnew-version%252Cpoisoned-search-results%252Cshlayer%252Cstealth&cookie_enabled=1&bc=31&abxe=1&lmt=1604093585&dt=1604093585582&dlt=1604093583543&idt=789&frm=20&biw=1600&bih=1200&oid=3&adxs=436%2C1082%2C1082%2C0&adys=10%2C257%2C1532%2C0&adks=1015519800%2C654286612%2C375389812%2C3385906655&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&dssz=52&icsg=171811933184&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90%7C300x250%7C300x250%7C1600x2&msz=728x90%7C300x250%7C300x250%7C1600x2&ga_vid=746451303.1604093585&ga_sid=1604093586&ga_hid=40877623&fws=0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfSx7Imlzc3Vlck9yaWdpbiI6Imh0dHBzOi8vYXR0ZXN0YXRpb24uYW5kcm9pZC5jb20iLCJzdGF0ZSI6MH1d

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020102601.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.21.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s13-in-f226.1e100.net

Software

cafe /

Resource Hash

ced9bde2b30c765bf1dafc6752d6f37cb3660281316652bff69a7798224f6c06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:06 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29771
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,5283645110
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,-1,138301519116
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://threatpost.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
ddfc2cf2e1ffe31253d42116313ebe73.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 0
0 54ms
38ms Other
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ddfc2cf2e1ffe31253d42116313ebe73.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 400 / Show response
graph.facebook.com/ 202 B
412 B 34ms
34ms XHR
application/json 2a03:2880:f02d:e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?id=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

29d1ccb9c33e266c4d1c504bab358d65cdc889fc81171ab938f82fd6c36da10e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
www-authenticate: OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
status: 400
x-fb-rev: 1002913607
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 148
pragma: no-cache
x-fb-debug: YVCByqn+EPOQ/NyaCR4okDmZr0fTdsz3vGrKbBxKZKsgfRvKDLQpLVmAjRn+VwPsSc1aoCb5/DAV+xRHzzDJVg==
x-fb-trace-id: Hha/u0f1/xn
date: Fri, 30 Oct 2020 21:33:05 GMT
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-fb-request-id: AmpxbVE2AaHxoMHTOkk_W1m
cache-control: no-store
facebook-api-version: v3.2
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 404 share
www.linkedin.com/countserv/count/ 0
0 693ms
678ms Script
text/html 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.linkedin.com/countserv/count/share?url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F&format=jsonp&callback=jQuery1124032811109300812413_1604093584414&_=1604093584415
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 info.json Show response
www.reddit.com/api/ 102 B
1 KB 357ms
242ms XHR
application/json 199.232.53.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reddit.com/api/info.json?url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.53.140 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

snooserv /

Resource Hash

f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:05 GMT
via: 1.1 varnish
x-content-type-options: nosniff
status: 200
content-length: 102
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge
x-moose: majestic
server: snooserv
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: X-Moose
cache-control: private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
accept-ranges: bytes
expires: -1

GET
H3-Q050 200 anchor
www.google.com/recaptcha/api2/ Frame 1E3A 0
0 31ms
30ms Document
text/html 2a00:1450:4001:81a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&theme=light&size=normal&cb=xmkv503p0w6u

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-PR17I6bk40gJNrBL6CRwmg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&theme=light&size=normal&cb=xmkv503p0w6u
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 30 Oct 2020 21:33:05 GMT
content-security-policy: script-src 'report-sample' 'nonce-PR17I6bk40gJNrBL6CRwmg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10824
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H/1.1 200
OK ao Show response
capi.connatix.com/tr/ Frame 52B6 0
323 B 148ms
148ms XHR
multipart/form-data 52.14.222.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ao?v=72327
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.14.222.78 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-14-222-78.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Fri, 30 Oct 2020 21:33:05 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK ps Show response
capi.connatix.com/tr/ Frame 52B6 0
323 B 152ms
142ms XHR
multipart/form-data 52.14.222.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ps?v=72327
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.14.222.78 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-14-222-78.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Fri, 30 Oct 2020 21:33:05 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 1_th.jpg
img.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ 2 KB
2 KB 45ms
45ms Image
image/webp 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/1_th.jpg?crop=400:225,smart&width=400&height=225&format=jpeg&quality=60&fit=crop
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3773223dc3f0b2c5f4ba6310b5eb478b52db9c305623545b0723b10a1e636b14

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:05 GMT
via: 1.1 varnish, 1.1 varnish
age: 3105000
x-cache: HIT, HIT
fastly-io-info: ifsz=36645 idim=2560x1440 ifmt=jpeg ofsz=2098 odim=400x225 ofmt=webp
status: 200
fastly-stats: io=1
content-encoding: gzip
content-length: 2066
x-served-by: cache-dca17753-DCA, cache-hhn4025-HHN
x-timer: S1604093586.739568,VS0,VE1
etag: "iDhG33Z1a+GgxtfhSqjNbZ1Iz0hjRhSMeN4Q5WPVjm0"
vary: Accept
x-amz-request-id: 9718C29D2B1AEC8D
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 1, 1

GET
H2 200 prebid3.25.0-1.js Show response
cds.connatix.com/p/plugins/ Frame 52B6 286 KB
89 KB 38ms
38ms Script
application/javascript 151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: b3e65f5bc65f920ed835a1329e8e585275e7c0e93de8a5c5642eab6300a11cef

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:05 GMT
content-encoding: gzip
age: 4016941
x-cache: HIT, HIT
status: 200
content-length: 90468
x-served-by: cache-dca17730-DCA, cache-hhn4037-HHN
access-control-allow-origin: *
last-modified: Mon, 14 Sep 2020 09:43:49 GMT
x-timer: S1604093586.745781,VS0,VE0
etag: "9c38c88a790efaae20de0f5391a27029"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 2, 18517

GET
H3-Q050 200 bframe
www.google.com/recaptcha/api2/ Frame D866 0
0 37ms
36ms Document
text/html 2a00:1450:4001:81a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=h0e8beelimqh

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-yr39dxpmEKclqj1YS98ydA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=h0e8beelimqh
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 30 Oct 2020 21:33:05 GMT
content-security-policy: script-src 'report-sample' 'nonce-yr39dxpmEKclqj1YS98ydA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1171
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 playlist.m3u8 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 52B6 309 B
326 B 34ms
34ms XHR
application/x-mpegurl 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/playlist.m3u8
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:05 GMT
content-encoding: gzip
age: 761482
x-cache: HIT, HIT
status: 200
content-length: 164
x-served-by: cache-bwi5145-BWI, cache-hhn4073-HHN
last-modified: Mon, 07 Sep 2020 18:49:42 GMT
x-timer: S1604093586.819353,VS0,VE1
etag: "8a966507b13615ecdc1330a4bc9dcfe1"
vary: Accept-Encoding
content-type: application/x-mpegURL
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 1

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 52B6 0
215 B 198ms
58ms XHR
application/json 3.124.44.162
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.44.162 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-44-162.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame 52B6 92 B
282 B 228ms
227ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=05bec532-c021-4b97-8c59-64c6b09b0fe0&nocache=1604093585863&schain=1.0%2C1!admetricspro.com%2C1%2C1%2C%2C%2C&auid=540882778&vwd=400&vht=225
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.197.0 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:06 GMT
via: 1.1 google
server: OXGW/16.197.0
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 52B6 19 B
713 B 92ms
91ms XHR
application/json 185.33.221.91
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.91 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 30 Oct 2020 21:33:05 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 721.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.79:80
AN-X-Request-Uuid: a46d5108-e36a-4f3f-9f4a-6fb852fbf847
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ Frame 52B6 24 B
1 KB 199ms
104ms XHR
application/json 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?t=900&s=435871&v=8.1&r=%7B%22id%22%3A%227f8c4233be1de7%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2287891a3526b897%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435871%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221%22%7D%5D%7D%7D%7D%7D&ac=j&sd=1&nf=1
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 651cc4fb61666e02141231920bd1d5eccb0244076416ce7351e40115f68d5564

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 30 Oct 2020 21:33:06 GMT
Content-Encoding: gzip
Server: Apache
Vary: Is-Traffic-Invalid,Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 44
Expires: Fri, 30 Oct 2020 21:33:06 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 52B6 0
59 B 86ms
86ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Fri, 30 Oct 2020 21:33:05 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ Frame 52B6 25 B
1 KB 216ms
91ms XHR
application/json 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?t=900&s=435870&v=8.1&r=%7B%22id%22%3A%2211f2ba2197afe95%22%2C%22imp%22%3A%5B%7B%22id%22%3A%221265f5d60373f56%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221%22%7D%5D%7D%7D%7D%7D&ac=j&sd=1&nf=1
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: ed32ae8da5321f719f046f787403ae3527b74cfbdd04ab19ed46e614fd216762

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 30 Oct 2020 21:33:06 GMT
Content-Encoding: gzip
Server: Apache
Vary: Is-Traffic-Invalid,Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 45
Expires: Fri, 30 Oct 2020 21:33:06 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 52B6 19 B
714 B 84ms
84ms XHR
application/json 185.33.221.91
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.91 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 30 Oct 2020 21:33:05 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 721.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.231:80
AN-X-Request-Uuid: 7a0c3c84-7b6f-408f-8537-cd81bb8162a1
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame 52B6 92 B
285 B 84ms
84ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=51b398e7-e21d-45b1-890f-e7db3f22af8c&nocache=1604093585877&schain=1.0%2C1!admetricspro.com%2C1%2C1%2C%2C%2C&auid=540882779&vwd=400&vht=225
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.197.0 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:05 GMT
via: 1.1 google
server: OXGW/16.197.0
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 52B6 0
59 B 81ms
81ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Fri, 30 Oct 2020 21:33:05 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H2 200 0.m3u8 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 52B6 5 KB
1 KB 72ms
72ms XHR
application/x-mpegurl 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.m3u8
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ac1eed21fdddd6a981458cc46e79523f77a9b44b9b639d9df405c0d9827cc552

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:05 GMT
content-encoding: gzip
age: 775922
x-cache: HIT, HIT
status: 200
content-length: 959
x-served-by: cache-bwi5126-BWI, cache-hhn4073-HHN
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
x-timer: S1604093586.916173,VS0,VE1
etag: "3a71266b043248350b2f39a55da8294e"
vary: Accept-Encoding
content-type: application/x-mpegURL
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 1

GET
H3-Q050 200 bframe
www.google.com/recaptcha/api2/ Frame AD0A 0
0 21ms
20ms Document
text/html 2a00:1450:4001:81a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=jfsh24orl9f

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-mCn10rDkd2EQn3EyfoMY8A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=4lbq4vBYAu25DMtzZ7GGbfAF&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=jfsh24orl9f
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 30 Oct 2020 21:33:05 GMT
content-security-policy: script-src 'report-sample' 'nonce-mCn10rDkd2EQn3EyfoMY8A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1168
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 65ms
65ms Other 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

status: 200
retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Fri, 30 Oct 2020 21:33:06 GMT
x-served-by: cache-hhn4073-HHN
x-cache: HIT
x-cache-hits: 0
x-timer: S1604093586.017211,VS0,VE0
cache-control: max-age=31557600
content-length: 0

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 52B6 1 KB
2 KB 34ms
34ms XHR
video/mp4 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: e8c207773b5b242229f77be9cde555a9cf5ced8288409f80da3d5192706e40e3

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=0-1428

Response headers

date: Fri, 30 Oct 2020 21:33:06 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 2808060
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5129-BWI, cache-hhn4073-HHN
status: 206
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 0-1428/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1604093586.084175,VS0,VE0
access-control-allow-origin: *
Content-Length: 1429
x-cache-hits: 1, 1

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 33ms
33ms Other 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

status: 200
retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Fri, 30 Oct 2020 21:33:06 GMT
x-served-by: cache-hhn4073-HHN
x-cache: HIT
x-cache-hits: 0
x-timer: S1604093586.120137,VS0,VE0
cache-control: max-age=31557600
content-length: 0

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 52B6 444 KB
445 KB 34ms
33ms XHR
video/mp4 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: dd7d093a1d67babe8e574f94231253e281cf71195d34d8d7035329c655915c90

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=1429-456334

Response headers

date: Fri, 30 Oct 2020 21:33:06 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 2808060
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5129-BWI, cache-hhn4073-HHN
status: 206
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 1429-456334/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1604093586.153683,VS0,VE0
access-control-allow-origin: *
Content-Length: 454906
x-cache-hits: 1, 2

GET
H2 200 bl-04a3385-bb7a25fb.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 29CE 94 KB
27 KB 57ms
56ms Script
application/javascript 65.9.20.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-bb7a25fb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.20.101 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f40b40ca5f8e9d73bbe3d3c0097d15681646fe084ecfb05d8e02b8f851570048

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 16:49:42 GMT
content-encoding: gzip
age: 17005
x-cache: Hit from cloudfront
status: 200
content-length: 27345
x-amz-meta-git_commit: 04a3385
last-modified: Fri, 30 Oct 2020 16:48:54 GMT
server: AmazonS3
etag: "47670cc31dbcdee64801850ce4f3d0ad"
x-amz-version-id: qaf1kCx.vAnyoj3z.jichs6F9nN3gldQ
via: 1.1 b8c21c40c485a68c7663b93787f93464.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: yUbWZcgGXI0YhQk8isHaFiadj1TnzFJcHPV-FL5CnSB4IXDxweckbA==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 29CE 61 KB
21 KB 65ms
65ms Script
application/javascript 65.9.20.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.20.101 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 04:31:24 GMT
content-encoding: gzip
age: 752503
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 b8c21c40c485a68c7663b93787f93464.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: MR9fIL2Fz7iuxWXENh2nXRSVBttcpcSPypkPhnZiz1rzu5EnqRLWkA==

GET
H2 200 bl-04a3385-bb7a25fb.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 5535 94 KB
27 KB 55ms
55ms Script
application/javascript 65.9.20.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-bb7a25fb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.20.101 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f40b40ca5f8e9d73bbe3d3c0097d15681646fe084ecfb05d8e02b8f851570048

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 16:49:42 GMT
content-encoding: gzip
age: 17005
x-cache: Hit from cloudfront
status: 200
content-length: 27345
x-amz-meta-git_commit: 04a3385
last-modified: Fri, 30 Oct 2020 16:48:54 GMT
server: AmazonS3
etag: "47670cc31dbcdee64801850ce4f3d0ad"
x-amz-version-id: qaf1kCx.vAnyoj3z.jichs6F9nN3gldQ
via: 1.1 b8c21c40c485a68c7663b93787f93464.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: m5RAS8YytI3ODPuyh0HAIQAfzC_Ewf08dfe3WInvZXIsON3h6OpuNQ==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 5535 61 KB
21 KB 55ms
55ms Script
application/javascript 65.9.20.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.20.101 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 04:31:24 GMT
content-encoding: gzip
age: 752503
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 b8c21c40c485a68c7663b93787f93464.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: VwCp3Scn7P-Jz6kZEh5Qk8iEqSSv9ofBJWWzt1ncDK_qrDb-rajHQg==

GET
H2 200 bl-04a3385-bb7a25fb.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 1DA5 94 KB
27 KB 56ms
56ms Script
application/javascript 65.9.20.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-bb7a25fb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.20.101 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f40b40ca5f8e9d73bbe3d3c0097d15681646fe084ecfb05d8e02b8f851570048

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 16:49:42 GMT
content-encoding: gzip
age: 17005
x-cache: Hit from cloudfront
status: 200
content-length: 27345
x-amz-meta-git_commit: 04a3385
last-modified: Fri, 30 Oct 2020 16:48:54 GMT
server: AmazonS3
etag: "47670cc31dbcdee64801850ce4f3d0ad"
x-amz-version-id: qaf1kCx.vAnyoj3z.jichs6F9nN3gldQ
via: 1.1 b8c21c40c485a68c7663b93787f93464.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: DxRaUUGujdNtA4VmUjw4uTWyubo5IhxXyxdqGFbDqv5rCVc4Pw9LCw==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 1DA5 61 KB
21 KB 57ms
56ms Script
application/javascript 65.9.20.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.20.101 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 04:31:24 GMT
content-encoding: gzip
age: 752503
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 b8c21c40c485a68c7663b93787f93464.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: U8rfC_xt7uN2GIl4fvMBtyrWTHQk-jbBkh1Sliq8Kz5rLompeFLSgA==

GET
H2 200 bl-04a3385-bb7a25fb.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame B4A2 94 KB
27 KB 56ms
54ms Script
application/javascript 65.9.20.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-bb7a25fb.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.20.101 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f40b40ca5f8e9d73bbe3d3c0097d15681646fe084ecfb05d8e02b8f851570048

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 16:49:42 GMT
content-encoding: gzip
age: 17005
x-cache: Hit from cloudfront
status: 200
content-length: 27345
x-amz-meta-git_commit: 04a3385
last-modified: Fri, 30 Oct 2020 16:48:54 GMT
server: AmazonS3
etag: "47670cc31dbcdee64801850ce4f3d0ad"
x-amz-version-id: qaf1kCx.vAnyoj3z.jichs6F9nN3gldQ
via: 1.1 b8c21c40c485a68c7663b93787f93464.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: iqYWtyCWA4i-F7qC32nviP5eodNbtT_LUoK5LSRXIAzFecI5PhiuTw==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame B4A2 61 KB
21 KB 56ms
54ms Script
application/javascript 65.9.20.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.20.101 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 04:31:24 GMT
content-encoding: gzip
age: 752503
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 b8c21c40c485a68c7663b93787f93464.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: ndbGa19IkSpMFJYt9lFu1G_Dftsn3fCuCA3BuCcuBiJc_kZxzZTdUw==

GET
H2 200 7464639028652035684
tpc.googlesyndication.com/simgad/ Frame B4A2 330 B
502 B 27ms
7ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7464639028652035684

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 02:48:04 GMT
x-content-type-options: nosniff
age: 67502
x-dns-prefetch-control: off
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 330
x-xss-protection: 0
last-modified: Tue, 28 Jan 2020 23:02:00 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Oct 2021 02:48:04 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20201027/r20110914/ Frame B4A2 17 KB
8 KB 26ms
5ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20201027/r20110914/abg_lite_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

51b80b713d82dafe9d86ff2b83dd557f60cbf887ac76483df35a75e6479b59c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 07:23:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50989
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7216
x-xss-protection: 0
server: cafe
etag: 18075241702106780385
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Nov 2020 07:23:17 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20201027/r20110914/client/ Frame B4A2 3 KB
1 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20201027/r20110914/client/window_focus_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9c8c5ae8437903bcd9d8737d4c119c14492373d06e719215ba9ef065bc5e1186

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 07:20:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51167
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1336
x-xss-protection: 0
server: cafe
etag: 4033927919502905291
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 13 Nov 2020 07:20:19 GMT

GET
H3-Q050 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame B4A2 74 KB
29 KB 81ms
66ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0aa4e66f2abe3d5d790dfe483c53bf8ff2fab13d8b35598c189db8c728ccca09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1604057784510231"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28759
x-xss-protection: 0
expires: Fri, 30 Oct 2020 21:33:06 GMT

GET
H3-Q050 204 l
www.google.com/ads/measurement/ Frame B4A2 0
0 17ms
15ms Image
text/html 2a00:1450:4001:81a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTglDWIlowtbioFBT06jeQWLVvSDWTmH88OYtScA1vAKHMhN25ctbfjQaDhfitolbAYUTPh
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 78ms
65ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020102601.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f675ce5fcecaf75514fa222819eb7a8241f6b7c7b92714fe008e8dd2ad30797

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1604057784510231"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27555
x-xss-protection: 0
expires: Fri, 30 Oct 2020 21:33:06 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/032010270040000/ Frame 29CE 204 KB
57 KB 42ms
6ms Script
text/javascript 2a00:1450:4001:814::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032010270040000/amp4ads-v0.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e5fdbe89bd5441da087ec62b54d1093627a0f4f3027c162b61c8a79a4b00e45

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 253550
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 56892
x-xss-protection: 0
server: sffe
date: Tue, 27 Oct 2020 23:07:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "d39b6146b3baf6a5"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Oct 2021 23:07:16 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/032010270040000/v0/ Frame 29CE 14 KB
5 KB 54ms
19ms Script
text/javascript 2a00:1450:4001:814::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032010270040000/v0/amp-ad-exit-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5b1ac3e3dac03cc7b55db95d3e2f6db06359e9f83c31edfe7e8948fe1b005ece

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 253550
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5339
x-xss-protection: 0
server: sffe
date: Tue, 27 Oct 2020 23:07:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f32966a1dd31423f"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Oct 2021 23:07:16 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/032010270040000/v0/ Frame 29CE 96 KB
29 KB 53ms
17ms Script
text/javascript 2a00:1450:4001:814::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032010270040000/v0/amp-analytics-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b53e860d5c71786683ef080150431ccdef7f285ecc24fea1abf56f8bb41109a5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 146528
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29532
x-xss-protection: 0
server: sffe
date: Thu, 29 Oct 2020 04:50:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "7e22568992b3e519"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Oct 2021 04:50:58 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/032010270040000/v0/ Frame 29CE 4 KB
2 KB 52ms
17ms Script
text/javascript 2a00:1450:4001:814::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032010270040000/v0/amp-fit-text-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a084f9fa314be804daeb5314c0dcf00022a8d8a1319a990b9546860e2ca8753

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 253550
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1794
x-xss-protection: 0
server: sffe
date: Tue, 27 Oct 2020 23:07:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "97d72cd21f25600f"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Oct 2021 23:07:16 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/032010270040000/v0/ Frame 29CE 45 KB
14 KB 50ms
14ms Script
text/javascript 2a00:1450:4001:814::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032010270040000/v0/amp-form-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8637b0501ace1a66eb37373c3440baf7ac214692ac755d90d901d1c1587f3f6c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 253550
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14173
x-xss-protection: 0
server: sffe
date: Tue, 27 Oct 2020 23:07:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "e02eb5bdf732790a"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Oct 2021 23:07:16 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 29CE 5 KB
761 B 18ms
15ms Stylesheet
text/css 2a00:1450:4001:81f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 30 Oct 2020 20:42:57 GMT
server: ESF
date: Fri, 30 Oct 2020 21:33:06 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 30 Oct 2020 21:33:06 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 29CE 5 KB
738 B 18ms
15ms Stylesheet
text/css 2a00:1450:4001:81f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&text=

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 30 Oct 2020 21:07:23 GMT
server: ESF
date: Fri, 30 Oct 2020 21:33:06 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 30 Oct 2020 21:33:06 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/18272868642523537273/ Frame 29CE 22 KB
23 KB 40ms
25ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/18272868642523537273/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoI2gMQ-AEYASABLQAAAD8w2gM4-AFFAACAPw&rs=AOga4qkQun6reHJzk5Jfjy1VI7ISxPo_aA

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5514ce28663ab40231eadef99a2728a934558fb65a0a666d4d7abbea65969a3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 29 Oct 2020 09:15:18 GMT
x-content-type-options: nosniff
last-modified: Mon, 21 Sep 2020 16:30:31 GMT
server: sffe
age: 130668
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22961
x-xss-protection: 0
expires: Fri, 29 Oct 2021 09:15:18 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/18372800752111016132/ Frame 29CE 41 KB
41 KB 36ms
21ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/18372800752111016132/downsize_200k_v1?sqp=4sqPyQSLAUKIAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-Mg8I2AQQ2AQYASABLQAAAD8&rs=AOga4qkDgIH4FIdyE9o0B70jW14MpCtq3A

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b25cbe4632e8840ea52359bb65b436e23b6e435d1153925d0261936f7651daea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 29 Oct 2020 22:22:24 GMT
x-content-type-options: nosniff
last-modified: Mon, 23 Sep 2019 17:14:48 GMT
server: sffe
age: 83442
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42228
x-xss-protection: 0
expires: Fri, 29 Oct 2021 22:22:24 GMT

GET
H3-Q050 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 29CE 0
0 49ms
47ms Image
text/html 172.217.21.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CQXMJkYacX6CsLNSbgQeugaCIA_jOy_lflrPz5bkMy5LKzMUbEAEg0YfSIGD1lc6B4ASgAYKFjtYDyAEG4AIAqAMByAMKqgSiAk_QbYlPhksHq4zioB8MLKV3M-Q0YGLPiDf6x-7qu8WcQ6v6VzKIotiumSP2IvAgRrAfbxpaReI18wARhp-unP-XSSlXDwTRMFTQ-ivBY3IpdNyhZpFefZGe4AtO9HidHaAn7t0l-Ynp3uoIv6mhYnphIs0cfOHHjrpFqb5_huNk8lJdsGRIeBkr143VAbuhvQPdVDp7Cb61ElC6yOXlM1cN_YC8cm1cTk4w8yAoAY3vzDvJiQcFZMX3lua20osxamm-4Vng-01f7SWrI_Ye1NrVDLsyEwK_SONwBQTOsUO4fCyIRqXKIOeirTndPa1u3Fp6HO_PtUVdBk51pbLuvnVRnZNnovPE8y1l4P6JOfJuEnNpQ-yarhQyaet4dHLMZpCLwAStkOPNjgPgBAGSBQQIBBgBkgUECAUYBKAGN4AH5vrxKagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHBBDsjSHSCAkIgOGAQBABGB3yCBthZHgtc3Vic3luLTcyNjM1NzM0NDY4MDQwNziACgPICwGyDBRwdWItOTY4NTczNDQ0NTQ3NjgxNMIMAggB2BMCiBQB&sigh=1LEw0eWjUu4&template_id=492&tpd=AGWhJmtlDqDpupG_eV1Ek5Qtlk213Nag5yfV2k75a6RBhEwWWg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 172.217.21.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s13-in-f226.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 204 l
www.google.com/ads/measurement/ Frame 29CE 0
0 15ms
14ms Image
text/html 2a00:1450:4001:81a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSdRvrXuqgYBxeWkl0I-NRQZ8dVe2GbbJKC2DjdsEzRz4sV581A15dgofk2PU-UtK3dwh-o
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 29CE 2 KB
3 KB 34ms
20ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 30 Oct 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 37448
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Sat, 31 Oct 2020 11:08:58 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 29CE 295 B
388 B 35ms
20ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 29 Oct 2020 22:32:01 GMT
x-content-type-options: nosniff
server: cafe
age: 82865
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 30 Oct 2020 22:32:01 GMT

GET
DATA 200
OK truncated
/ Frame 29CE 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 24d4a5ecc42910ab71c4eba19b84e0a09ddeffb7c079801668e312180d497c96

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/032010270040000/ Frame 5535 204 KB
56 KB 39ms
23ms Script
text/javascript 2a00:1450:4001:814::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032010270040000/amp4ads-v0.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e5fdbe89bd5441da087ec62b54d1093627a0f4f3027c162b61c8a79a4b00e45

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 253550
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 56892
x-xss-protection: 0
server: sffe
date: Tue, 27 Oct 2020 23:07:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "d39b6146b3baf6a5"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Oct 2021 23:07:16 GMT

GET
H3-Q050 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/032010270040000/v0/ Frame 5535 14 KB
5 KB 39ms
22ms Script
text/javascript 2a00:1450:4001:814::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032010270040000/v0/amp-ad-exit-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5b1ac3e3dac03cc7b55db95d3e2f6db06359e9f83c31edfe7e8948fe1b005ece

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 253550
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5339
x-xss-protection: 0
server: sffe
date: Tue, 27 Oct 2020 23:07:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f32966a1dd31423f"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Oct 2021 23:07:16 GMT

GET
H3-Q050 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/032010270040000/v0/ Frame 5535 96 KB
29 KB 37ms
21ms Script
text/javascript 2a00:1450:4001:814::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032010270040000/v0/amp-analytics-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b53e860d5c71786683ef080150431ccdef7f285ecc24fea1abf56f8bb41109a5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 146528
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29532
x-xss-protection: 0
server: sffe
date: Thu, 29 Oct 2020 04:50:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "7e22568992b3e519"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Oct 2021 04:50:58 GMT

GET
H3-Q050 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/032010270040000/v0/ Frame 5535 4 KB
2 KB 36ms
21ms Script
text/javascript 2a00:1450:4001:814::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032010270040000/v0/amp-fit-text-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a084f9fa314be804daeb5314c0dcf00022a8d8a1319a990b9546860e2ca8753

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 253550
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1794
x-xss-protection: 0
server: sffe
date: Tue, 27 Oct 2020 23:07:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "97d72cd21f25600f"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Oct 2021 23:07:16 GMT

GET
H3-Q050 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/032010270040000/v0/ Frame 5535 45 KB
15 KB 35ms
21ms Script
text/javascript 2a00:1450:4001:814::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032010270040000/v0/amp-form-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8637b0501ace1a66eb37373c3440baf7ac214692ac755d90d901d1c1587f3f6c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 253550
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14173
x-xss-protection: 0
server: sffe
date: Tue, 27 Oct 2020 23:07:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "e02eb5bdf732790a"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Oct 2021 23:07:16 GMT

GET
H3-Q050 200 css
fonts.googleapis.com/ Frame 5535 5 KB
687 B 51ms
36ms Stylesheet
text/css 2a00:1450:4001:820::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 30 Oct 2020 19:37:30 GMT
server: ESF
date: Fri, 30 Oct 2020 21:33:06 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 30 Oct 2020 21:33:06 GMT

GET
H3-Q050 200 css
fonts.googleapis.com/ Frame 5535 5 KB
1 KB 44ms
29ms Stylesheet
text/css 2a00:1450:4001:820::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&text=

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 30 Oct 2020 20:47:46 GMT
server: ESF
date: Fri, 30 Oct 2020 21:33:06 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 30 Oct 2020 21:33:06 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/2620902511481989051/ Frame 5535 29 KB
29 KB 9ms
8ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/2620902511481989051/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoIzgIQrwEYASABLQAAAD8wzgI4rwFFAACAPw&rs=AOga4qk0F584v7_1XR9NDA4LkT5gBtPYeg

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3865ad0db89497d72c806c4448fcd29f6dc9b1d6a72dfca1f56ebf768b50eb9f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 17:47:00 GMT
x-content-type-options: nosniff
last-modified: Wed, 26 Aug 2020 17:01:09 GMT
server: sffe
age: 13566
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29496
x-xss-protection: 0
expires: Sat, 30 Oct 2021 17:47:00 GMT

GET
H3-Q050 200 40933678460698624
tpc.googlesyndication.com/simgad/ Frame 5535 1 KB
871 B 7ms
6ms Image
image/svg+xml 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/40933678460698624

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

09fba596f1ba572cf4b3ceb9c1f3962d1b75bbb4a6d6d7707f1f93e2fe889aee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 09:23:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 389349
x-dns-prefetch-control: off
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 728
x-xss-protection: 0
last-modified: Thu, 26 Oct 2017 18:18:20 GMT
server: sffe
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Oct 2021 09:23:57 GMT

GET
H3-Q050 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 5535 0
0 47ms
46ms Image
text/html 172.217.21.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C41nrkYacX6GsLNSbgQeugaCIA6Wl_vlfnJDisssMhb-X76IaEAEg0YfSIGD1lc6B4ASgAbnzhfADyAEGqQI-1HNXIImzPuACAKgDAcgDCqoEpgJP0IFQzqyEBdHbTOZM3qQoRKWdBA2l_0K1Q1P0R7F-EeGlsGYp6y82tkeg8Si6v1ly5Uk9gZtZKBXl2PhAGIryiJViv62U3R5acXJ5RLJJ6G3i47Y5D7uoRpiIx1WT5ssPTLx8hvy3NUqb2O_zq-3aFP38dH2gXhYqKRpUxuPkvwQHU7e-S6TqLivy-UysBS0Jmu1tnn5NQpRuFk3nymLUejvuheUQt6aP2mJBbw-SfwTRRfb-FXJ2WRJ39ENkT1_isMQ9jJAD02N_ckUDoZH_RiMfk3D_fvWAbs1cVi4zIKs8NNVoXUaqCasX3Anqlli0tPcoEDU2OhuWwdQ9-fNEUKwZC6qO38HdXw70y1t9VXuX9oZPt1W1fpPq-GqOgI7GclYmA5LABMql9aShA-AEAZIFBAgEGAGSBQQIBRgEoAY3gAe37ZvLAagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHBBDFviXSCAkIgOGAQBABGB3yCBthZHgtc3Vic3luLTcyNjM1NzM0NDY4MDQwNziACgPICwGyDBRwdWItOTY4NTczNDQ0NTQ3NjgxNMIMAggB2BMCiBQB&sigh=pS678vHR00Y&template_id=492&tpd=AGWhJmvd0OIbqai0WCn8lewNaql7qmxnBK5zzg3sqKkrs5bHfA
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 172.217.21.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s13-in-f226.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 5535 2 KB
2 KB 8ms
7ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 30 Oct 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 37448
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Sat, 31 Oct 2020 11:08:58 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 5535 295 B
319 B 8ms
7ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 29 Oct 2020 22:32:01 GMT
x-content-type-options: nosniff
server: cafe
age: 82865
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 30 Oct 2020 22:32:01 GMT

GET
DATA 200
OK truncated
/ Frame 5535 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d8d326a9d025fe940aeb0589c3bed484620e8504d269fa4dc34e442673059071

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 29CE 11 KB
11 KB 34ms
20ms Font
font/woff2 2a00:1450:4001:815::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 11:20:34 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 36752
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Sat, 30 Oct 2021 11:20:34 GMT

GET
H3-Q050 200 KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 29CE 11 KB
11 KB 34ms
21ms Font
font/woff2 2a00:1450:4001:815::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 11:20:34 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:48 GMT
server: sffe
age: 36752
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11056
x-xss-protection: 0
expires: Sat, 30 Oct 2021 11:20:34 GMT

GET
H3-Q050 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/032010270040000/ Frame 1DA5 204 KB
56 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:814::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032010270040000/amp4ads-v0.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e5fdbe89bd5441da087ec62b54d1093627a0f4f3027c162b61c8a79a4b00e45

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 253550
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 56892
x-xss-protection: 0
server: sffe
date: Tue, 27 Oct 2020 23:07:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "d39b6146b3baf6a5"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Oct 2021 23:07:16 GMT

GET
H3-Q050 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/032010270040000/v0/ Frame 1DA5 14 KB
5 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:814::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032010270040000/v0/amp-ad-exit-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5b1ac3e3dac03cc7b55db95d3e2f6db06359e9f83c31edfe7e8948fe1b005ece

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 253550
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5339
x-xss-protection: 0
server: sffe
date: Tue, 27 Oct 2020 23:07:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f32966a1dd31423f"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Oct 2021 23:07:16 GMT

GET
H3-Q050 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/032010270040000/v0/ Frame 1DA5 96 KB
29 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:814::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032010270040000/v0/amp-analytics-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b53e860d5c71786683ef080150431ccdef7f285ecc24fea1abf56f8bb41109a5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 146528
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29532
x-xss-protection: 0
server: sffe
date: Thu, 29 Oct 2020 04:50:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "7e22568992b3e519"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Oct 2021 04:50:58 GMT

GET
H3-Q050 200 amp-animation-0.1.js Show response
cdn.ampproject.org/rtv/032010270040000/v0/ Frame 1DA5 76 KB
18 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:814::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032010270040000/v0/amp-animation-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

28df7c560036a772abb8e8cc8c20bfb4fc134bac4d3ddc09a50f10dc82a53523

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 251636
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18076
x-xss-protection: 0
server: sffe
date: Tue, 27 Oct 2020 23:39:10 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "a692ffddf0ade807"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Oct 2021 23:39:10 GMT

GET
H3-Q050 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/032010270040000/v0/ Frame 1DA5 4 KB
2 KB 12ms
10ms Script
text/javascript 2a00:1450:4001:814::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032010270040000/v0/amp-fit-text-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a084f9fa314be804daeb5314c0dcf00022a8d8a1319a990b9546860e2ca8753

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 253550
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1794
x-xss-protection: 0
server: sffe
date: Tue, 27 Oct 2020 23:07:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "97d72cd21f25600f"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Oct 2021 23:07:16 GMT

GET
H3-Q050 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/032010270040000/v0/ Frame 1DA5 45 KB
14 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:814::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/032010270040000/v0/amp-form-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8637b0501ace1a66eb37373c3440baf7ac214692ac755d90d901d1c1587f3f6c

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 253550
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14173
x-xss-protection: 0
server: sffe
date: Tue, 27 Oct 2020 23:07:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "e02eb5bdf732790a"
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Oct 2021 23:07:16 GMT

GET
H3-Q050 200 css
fonts.googleapis.com/ Frame 1DA5 1 KB
456 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:820::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:700,400

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e9bc1aae5d071164156ac6685a10f027f619075588ccdfc093d8f96cd26ded26

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 30 Oct 2020 21:15:03 GMT
server: ESF
date: Fri, 30 Oct 2020 21:33:06 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 30 Oct 2020 21:33:06 GMT

GET
H3-Q050 200 css
fonts.googleapis.com/ Frame 1DA5 3 KB
613 B 18ms
17ms Stylesheet
text/css 2a00:1450:4001:820::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%20Condensed:400

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

38cb9a71128d5db487a5dd3563b18a480301f160f0e1f05e98199818b40d61e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 30 Oct 2020 21:33:06 GMT
server: ESF
date: Fri, 30 Oct 2020 21:33:06 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 30 Oct 2020 21:33:06 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 1DA5 2 KB
2 KB 9ms
8ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 30 Oct 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 37448
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Sat, 31 Oct 2020 11:08:58 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 1DA5 295 B
319 B 9ms
8ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 29 Oct 2020 22:32:01 GMT
x-content-type-options: nosniff
server: cafe
age: 82865
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 30 Oct 2020 22:32:01 GMT

GET
H3-Q050 204 l
www.google.com/ads/measurement/ Frame 1DA5 0
0 15ms
14ms Image
text/html 2a00:1450:4001:81a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSDbJjvZOeFPtRtF38CMi2LDGr3j1kCnqd8qP2nQrkUBJIwsAKaT3mkxGAV6JrwRMa51Y7M
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 1DA5 0
0 47ms
46ms Image
text/html 172.217.21.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=ClxPKkYacX6KsLNSbgQeugaCIA_LLpu9fvdnp_rwM-rSM8b4BEAEg0YfSIGD1lc6B4ASgAaugk58CyAEJqQLMUqbDsUqyPuACAKgDAcgDCKoEqwJP0PkSlxK4RFRbN8T7QY86vj5G1hi_NfXnfwSDdUSmewQqsF5SXkqZHmMISym1DogUanoFWLSIbgEgiKH07AFHeom9b0oov4Jjg9CdISzUpJjXBjI20WMuAf6qxk5rxz7pqasX5sDn9QcAAE_9fZTL7AhcRDvx9ziFPaSurE8B_akMZMP8LvWcgdw-gwJ6tF7VbuaY1ntvUuwVhSZacakck0FlZx111NWHmvIHb_-aQAd6Lp-Qvsi7yVDiG1TqOPFPoB7HR5lus3MEnxIXTOFs-SHjRSO0NX1NNt5LZIwB596LvaT1zxst5XCFKR_0POOA5VWEj2V5aOQI3xS6Ilc_R9RZDiLTIXzz4U1c3ns1aWNFnTvNlhra5PN65_8d410D9gmltoBjfAdwKsAEs9zyi58D4AQBkgUECAQYAZIFBAgFGASgBi6AB73f7OABqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEEPSyNtIICQiA4YBAEAEYHfIIG2FkeC1zdWJzeW4tNzI2MzU3MzQ0NjgwNDA3OIAKA8gLAbIMFHB1Yi05Njg1NzM0NDQ1NDc2ODE0wgwCCAHYEw0&sigh=JlmdjhtHMA8&template_id=419&tpd=AGWhJmv6fP0weqDLI2I9Ra0M7_r8uqTRMP7I9Ldw_F_X7fTniQ
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 172.217.21.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s13-in-f226.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 66019e7147d963cc1f94fbdefaf0fd20.jpg
tpc.googlesyndication.com/sadbundle/14659877060161173457/media/ Frame 1DA5 42 KB
42 KB 12ms
12ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/14659877060161173457/media/66019e7147d963cc1f94fbdefaf0fd20.jpg

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5783dc9bd9c49e0df78654420128996461fb42be3e2874bc8ec7c96f1f2e4fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 29 Oct 2020 11:43:34 GMT
x-content-type-options: nosniff
age: 121772
x-dns-prefetch-control: off
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43480
x-xss-protection: 0
last-modified: Wed, 23 Sep 2020 07:15:43 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Oct 2021 11:43:34 GMT

GET
H3-Q050 200 32ae814996b4bb04eca4372e83a6df23.png
tpc.googlesyndication.com/sadbundle/14659877060161173457/media/ Frame 1DA5 46 KB
46 KB 12ms
11ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/14659877060161173457/media/32ae814996b4bb04eca4372e83a6df23.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3be11f9ebd54a6c51e13196bfbc965a968681f5422d4ebd821eff51c6e9c8473

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 29 Oct 2020 11:43:34 GMT
x-content-type-options: nosniff
age: 121772
x-dns-prefetch-control: off
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47348
x-xss-protection: 0
last-modified: Wed, 23 Sep 2020 07:15:43 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Oct 2021 11:43:34 GMT

GET
H3-Q050 200 3bdaf7e57d3639b689ad85585e344e6a.svg
tpc.googlesyndication.com/sadbundle/14659877060161173457/media/ Frame 1DA5 7 KB
3 KB 15ms
14ms Image
image/svg+xml 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/14659877060161173457/media/3bdaf7e57d3639b689ad85585e344e6a.svg

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0ac7ae7534a5adac4aa0f361ee4ea6c5c98c072cfdb6f3503514f74c0b1a8509

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 17:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13538
x-dns-prefetch-control: off
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3005
x-xss-protection: 0
last-modified: Wed, 23 Sep 2020 07:15:43 GMT
server: sffe
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Oct 2021 17:47:28 GMT

GET
DATA 200
OK truncated
/ Frame 1DA5 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4862ab203a324923197af03cc62a93c2bdfd0b1de8fea281884b5ffc6fa880c0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame B4A2 0
427 B 184ms
58ms Other
text/plain 65.9.20.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=0&d=eyJzaXRlSWQiOiJtYXRoLWFpZHMtdGhyZWF0cG9zdCIsInVybCI6Imh0dHBzOi8vdGhyZWF0cG9zdC5jb20vc2hsYXllci1tYWMtbWFsd2FyZS1leHRyYS1zbmVha2luZXNzLzE1NjY2OS8%2Fd2ViX3ZpZXc9dHJ1ZSIsImFkVW5pdCI6Ii8yMTcwNzEyNDMzNi9UaHJlYXRQb3N0LTJ4Mi1Ta2luXzAiLCJhZFNlcnZlckRldGFpbHMiOnsiYWR2ZXJ0aXNlcklkIjoiNDYwMTEyOTIwNiIsImNhbXBhaWduSWQiOiIyMzU3OTQ0NDYyIiwiY3JlYXRpdmVJZCI6IjEzODMwMTUxOTExNiIsImxpbmVpdGVtSWQiOiI1MjgzNjQ1MTEwIiwiYWRTZXJ2ZXIiOiJkZnAifSwid2lkdGgiOjIsImhlaWdodCI6Miwid3YiOiIxLjAuMCs5YTRmN2NlIiwiYnYiOiIxLjAuMCs5YTRmN2NlIiwidGFnTWFya3VwIjoiPGh0bWw%2BPGhlYWQ%2BPHNjcmlwdCBzcmM9XCJodHRwczovL3RhZ2FuLmFkbGlnaHRuaW5nLmNvbS9tYXRoLWFpZHMtdGhyZWF0cG9zdC9ibC0wNGEzMzg1LWJiN2EyNWZiLmpzXCIgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiPjwvc2NyaXB0PjxzY3JpcHQgc3JjPVwiaHR0cHM6Ly90YWdhbi5hZGxpZ2h0bmluZy5jb20vbWF0aC1haWRzLXRocmVhdHBvc3QvYi05YTRmN2NlLWE3ZjYwOThjLmpzXCIgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiPjwvc2NyaXB0PjxzY3JpcHQ%2Bd2luZG93W1wiNzY2MDM1NDZfbWF0aC1haWRzLXRocmVhdHBvc3RcIl0gPSB3aW5kb3dbXCI3NjYwMzU0Nl9tYXRoLWFpZHMtdGhyZWF0cG9zdFwiXSB8fCB7fTt3aW5kb3dbXCI3NjYwMzU0Nl9tYXRoLWFpZHMtdGhyZWF0cG9zdFwiXS50YWdEZXRhaWxzID0gd2luZG93W1wiNzY2MDM1NDZfbWF0aC1haWRzLXRocmVhdHBvc3RcIl0udGFnRGV0YWlscyB8fCB7XCJzaXRlSWRcIjpcIm1hdGgtYWlkcy10aHJlYXRwb3N0XCIsXCJ3dlwiOlwiMS4wLjArOWE0ZjdjZVwiLFwidG9wRG9tYWluXCI6XCJodHRwczovL3RocmVhdHBvc3QuY29tL3NobGF5ZXItbWFjLW1hbHdhcmUtZXh0cmEtc25lYWtpbmVzcy8xNTY2NjkvP3dlYl92aWV3PXRydWVcIixcImN1cnJlbnRUYWdJZFwiOlwiYWRsdGFnX2tnd3J3a2x3X3JyTTRYNjN2MGNFXCIsXCJhdVwiOlwiLzIxNzA3MTI0MzM2L1RocmVhdFBvc3QtMngyLVNraW5fMFwiLFwic2xvdEVsZW1lbnRJZFwiOlwiZGl2LWdwdC1hZC02Nzk0NjcwLTFcIixcImFkU2VydmVyRGV0YWlsc1wiOntcImFkdmVydGlzZXJJZFwiOlwiNDYwMTEyOTIwNlwiLFwiY2FtcGFpZ25JZFwiOlwiMjM1Nzk0NDQ2MlwiLFwiY3JlYXRpdmVJZFwiOlwiMTM4MzAxNTE5MTE2XCIsXCJsaW5laXRlbUlkXCI6XCI1MjgzNjQ1MTEwXCIsXCJhZFNlcnZlclwiOlwiZGZwXCJ9LFwid1wiOjIsXCJoXCI6Mn07d2luZG93LmJsb2NrZXIgJiYgYmxvY2tlcihcIjc2NjAzNTQ2X21hdGgtYWlkcy10aHJlYXRwb3N0XCIsIFwiPCEtLUFETF9XUkFQUEVELS0%2BXCIsIGZhbHNlLCB3aW5kb3csIHt9KTs8L3NjcmlwdD48L2hlYWQ%2BPC9odG1sPjwhLS0gSUZSQU1FIElOTkVSIENPTlRFTlQgLS0%2BIiwibWV0YSI6eyJwbFJhdGlvIjowLjAxfX0%3D&i=1-1&t=adltag_kgwrwklw_rrM4X63v0cE&r=f96a8fc6b39d7db8c4ca6d501bbddf1&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.20.54 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 f857c6fa23ed7b2d0b237aefe9c50960.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 29050
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Fri, 30 Oct 2020 13:28:57 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
x-amz-cf-id: cPa4mT_tKFNjWBM64Czm0lBpABgJC34lWFxTt-jcfZkN3_qr0DnPIQ==

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame B4A2 0
0 46ms
46ms Fetch
image/gif 172.217.21.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstuRYIMMyJmelj-PcpnioRR4pcdilb7KO4dW0pDZNHDT1qHlO3QC2mGGuw-yDAG5Ul_8r6tNFxuv5IRTJ_Xfd2kTVndv_AcioZPPXySLgnU6w8n3eZDwcy-PjfUJP8LufPZE0jLha_2tV4EM-JLC2skCs3PTHEcg4UqpLKm9bG8GuKeThyeC5gEztmGeU88Z46P9OyjLBpE_xENiMWkJqjjooktjD7oug1URKp2NBSBPiyJWqZYQ64B6mSvI9TI2bOWBmikAwE8WgQNgVvIXA&sai=AMfl-YRvCYSa2gKB6VyEuLFFanxupaF-rGql_B5_otGRO9AwjwLGWbEIxxnArjv2MJSgmngU3PnxDzY_RsMpNK78iGw0ozNo8dHDYdoI4ei6uNajCM_xrS6CFZ_n8z1Iiew&sig=Cg0ArKJSzD4W5_3hbuccEAE&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.21.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s13-in-f226.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 30 Oct 2020 21:33:06 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame B4A2 0
21 B 45ms
45ms Image
image/gif 172.217.21.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstGRtc3mGpcDPZD1omHgEG4r8FC59VsarK6d2DE-3LKrDCpHvOUEbGjcgycOUFSdl3Czo4pr4RM-8fLuOZPuAipZc96KWgpbwk5QUKadsOtX55auWZi_qqYOF5_4mA4OR78fUfoRQaNVz7JYEiycDkpHSEqvw5CnTADNFDSw4GiqKdsHVfQWCAELs6SvSpZld2P2VI-05PDlqcPBdgtWJTEiOLoyaOBq5vsZ1Lglowx68m1HvEan8QaKjnOZB0gqc37qj7xnqiKMud-jy2PpLsa&sai=AMfl-YQIR-QaG4nlJz_evjZ2X3wbnP45IRj4M_3tAks7uxedtP0ugSnIgsoM3d7uW0RdYylmHMOVLcRoO7nBjfiwRrp49LgRffITdfz7__x5otGcDVQS7ecWx12T3GUdPLw&sig=Cg0ArKJSzC3mnp-OMyoqEAE&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.21.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s13-in-f226.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 30 Oct 2020 21:33:06 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame B4A2 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0a40c1b3bc56eeffdc9b506edb8d6b916fed7f315ad207d7df2a846476748e31

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 5535 11 KB
11 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:815::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 11:20:34 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:48 GMT
server: sffe
age: 36752
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11056
x-xss-protection: 0
expires: Sat, 30 Oct 2021 11:20:34 GMT

GET
H3-Q050 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ Frame 5535 11 KB
11 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:815::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://fonts.googleapis.com/css?family=Roboto:400,500&lang=en
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 11:20:34 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 36752
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Sat, 30 Oct 2021 11:20:34 GMT

GET
H3-Q050 200 ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQk6YvM.woff2
fonts.gstatic.com/s/robotocondensed/v19/ Frame 1DA5 11 KB
11 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:815::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotocondensed/v19/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQk6YvM.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%20Condensed:400

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

49a1b4e1296645aa2f513c87a0e5fe56a305a7ed678c2f6499631ec1f3b35856

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://fonts.googleapis.com/css?family=Roboto%20Condensed:400
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 11:20:40 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:08:42 GMT
server: sffe
age: 36746
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10968
x-xss-protection: 0
expires: Sat, 30 Oct 2021 11:20:40 GMT

GET
H3-Q050 200 S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v17/ Frame 1DA5 14 KB
14 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:815::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:700,400

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://fonts.googleapis.com/css?family=Lato:700,400
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 29 Oct 2020 04:50:44 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:12:25 GMT
server: sffe
age: 146542
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14176
x-xss-protection: 0
expires: Fri, 29 Oct 2021 04:50:44 GMT

GET
H3-Q050 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v17/ Frame 1DA5 14 KB
14 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:815::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:700,400

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://fonts.googleapis.com/css?family=Lato:700,400
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 11:20:37 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:12:59 GMT
server: sffe
age: 36749
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14044
x-xss-protection: 0
expires: Sat, 30 Oct 2021 11:20:37 GMT

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 29CE
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

14ms
14ms

Image
text/html

2a00:1450:4001:824::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:824::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date: Fri, 30 Oct 2020 21:33:06 GMT
x-content-type-options: nosniff
server: safe
status: 302
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame B4A2 0
427 B 61ms
60ms Other
text/plain 65.9.20.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=eyJzaXRlSWQiOiJtYXRoLWFpZHMtdGhyZWF0cG9zdCIsInVybCI6Imh0dHBzOi8vdGhyZWF0cG9zdC5jb20vc2hsYXllci1tYWMtbWFsd2FyZS1leHRyYS1zbmVha2luZXNzLzE1NjY2OS8%2Fd2ViX3ZpZXc9dHJ1ZSIsImFkVW5pdCI6Ii8yMTcwNzEyNDMzNi9UaHJlYXRQb3N0LTJ4Mi1Ta2luXzAiLCJhZFNlcnZlckRldGFpbHMiOnsiYWR2ZXJ0aXNlcklkIjoiNDYwMTEyOTIwNiIsImNhbXBhaWduSWQiOiIyMzU3OTQ0NDYyIiwiY3JlYXRpdmVJZCI6IjEzODMwMTUxOTExNiIsImxpbmVpdGVtSWQiOiI1MjgzNjQ1MTEwIiwiYWRTZXJ2ZXIiOiJkZnAifSwid2lkdGgiOjIsImhlaWdodCI6Miwid3YiOiIxLjAuMCs5YTRmN2NlIiwiYnYiOiIxLjAuMCs5YTRmN2NlIiwidGFnTWFya3VwIjoiPGh0bWw%2BPGhlYWQ%2BPHNjcmlwdCBzcmM9XCJodHRwczovL3RhZ2FuLmFkbGlnaHRuaW5nLmNvbS9tYXRoLWFpZHMtdGhyZWF0cG9zdC9ibC0wNGEzMzg1LWJiN2EyNWZiLmpzXCIgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiPjwvc2NyaXB0PjxzY3JpcHQgc3JjPVwiaHR0cHM6Ly90YWdhbi5hZGxpZ2h0bmluZy5jb20vbWF0aC1haWRzLXRocmVhdHBvc3QvYi05YTRmN2NlLWE3ZjYwOThjLmpzXCIgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiPjwvc2NyaXB0PjxzY3JpcHQ%2Bd2luZG93W1wiNzY2MDM1NDZfbWF0aC1haWRzLXRocmVhdHBvc3RcIl0gPSB3aW5kb3dbXCI3NjYwMzU0Nl9tYXRoLWFpZHMtdGhyZWF0cG9zdFwiXSB8fCB7fTt3aW5kb3dbXCI3NjYwMzU0Nl9tYXRoLWFpZHMtdGhyZWF0cG9zdFwiXS50YWdEZXRhaWxzID0gd2luZG93W1wiNzY2MDM1NDZfbWF0aC1haWRzLXRocmVhdHBvc3RcIl0udGFnRGV0YWlscyB8fCB7XCJzaXRlSWRcIjpcIm1hdGgtYWlkcy10aHJlYXRwb3N0XCIsXCJ3dlwiOlwiMS4wLjArOWE0ZjdjZVwiLFwidG9wRG9tYWluXCI6XCJodHRwczovL3RocmVhdHBvc3QuY29tL3NobGF5ZXItbWFjLW1hbHdhcmUtZXh0cmEtc25lYWtpbmVzcy8xNTY2NjkvP3dlYl92aWV3PXRydWVcIixcImN1cnJlbnRUYWdJZFwiOlwiYWRsdGFnX2tnd3J3a2x3X3JyTTRYNjN2MGNFXCIsXCJhdVwiOlwiLzIxNzA3MTI0MzM2L1RocmVhdFBvc3QtMngyLVNraW5fMFwiLFwic2xvdEVsZW1lbnRJZFwiOlwiZGl2LWdwdC1hZC02Nzk0NjcwLTFcIixcImFkU2VydmVyRGV0YWlsc1wiOntcImFkdmVydGlzZXJJZFwiOlwiNDYwMTEyOTIwNlwiLFwiY2FtcGFpZ25JZFwiOlwiMjM1Nzk0NDQ2MlwiLFwiY3JlYXRpdmVJZFwiOlwiMTM4MzAxNTE5MTE2XCIsXCJsaW5laXRlbUlkXCI6XCI1MjgzNjQ1MTEwXCIsXCJhZFNlcnZlclwiOlwiZGZwXCJ9LFwid1wiOjIsXCJoXCI6Mn07d2luZG93LmJsb2NrZXIgJiYgYmxvY2tlcihcIjc2NjAzNTQ2X21hdGgtYWlkcy10aHJlYXRwb3N0XCIsIFwiPCEtLUFETF9XUkFQUEVELS0%2BXCIsIGZhbHNlLCB3aW5kb3csIHt9KTs8L3NjcmlwdD48c2NyaXB0PnZhciBqc2NWZXJzaW9uID0gJ3IyMDIwMTAyNyc7PC9zY3JpcHQ%2BPHNjcmlwdD52YXIgZ29vZ2xlX2Nhc209W107PC9zY3JpcHQ%2BPHN0eWxlPmEgeyBjb2xvcjogIzAwMDAwMCB9PC9zdHlsZT48c2NyaXB0PmZ1bmN0aW9uIHN1KGlkKSB7dmFyIGEgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZChpZCk7dmFyIGIgPSAobmV3IERhdGUoKSkuZ2V0VGltZSgpO2lmIChhICYmIGEubXl0ICYmIGIpIHt2YXIgdCA9IGIgLSBhLm15dDtpZiAod2luZG93LmNzcykge2NzcyhpZCwnY2xrdCcsdCk7cmV0dXJuO312YXIgYmkgPSBhLmhyZWYuaW5kZXhPZihcIiZjbGt0PVwiKTtpZiAoYmkgPiAwKSB7dmFyIGMgPSBhLmhyZWYuc3Vic3RyaW5nKDAsIGJpKzYpOyB2YXIgZCA9IGEuaHJlZi5zdWJzdHJpbmcoYmkrNiwgYS5ocmVmLmxlbmd0aCk7dmFyIGVpID0gZC5pbmRleE9mKFwiJlwiKTt2YXIgciA9ICcnO2lmIChlaSA%2BPSAwKXIgPSBkLnN1YnN0cmluZyhlaSwgZC5sZW5ndGgpO2EuaHJlZiA9IGMgKyB0ICsgcjsgfSBlbHNlIHthLmhyZWYgKz0gXCImY2xrdD1cIiArIHQ7fX19PC9zY3JpcHQ%2BPHNjcmlwdD53aW5kb3cuZGljbmYgPSB7fTs8L3NjcmlwdD48c2NyaXB0IGRhdGEtamM9XCI0MlwiIGRhdGEtamMtdmVyc2lvbj1cInIyMDIwMTAyN1wiPihmdW5jdGlvbigpey8qICBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMCAqLyAndXNlIHN0cmljdCc7d2luZG93LnZpZXdSZXE9W107Y29uc3QgYz1hPT57ZmV0Y2goYSx7a2VlcGFsaXZlOiEwLGNyZWRlbnRpYWxzOlwiaW5jbHVkZVwiLHJlZGlyZWN0OlwiZm9sbG93XCIsbWV0aG9kOlwiZ2V0XCIsbW9kZTpcIm5vLWNvcnNcIn0pLmNhdGNoKCgpPT57e2NvbnN0IGI9bmV3IEltYWdlO2Iuc3JjPWEucmVwbGFjZShcIiZhbXA7XCIsXCImXCIpO3ZpZXdSZXEucHVzaChiKX19KX07d2luZG93LnZ1PWE9PntpZih3aW5kb3cuZmV0Y2gpYyhhKTtlbHNle3tjb25zdCBiPW5ldyBJbWFnZTtiLnNyYz1hLnJlcGxhY2UoXCImYW1wO1wiLFwiJlwiKTt2aWV3UmVxLnB1c2goYil9fX07fSkuY2FsbCh0aGlzKTs8L3NjcmlwdD48c2NyaXB0IGRhdGEtamM9XCI1M1wiIGRhdGEtamMtdmVyc2lvbj1cInIyMDIwMTAyN1wiPihmdW5jdGlvbigpey8qICBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMCAqLyAndXNlIHN0cmljdCc7dmFyIGc9dGhpc3x8c2VsZjtmdW5jdGlvbiBoKGEsYixjKXtyZXR1cm4gYS5jYWxsLmFwcGx5KGEuYmluZCxhcmd1bWVudHMpfWZ1bmN0aW9uIGsoYSxiLGMpe2lmKCFhKXRocm93IEVycm9yKCk7aWYoMjxhcmd1bWVudHMubGVuZ3RoKXt2YXIgZD1BcnJheS5wcm90b3R5cGUuc2xpY2UuY2FsbChhcmd1bWVudHMsMik7cmV0dXJuIGZ1bmN0aW9uKCl7dmFyIGU9QXJyYXkucHJvdG90eXBlLnNsaWNlLmNhbGwoYXJndW1lbnRzKTtBcnJheS5wcm90b3R5cGUudW5zaGlmdC5hcHBseShlLGQpO3JldHVybiBhLmFwcGx5KGIsZSl9fXJldHVybiBmdW5jdGlvbigpe3JldHVybiBhLmFwcGx5KGIsYXJndW1lbnRzKX19IGZ1bmN0aW9uIGwoYSxiLGMpe0Z1bmN0aW9uLnByb3RvdHlwZS5iaW5kJiYtMSE9RnVuY3Rpb24ucHJvdG90eXBlLmJpbmQudG9TdHJpbmcoKS5pbmRleE9mKFwibmF0aXZlIGNvZGVcIik%2FbD1oOmw9aztyZXR1cm4gbC5hcHBseShudWxsLGFyZ3VtZW50cyl9ZnVuY3Rpb24gbihhLGIpe2E9YS5zcGxpdChcIi5cIik7dmFyIGM9ZzthWzBdaW4gY3x8XCJ1bmRlZmluZWRcIj09dHlwZW9mIGMuZXhlY1NjcmlwdHx8Yy5leGVjU2NyaXB0KFwidmFyIFwiK2FbMF0pO2Zvcih2YXIgZDthLmxlbmd0aCYmKGQ9YS5zaGlmdCgpKTspYS5sZW5ndGh8fHZvaWQgMD09PWI%2FY1tkXSYmY1tkXSE9PU9iamVjdC5wcm90b3R5cGVbZF0%2FYz1jW2RdOmM9Y1tkXT17fTpjW2RdPWJ9O2Z1bmN0aW9uIHAoYSl7bGV0IGI9ITEsYztyZXR1cm4gZnVuY3Rpb24oKXtifHwoYz1hKCksYj0hMCk7cmV0dXJuIGN9fTtmdW5jdGlvbiBxKGEpe3FbXCIgXCJdKGEpO3JldHVybiBhfXFbXCIgXCJdPWZ1bmN0aW9uKCl7fTt2YXIgcj17Y2FwdHVyZTohMH0sdD1wKGZ1bmN0aW9uKCl7bGV0IGE9ITE7dHJ5e2NvbnN0IGI9T2JqZWN0LmRlZmluZVByb3BlcnR5KHt9LFwicGFzc2l2ZVwiLHtnZXQ6ZnVuY3Rpb24oKXthPSEwfX0pO2cuYWRkRXZlbnRMaXN0ZW5lcihcInRlc3RcIixudWxsLGIpfWNhdGNoKGIpe31yZXR1cm4gYX0pO2Z1bmN0aW9uIHUoYSl7cmV0dXJuIGE%2FYS5wYXNzaXZlJiZ0KCk%2FYTphLmNhcHR1cmV8fCExOiExfWZ1bmN0aW9uIHgoYSxiLGMsZCl7YS5hZGRFdmVudExpc3RlbmVyJiZhLmFkZEV2ZW50TGlzdGVuZXIoYixjLHUoZCkpfTtmdW5jdGlvbiB5KGEsYil7aWYoIWF8fCFiKXJldHVybiExO2lmKGEuY29udGFpbnMmJjE9PWIubm9kZVR5cGUpcmV0dXJuIGE9PWJ8fGEuY29udGFpbnMoYik7aWYoXCJ1bmRlZmluZWRcIiE9dHlwZW9mIGEuY29tcGFyZURvY3VtZW50UG9zaXRpb24pcmV0dXJuIGE9PWJ8fCEhKGEuY29tcGFyZURvY3VtZW50UG9zaXRpb24oYikmMTYpO2Zvcig7YiYmYSE9YjspYj1iLnBhcmVudE5vZGU7cmV0dXJuIGI9PWF9O2Z1bmN0aW9uIHooKXt2YXIgYT1BO3RyeXt2YXIgYjtpZihiPSEhYSYmbnVsbCE9YS5sb2NhdGlvbi5ocmVmKWE6e3RyeXtxKGEuZm9vKTtiPSEwO2JyZWFrIGF9Y2F0Y2goYyl7fWI9ITF9cmV0dXJuIGJ9Y2F0Y2goYyl7cmV0dXJuITF9fTt2YXIgQj1kb2N1bWVudDt2YXIgRD17fTt2YXIgRT1jbGFzc3t9LEY9Y2xhc3MgZXh0ZW5kcyBFe2NvbnN0cnVjdG9yKGEpe3N1cGVyKCk7aWYoRCE9PUQpdGhyb3cgRXJyb3IoXCJCYWQgc2VjcmV0XCIpO3RoaXMuYT1hfXRvU3RyaW5nKCl7cmV0dXJuIHRoaXMuYX19O25ldyBGKFwiYWJvdXQ6YmxhbmtcIik7bmV3IEYoXCJhYm91dDppbnZhbGlkI3pUU3pcIik7dmFyIEc9ISF3aW5kb3cuZ29vZ2xlX2FzeW5jX2lmcmFtZV9pZDtsZXQgQT1HJiZ3aW5kb3cucGFyZW50fHx3aW5kb3c7bGV0IEk9bnVsbDtjbGFzcyBKe2NvbnN0cnVjdG9yKGEsYil7dmFyIGM9KGM9Zy5wZXJmb3JtYW5jZSkmJmMubm93P2Mubm93KCk6bnVsbDtjfHwoYz0oYz1nLnBlcmZvcm1hbmNlKSYmYy5ub3cmJmMudGltaW5nP01hdGguZmxvb3IoYy5ub3coKStjLnRpbWluZy5uYXZpZ2F0aW9uU3RhcnQpOkRhdGUubm93KCkpO3RoaXMubGFiZWw9YTt0aGlzLnR5cGU9Yjt0aGlzLnZhbHVlPWM7dGhpcy5kdXJhdGlvbj0wO3RoaXMudW5pcXVlSWQ9TWF0aC5yYW5kb20oKTt0aGlzLnNsb3RJZD12b2lkIDB9fTtjb25zdCBLPWcucGVyZm9ybWFuY2UsYWE9ISEoSyYmSy5tYXJrJiZLLm1lYXN1cmUmJksuY2xlYXJNYXJrcyksTD1wKCgpPT57dmFyIGE7aWYoYT1hYSl7dmFyIGI7aWYobnVsbD09PUkpe0k9XCJcIjt0cnl7YT1cIlwiO3RyeXthPWcudG9wLmxvY2F0aW9uLmhhc2h9Y2F0Y2goYyl7YT1nLmxvY2F0aW9uLmhhc2h9YSYmKEk9KGI9YS5tYXRjaCgvXFxiZGVpZD0oW1xcZCxdKykvKSk%2FYlsxXTpcIlwiKX1jYXRjaChjKXt9fWI9STthPSEhYi5pbmRleE9mJiYwPD1iLmluZGV4T2YoXCIxMzM3XCIpfXJldHVybiBhfSk7ZnVuY3Rpb24gYmEoYSl7YSYmSyYmTCgpJiYoSy5jbGVhck1hcmtzKGBnb29nXyR7YS5sYWJlbH1fJHthLnVuaXF1ZUlkfV9zdGFydGApLEsuY2xlYXJNYXJrcyhgZ29vZ18ke2EubGFiZWx9XyR7YS51bmlxdWVJZH1fZW5kYCkpfSBjbGFzcyBjYXtjb25zdHJ1Y3Rvcigpe3ZhciBhPU07dGhpcy5hPVtdO3RoaXMuYz1hfHxnO2xldCBiPW51bGw7YSYmKGEuZ29vZ2xlX2pzX3JlcG9ydGluZ19xdWV1ZT1hLmdvb2dsZV9qc19yZXBvcnRpbmdfcXVldWV8fFtdLHRoaXMuYT1hLmdvb2dsZV9qc19yZXBvcnRpbmdfcXVldWUsYj1hLmdvb2dsZV9tZWFzdXJlX2pzX3RpbWluZyk7dGhpcy5iPUwoKXx8KG51bGwhPWI%2FYjoxPk1hdGgucmFuZG9tKCkpfXN0YXJ0KGEsYil7aWYoIXRoaXMuYilyZXR1cm4gbnVsbDthPW5ldyBKKGEsYik7Yj1gZ29vZ18ke2EubGFiZWx9XyR7YS51bmlxdWVJZH1fc3RhcnRgO0smJkwoKSYmSy5tYXJrKGIpO3JldHVybiBhfX07aWYoRyYmIXooKSl7bGV0IGE9XCIuXCIrQi5kb21haW47dHJ5e2Zvcig7MjxhLnNwbGl0KFwiLlwiKS5sZW5ndGgmJiF6KCk7KUIuZG9tYWluPWE9YS5zdWJzdHIoYS5pbmRleE9mKFwiLlwiKSsxKSxBPXdpbmRvdy5wYXJlbnR9Y2F0Y2goYil7fXooKXx8KEE9d2luZG93KX1jb25zdCBNPUEsTj1uZXcgY2E7dmFyIE89KCk9PntNLmdvb2dsZV9tZWFzdXJlX2pzX3RpbWluZ3x8KE4uYj0hMSxOLmEhPU4uYy5nb29nbGVfanNfcmVwb3J0aW5nX3F1ZXVlJiYoTCgpJiZBcnJheS5wcm90b3R5cGUuZm9yRWFjaC5jYWxsKE4uYSxiYSx2b2lkIDApLE4uYS5sZW5ndGg9MCkpfTtcIm51bWJlclwiIT09dHlwZW9mIE0uZ29vZ2xlX3NydCYmKE0uZ29vZ2xlX3NydD1NYXRoLnJhbmRvbSgpKTtcImNvbXBsZXRlXCI9PU0uZG9jdW1l&i=1-6&t=adltag_kgwrwklw_rrM4X63v0cE&r=2e511a72bb7ad7582eb7de24a38f307&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.20.54 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 f857c6fa23ed7b2d0b237aefe9c50960.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 29050
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Fri, 30 Oct 2020 13:28:57 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
x-amz-cf-id: Mr6HukScRCA2HEqHyNOiDSnkY9qaFmzqhhnXiI_cAY4hlVsWwcmNmg==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame B4A2 0
427 B 83ms
82ms Other
text/plain 65.9.20.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=bnQucmVhZHlTdGF0ZT9PKCk6Ti5iJiZ4KE0sXCJsb2FkXCIsKCk9PntPKCl9KTt2YXIgUD0oYSxiLGMsZCxlKT0%2Be3dpbmRvdy5jc3M%2Fd2luZG93LmNzcyhiLGMsZCxlLHZvaWQgMCk6YSYmKGI9YS5ocmVmLGU%2FZD1iKyhcIiZcIitjK1wiPVwiK2QpOihlPVwiJlwiK2MrXCI9XCIsYz1iLmluZGV4T2YoZSksMD5jP2Q9YitlK2Q6KGMrPWUubGVuZ3RoLGU9Yi5pbmRleE9mKFwiJlwiLGMpLGQ9MDw9ZT9iLnN1YnN0cmluZygwLGMpK2QrYi5zdWJzdHJpbmcoZSk6Yi5zdWJzdHJpbmcoMCxjKStkKSksYj0yRTM8ZC5sZW5ndGg%2FYjpkLGEuaHJlZj1iKX07bGV0IFE9ITEsUj0hMSxTPW51bGw7dmFyIGRhPSgpPT57ZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lciYmeChkb2N1bWVudCxcImNsaWNrXCIsYT0%2Be1M9YX0scil9LGVhPSgpPT57Y29uc3QgYT1TO3JldHVybiBhP1F8fFI%2FITE6KGEucHJldmVudERlZmF1bHQ%2FYS5wcmV2ZW50RGVmYXVsdCgpOmEucmV0dXJuVmFsdWU9ITEsITApOiExfSxmYT0oKT0%2Be3goZG9jdW1lbnQsXCJtb3VzZWRvd25cIiwoKT0%2Be1E9ITB9KTt4KGRvY3VtZW50LFwia2V5ZG93blwiLCgpPT57Uj0hMH0pO2RhKCl9O3ZhciBoYT0oYSxiPTE3KT0%2Be2lmKDA%2BYnx8cGFyc2VJbnQoYiwxMCkhPT1iKWI9MTc7VChhLGIpfSxpYT0oYSxiKT0%2Be1QoYSxifHwxKX0samE9YT0%2Be1QoYSwyKX0sa2E9KGEsYik9PntUKGEsYnx8MCl9O2xldCBVPXt9LFY9ITA7dmFyIFQ9KGEsYik9Pnt2YXIgYztpZihjPVYpdm9pZCAwPT09VVthXSYmKFVbYV09W10pLChjPVVbYV1bYl0pfHwoVVthXVtiXT0hMCk7Y3x8UChkb2N1bWVudC5nZXRFbGVtZW50QnlJZChhKSxhLFwibmJcIixiLFYpfTtmdW5jdGlvbiBXKGEsYixjKXtjb25zdCBkPWEuaWR8fFwiXCI7UChhLGQsXCJueFwiLGIpO1AoYSxkLFwibnlcIixjKX1jbGFzcyBsYXtjb25zdHJ1Y3Rvcigpe3RoaXMuYT10aGlzLmI9bnVsbDtCLmFkZEV2ZW50TGlzdGVuZXImJkIuYWRkRXZlbnRMaXN0ZW5lcihcIm1vdXNlZG93blwiLGwodGhpcy5jLHRoaXMpLCEwKTt4KEIsXCJET01Db250ZW50TG9hZGVkXCIsbChmdW5jdGlvbigpe3RoaXMuYT1CLmdldEVsZW1lbnRCeUlkKFwiY29tbW9uXzE1Y2xpY2tfYW5jaG9yXCIpfSx0aGlzKSl9YyhhKXt0aGlzLmI9YX19O2NvbnN0IG1hPVswLDIsMV07bGV0IFg9bnVsbDt2YXIgWT1hPT57aWYoYSl7dmFyIGI7e2NvbnN0IGM9d2luZG93LmV2ZW50fHxYO2M%2FKChiPWMud2hpY2g%2FMTw8bWFbYy53aGljaC0xXTpjLmJ1dHRvbikmJmMuc2hpZnRLZXkmJihifD04KSxiJiZjLmFsdEtleSYmKGJ8PTE2KSxiJiZjLmN0cmxLZXkmJihifD0zMikpOmI9bnVsbH1iJiZQKGEsYS5pZCxcIm1iXCIsYil9fTtkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyJiZkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKFwibW91c2Vkb3duXCIsYT0%2Be1g9YX0sITApO3dpbmRvdy5tYj1ZO3ZhciBaPXt9LG5hPShhLGI9MixjPVwiXCIpPT57Yz1jP2M6YTsxIT1iJiYodm9pZCAwPT09WltjXT9aW2NdPTE6WltjXSsrKTswIT1iJiZaW2NdJiZQKGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKGEpLGEsXCJubVwiLFpbY10pfTtuKFwiaW5pdF9zc2JcIiwoYSxiLGMsZCxlLG9hKT0%2Be2EmJihmYSgpLG4oXCJhY2Nia1wiLGVhKSk7YiYmKG9hJiYoVj0hMSksbihcImNsYVwiLGhhKSxuKFwiY2xsXCIsaWEpLG4oXCJjbGJcIixqYSksbihcImNsaFwiLGthKSk7aWYoYyl7Y29uc3QgQz1uZXcgbGE7bihcInh5XCIsKGYsSCx2KT0%2Be3t2YXIgbT12fHxIO2NvbnN0IHc9Znx8Qy5iO3cmJkgmJm0mJiF5KEMuYSx3LnRhcmdldCkmJihmPUIucXVlcnlTZWxlY3RvcihcImEub25lLXBvaW50LWZpdmUtY2xpY2sucmhidXR0b25cIiksIWZ8fChmLmNsYXNzTGlzdD9mLmNsYXNzTGlzdC5jb250YWlucyhcInByZWV4cGFuZGVkXCIpOjA8PUFycmF5LnByb3RvdHlwZS5pbmRleE9mLmNhbGwoZi5jbGFzc0xpc3Q%2FZi5jbGFzc0xpc3Q6KFwic3RyaW5nXCI9PXR5cGVvZiBmLmNsYXNzTmFtZT9mLmNsYXNzTmFtZTpmLmdldEF0dHJpYnV0ZSYmZi5nZXRBdHRyaWJ1dGUoXCJjbGFzc1wiKXx8XCJcIikubWF0Y2goL1xcUysvZyl8fFtdLFwicHJlZXhwYW5kZWRcIix2b2lkIDApKXx8ICF5KGYsdy50YXJnZXQpKSYmKHY9TWF0aC5yb3VuZCh3LmNsaWVudFgtbS5vZmZzZXRMZWZ0KSxtPU1hdGgucm91bmQody5jbGllbnRZLW0ub2Zmc2V0VG9wKSxXKEgsdixtKSxDLmEmJlcoQy5hLHYsbSksZiYmVyhmLHYsbSkpfX0pfWQmJm4oXCJtYlwiLFkpO2UmJm4oXCJzc1wiLG5hKX0pO30pLmNhbGwodGhpcyk7PC9zY3JpcHQ%2BPHNjcmlwdD5pbml0X3NzYih0cnVlLGZhbHNlLHRydWUsdHJ1ZSx0cnVlLGZhbHNlKTs8L3NjcmlwdD48c2NyaXB0PmlmICh0eXBlb2Yoc3MpID09PSBcInVuZGVmaW5lZFwiKSB7IHNzID0gZnVuY3Rpb24oKXt9OyB9ZnVuY3Rpb24gc3QoaWQpIHt2YXIgYSA9IGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKGlkKTtpZiAoYSkge2EubXl0ID0gKG5ldyBEYXRlKCkpLmdldFRpbWUoKTt4eSh3aW5kb3cuZXZlbnQsIGEpO21iKGEpO319ZnVuY3Rpb24gaGEoYSx4KXsgIGlmIChhY2NiaygpKSByZXR1cm47c3UoYSk7fWZ1bmN0aW9uIGlhKGEsZSx4KSB7aWYgKGFjY2JrKCkpIHJldHVybjtzdShhKTt9ZnVuY3Rpb24gamEoYSx4KSB7aWYgKGFjY2JrKCkpIHJldHVybjtzdShhKTt9ZnVuY3Rpb24gZ2EobyxlLHgpIHtpZiAoZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQpIHt2YXIgYT1vLmlkLnN1YnN0cmluZygxKSxwPVwiXCIscj1cIlwiLGc9ZS50YXJnZXQsdCxmLGg7aWYgKGcpIHt0PWcuaWQ7Zj1nLnBhcmVudE5vZGU7aWYgKGYpIHtwPWYuaWQ7aD1mLnBhcmVudE5vZGU7aWYgKGgpcj1oLmlkO319IGVsc2Uge2g9ZS5zcmNFbGVtZW50O2Y9aC5wYXJlbnROb2RlO2lmIChmKXA9Zi5pZDt0PWguaWQ7fWlmICh0PT1hfHxwPT1hfHxyPT1hKXJldHVybiB0cnVlO2lhKGEsZSx4KTt3aW5kb3cub3Blbihkb2N1bWVudC5nZXRFbGVtZW50QnlJZChhKS5ocmVmKTt9fTwvc2NyaXB0PjwvaGVhZD48Ym9keSBsZWZ0bWFyZ2luPVwiMFwiIHRvcG1hcmdpbj1cIjBcIiBtYXJnaW53aWR0aD1cIjBcIiBtYXJnaW5oZWlnaHQ9XCIwXCIgc3R5bGU9XCJiYWNrZ3JvdW5kOnRyYW5zcGFyZW50OyBsaW5lLWhlaWdodDowXCIgY2xhc3M9XCJqYXJcIj48ZGl2IGlkPVwiZ29vZ2xlX2ltYWdlX2RpdlwiIHN0eWxlPVwib3ZlcmZsb3c6aGlkZGVuOyBwb3NpdGlvbjphYnNvbHV0ZVwiIGNsYXNzPVwiR29vZ2xlQWN0aXZlVmlld0VsZW1lbnRcIiBkYXRhLWdvb2dsZS1hdi1jeG49XCJodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3Bjcy9hY3RpdmV2aWV3P3hhaT1BS0FPanNzbktaM2RtMUhZZE5pdEFjOFhzN2dDY3pBeDN3MHlrOVB4ODNNMDU5NG1QNjJ2VlZaTnNlZFdhRzVXdFdhLVhQRGphYlZpY3RFUERSU0JfYWViSG1SOTl0WS15UUpzUG5hQi1zZ3dvXzQmYW1wO3NpZz1DZzBBcktKU3pEVnFQRE9QYkZyNUVBRVwiIGRhdGEtZ29vZ2xlLWF2LWFkaz1cIjMzODU5MDY2NTVcIiBkYXRhLWdvb2dsZS1hdi1tZXRhZGF0YT1cImxhPTAmYW1wO3hkaT0wJmFtcDtcIiBkYXRhLWdvb2dsZS1hdi1vdmVycmlkZT1cIi0xXCIgZGF0YS1nb29nbGUtYXYtZG09XCIyXCIgZGF0YS1nb29nbGUtYXYtaW1tZWRpYXRlPVwiXCIgZGF0YS1nb29nbGUtYXYtYWlkPVwiMFwiIGRhdGEtZ29vZ2xlLWF2LW5haWQ9XCIxXCIgZGF0YS1nb29nbGUtYXYtc2xpZnQ9XCJcIiBkYXRhLWdvb2dsZS1hdi1jcG1hdj1cIlwiIGRhdGEtZ29vZ2xlLWF2LWJ0cj1cImh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L3Bjcy92aWV3P3hhaT1BS0FPanN0R1J0YzNtR3BjRFBaRDFvbUhnRUc0cjhGQzU5VnNhcks2ZDJERS0zTEtyRENwSHZPVUViR2pjZ3ljT1VGU2RsM0N6bzRwcjRSTS04Zkx1T1pQdUFpcFpjOTZLV2dwYndrNVFVS2Fkc090WDU1YXVXWmlfcXFZT0Y1XzRtQTRPUjc4ZlVmb1JRYU5WejdKWUVpeWNEa3BIU0Vxdnc1Q25UQURORkRTdzRHaXFLZHNIVmZRV0NBRUxzNlN2U3BabGQyUDJWSS0wNVBEbHFjUEJkZ3RXSlRFaU9Mb3lhT0JxNXZzWjFMZ2xvd3g2OG0xSHZFYW44UWFLam5PWkIwZ3FjMzdxajd4bnFpS011ZC1qeTJQcExzYSZhbXA7c2FpPUFNZmwtWVFJUi1RYUc0bmxKel9ldmpaMlgzd2JuUDQ1SVJqNE1fM3RBa3M3dXhlZHRQMHVnU25JZ3NvTTNkN3VXMFJkWXlsbUhNT1ZMY1JvTzduQmpmaXdScnA0OUxnUmZmSVRkZno3X194NW90R2NEVlFTN2VjV3gxMlQzR1VkUEx3JmFtcDtzaWc9Q2cwQXJLSlN6QzNtbnAtT015b3FFQUUmYW1wO2FkdXJsPVwiIGRhdGEtZ29vZ2xlLWF2LWl0cGw9XCIzXCIgZGF0YS1nb29nbGUtYXYtcnM9XCI0XCIgZGF0YS1nb29nbGUtYXYtZmxhZ3M9XCJbJnF1b3Q7eX4mcXVvdDtdXCI%2BPHNjcmlwdD52dShcImh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L3Bjcy92aWV3P3hhaVxceDNkQUtBT2pzdHVSWUlNTXlKbWVsai1QY3BuaW9SUjRwY2RpbGI3S080ZFcwcERaTkhEVDFxSGxPM1FDMm1HR3V3LXlEQUc1VWxfOHI2dE5GeHV2NUlSVEpfWGZkMmtUVm5kdl9BY2lvWlBQWHlTTGduVTZ3OG4zZVpEd2N5LVBqZlVKUDhMdWZQWkUwakxoYV8ydFY0RU0tSkxDMnNrQ3MzUFRIRWNnNFVxcExLbTliRzhHdUtlVGh5ZUM1Z0V6dG1HZVU4OFo0NlA5T3lqTEJwRV94RU5pTVdrSnFqam9va3RqRDdvdWcxVVJLcDJOQlNCUGl5SldxWllRNjRCNm1Tdkk5VEkyYk9XQm1pa0F3RThXZ1FOZ1Z2SVhBXFx4MjZzYWlcXHgzZEFNZmwtWVJ2Q1lTYTJnS0I2VnlFdUxGRmFueHVwYUYtckdxbF9CNV9vdEdSTzlBd2p3TEdXYkVJeHhuQXJqdjJNSlNnbW5nVTNQbnhEellfUnNNcE5LNzhpR3cwb3pObzhkSERZZG9JNGVpNnVOYWpDTV94clM2Q0ZaX244ejFJaWV3XFx4MjZzaWdcXHgzZENnMEFyS0pTekQ0VzVfM2hidWNjRUFFXFx4MjZhZHVybFxceDNkXCIpPC9zY3JpcHQ%2BPGEgaWQ9XCJhdzBcIiB0YXJnZXQ9XCJfYmxhbmtcIiBocmVmPVwiaHR0cHM6Ly9nb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQvcGNzL2NsaWNrP3hhaT1BS0FPanN0NHN4SWxsdV9yZko5NHpEMTBCbWoxT1lYcXhELVdxQUlRdjBSRFFMaXd5UVAzQk9SeE5NNVdQWmpwMHVrTXJnd28zZlBBbHpVZThKX25kT3E3RXdtQWhtaTF6QUNTaDlpMHM5MjJGalh6bERtRDkzbjEycmUyRnNkMHFXblhoMTRBSEg1YlExY1FhbkgzUWFkWHZBeVl0RFFtX1R4MnBmWmwwYkxjQmxFYTd1djEyamVYNUl4QjZCZVRBMl8zb1d6aFl2M1B1cXRpOTFXeVkwbkNmZnFaLVhaT0VaMDAxdXFFcHdiZ0pKc0JzVnpHVkt1Y1B5TEJhQTV0T2hTTHNidkxJMjFaV2ZCbVoyVC1OQSZhbXA7c2FpPUFNZmwtWVNucUtfYzJ4dzFLLWNoRmpFbmVfZEh1cXZ2SWRiQ2JKc1hJXzI2MnhPb1FfR1U1VEh6VEQ1bm9kQTZRY3d6MFFQaFVOR1c2YlVVcGFsT0ZYZzY1LUd2M3ZVMDlteThsRlR5ajhhWXFOVlhWUEFldzJlVTlqMFNRSTU2akw0JmFtcDtzaWc9Q2cwQXJLSlN6TmpVODY0dmxFMGgmYW1wO2FkdXJsPWh0dHBzOi8vdGhyZWF0cG9zdC5jb20vXCIgb25mb2N1cz1cInNzKCdhdzAnKVwiIG9ubW91c2Vkb3duPVwic3QoJ2F3MCcpXCIgb25tb3VzZW92ZXI9XCJzcygnYXcwJylcIiBvbmNsaWNrPVwiaGEoJ2F3MCcpXCI%2BPGltZyBzcmM9XCJodHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vc2ltZ2FkLzc0NjQ2MzkwMjg2NTIwMzU2ODRcIiBib3JkZXI9XCIwXCIgd2lkdGg9XCIyXCIgaGVpZ2h0PVwiMlwiIGFsdD1cIlwiIGNsYXNzPVwiaW1nX2FkXCI%2BPC9hPjxzdHlsZT5kaXZ7bWFyZ2luOjA7cGFkZGluZzowO30uYWJnY3tkaXNwbGF5Om5vbmU7aGVpZ2h0OjE1cHg7cG9zaXRpb246YWJzb2x1dGU7cmlnaHQ6MTdweDt0b3A6MXB4O3RleHQtcmVuZGVyaW5nOmdlb21ldHJpY1ByZWNpc2lvbjt6LWluZGV4OjIxNDc0ODM2NDY7fS5hYmdie2Rpc3BsYXk6aW5saW5lLWJsb2NrO2hlaWdodDoxNXB4O30uYWJnYywuamFy&i=2-6&t=adltag_kgwrwklw_rrM4X63v0cE&r=2e511a72bb7ad7582eb7de24a38f307&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.20.54 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 f857c6fa23ed7b2d0b237aefe9c50960.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 29050
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Fri, 30 Oct 2020 13:28:57 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
x-amz-cf-id: kUMX_zrAV7Uy1iBgtFFIwnoDOP8Rq41xycyrafi3ygPqCHF38mcJ-g==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame B4A2 0
427 B 86ms
84ms Other
text/plain 65.9.20.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=IC5hYmdjLC5qYXIgLmNiYntvcGFjaXR5OjE7fS5hYmdje2N1cnNvcjpwb2ludGVyO30uY2Jie2N1cnNvcjpwb2ludGVyO2hlaWdodDoxNXB4O3dpZHRoOjE1cHg7ei1pbmRleDoyMTQ3NDgzNjQ2O2JhY2tncm91bmQtY29sb3I6I2ZmZmZmZjtvcGFjaXR5OjA7fS5jYmIgc3Zne3Bvc2l0aW9uOmFic29sdXRlO3RvcDowO3JpZ2h0OjA7aGVpZ2h0OjE1cHg7d2lkdGg6MTVweDtzdHJva2U6IzAwYWVjZDtzdHJva2Utd2lkdGg6MS4yNTt9LmNiYjpob3ZlcntjdXJzb3I6cG9pbnRlcjt9LmNiYjpob3ZlcntiYWNrZ3JvdW5kLWNvbG9yOiM1ODU4NWE7fS5jYmI6aG92ZXIgc3Zne3N0cm9rZTojZmZmZmZmO30uYWJnYntwb3NpdGlvbjphYnNvbHV0ZTtyaWdodDowcHg7dG9wOjBweDt9LmNiYntwb3NpdGlvbjphYnNvbHV0ZTtyaWdodDoxcHg7dG9wOjFweDt9LmFiZ3N7ZGlzcGxheTpub25lO2hlaWdodDoxMDAlO30uYWJnbHt0ZXh0LWRlY29yYXRpb246bm9uZTt9LmFiZ3Mgc3ZnLC5hYmdiIHN2Z3tkaXNwbGF5OmlubGluZS1ibG9jaztoZWlnaHQ6MTVweDt3aWR0aDphdXRvO3ZlcnRpY2FsLWFsaWduOnRvcDt9LmFiZ2MgLmlsLXdyYXB7YmFja2dyb3VuZC1jb2xvcjojZmZmZmZmO2hlaWdodDoxNXB4O3doaXRlLXNwYWNlOm5vd3JhcDt9LmFiZ2MgLmlsLXdyYXAuZXhwe2JvcmRlci1ib3R0b20tbGVmdC1yYWRpdXM6NXB4O30uYWJnYyAuaWwtdGV4dCwuYWJnYyAuaWwtaWNvbntkaXNwbGF5OmlubGluZS1ibG9jazt9LmFiZ2MgLmlsLXRleHR7cGFkZGluZy1yaWdodDoxcHg7cGFkZGluZy1sZWZ0OjVweDtoZWlnaHQ6MTVweDt3aWR0aDo1NXB4O30uYWJnYyAuaWwtaWNvbntoZWlnaHQ6MTVweDt3aWR0aDoxNXB4O30uYWJnYyAuaWwtdGV4dCBzdmd7ZmlsbDojMDAwMDAwO30uYWJnYyAuaWwtaWNvbiBzdmd7ZmlsbDojMDBhZWNkfTwvc3R5bGU%2BPGRpdiBpZD1cImFiZ2NcIiBjbGFzcz1cImFiZ2NcIiBkaXI9XCJsdHJcIiBhcmlhLWhpZGRlbj1cInRydWVcIj48ZGl2IGlkPVwiYWJnYlwiIGNsYXNzPVwiYWJnYlwiPjxkaXYgY2xhc3M9XCJpbC13cmFwXCI%2BPGRpdiBjbGFzcz1cImlsLWljb25cIj48c3ZnIHhtbG5zPVwiaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmdcIiB4bWxuczp4bGluaz1cImh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmtcIiB2aWV3Qm94PVwiMCAwIDE1IDE1XCI%2BPGNpcmNsZSBjeD1cIjZcIiBjeT1cIjZcIiByPVwiMC42N1wiPjwvY2lyY2xlPjxwYXRoIGQ9XCJNNC4yLDExLjNRMy4zLDExLjgsMy4zLDEwLjc1TDMuMyw0LjFRMy4zLDMuMSw0LjMsMy41TDEwLjQsNy4wUTEyLjAsNy41LDEwLjQsOC4wTDYuNjUsMTAuMEw2LjY1LDcuNzVhMC42NSwwLjY1LDAsMSwwLC0xLjMsMEw1LjM1LDEwLjc1YTAuOSwwLjksMCwwLDAsMS4zLDAuOEwxMi43LDguMlExMy43LDcuNSwxMi43LDYuN0wzLjMsMS42UTIuMiwxLjMsMS44LDIuNUwxLjgsMTIuNVEyLjIsMTMuOSwzLjMsMTMuM0w0LjgsMTIuNUEwLjMsMC4zLDAsMSwwLDQuMiwxMS4zWlwiPjwvcGF0aD48L3N2Zz48L2Rpdj48L2Rpdj48L2Rpdj48ZGl2IGlkPVwiYWJnc1wiIGNsYXNzPVwiYWJnc1wiPjxhIGlkPVwiYWJnbFwiIGNsYXNzPVwiYWJnbFwiIGhyZWY9XCJodHRwczovL2Fkc3NldHRpbmdzLmdvb2dsZS5jb20vd2h5dGhpc2FkP3JlYXNvbnM9QUIzYWZHRUFBQVAxVzF0YlcxMHNXMjUxYkd3c0ltaDBkSEJ6T2k4dloyOXZaMnhsWVdSekxtY3VaRzkxWW14bFkyeHBZMnN1Ym1WMEwzQmhaMlZoWkM5amIyNTJaWEp6YVc5dUx6OWhhVDFDT0Rrd2VtdFpZV05ZT1RNMVMzUlRZbWRSWlhWbllVTkpRUzF1ZDNjNVRrWkJRVUZCUlVGRlp6SkpURU5hVkdkQlYwbDZjWEJ3ZFVSQ1IwUXhiR00yUWpSQlUzbEJVVFV3WVVoS2JGbFlVbmRpTTA0d1RHMU9kbUppYjBKRFYyUnRZMFk1Y0dKWFJtNWFZMmRDUVhSdlFsVlhhREJrU0VKNlQyazRkbVJIYUhsYVYwWXdZMGM1ZW1SRE5XcGlNakIyWXpKb2MxbFliR3hqYVRGMFdWZE5kR0pYUm5Oa01rWjVXbE14YkdWSVVubFpVekY2WW0xV2FHRXliSFZhV0U1NlRIcEZNVTVxV1RKUFV6aGZaREpXYVZnelduQmFXR001WkVoS01WcGpRVU5CZFVGRFFVOXZRMGxET0hsTlZHTjNUbnBGZVU1RVRYcE9hVGxWWVVoS2JGbFlVbEZpTTA0d1RGUktORTFwTVZSaE1teDFMVUZNZHpCU05sRkJOSGRIYlVGUVowRTJaMFJCWTJkRWJWRlVVVUpLUWs4MFFWRkNNR2RWUjBWTVlVNTFUbU5VYTBGWlFtOUJXVlZ4UVdaek1WSjFiMEpmVUZKSE5tZEliSFJuWW5GQlprTXlhSFpaUW5kSVowSjRYMU5EUVd0SlowOUhRVkZDUVVKSFFqTlpRMEZMUVVOblYxbERkMFZjZFRBd01qWnphV2RvUFdjd1QzZGlaVGhGTms1QlhIVXdNREkyWTJsa1BVTkJVVk5RWjBOT1NYSk1UVUUwYjE4MFdrcFBkMEZSTUZoRlRVbFdhalJSTVdFMVFuWXpXVzVHTmpSQ2NqTkRUVFZ6YTBsalUxTTNZMDAwZHpoVFVIRXpPVk5oVGxGalUwWXhjR1UwYm5JM09YWm1WVU5UV0U0aUxGdHVkV3hzTEc1MWJHd3NiblZzYkN3aWFIUjBjSE02THk5a2FYTndiR0Y1WVdSekxXWnZjbTFoZEhNdVoyOXZaMnhsZFhObGNtTnZiblJsYm5RdVkyOXRMMkZrY3k5d2NtVjJhV1YzTDJOdmJuUmxiblF1YW5NX1kyeHBaVzUwUFhkMFlWeDFNREF5Tm05aVpuVnpZMkYwWldSRGRYTjBiMjFsY2tsa1BURXdNREF3TURBd01EQmNkVEF3TWpaamNtVmhkR2wyWlVsa1BURXpPRE13TVRVeE9URXhObHgxTURBeU5uWmxjbk5wYjI1SlpEMHdYSFV3TURJMllXUkhjbTkxY0VOeVpXRjBhWFpsU1dROU1GeDFNREF5Tm1oMGJXeFFZWEpsYm5SSlpEMXdjbVYyTFRCY2RUQXdNalpvWldsbmFIUTlNbHgxTURBeU5uZHBaSFJvUFRKY2RUQXdNalp6YVdjOVFVTnBWa0pmZDJWRGMxSjBVbkE1TjNGeGNsZFRTSFIwYkc1NGJtNW5SRFU1WnlKZExHNTFiR3dzYm5Wc2JDd3hMQ0pRWWpCUE9ITmpkbTFuUVVsQlFrTlBkMkV6YTBOQ1owRkpaMEpEUmpKT2FFeFlRakZaYVRBelRsUkJkMDVVYTNwTmFrMHlUbnBCTTAxNlNURlRRVXBaUmtoQlFuVkJSMDAyY1dGaVozZFJJaXdpTWpNMU56azBORFEyTWlKZFhWMHNXekVzTVN3eFhWMktzLXEyd2E5S1o3ZFhmcVIwVUZpZGdMQllVMlpYbEltREU3YzlXUmFSR3FMdHdaM3hubnpxMGhhRU1EWm5NNTZvVDA0MkVkODZBeVNXQ2oxeV83UGszbTRIWFdZdGoyNlV1YU53Ym44WUxlWTg2SHFIVnlQRHFnWlJqcGpFM1g5OFBVOGZRakVBMkk4XzVKRWJTVDBaak1VZkFQMzF1dzlrUkdlV19XM2owX3hsTmg5RWp0QmxySGc2NjlfamNBRHpjclhWdVFCZzM1WXRhNUpDS01RaVpyQlZRRWRpSkctZFRhZ0xkTVdtZ2NCOTdVcVhlRHhSTW1YNzdtWjEwR3pTX0Q1Rm14WUdfWnVKTVh6RFBBVnBfMlVGZ2E0dDlQek96azBwVy1XVmE1NkJGMFFjeW9Zem9RelNwWDF6VGlMM1VEQnNEb3p1VmF6R1pkdnl3a3RtLDhXYnIwalVHMU5odHVoel9VaHBjZWcmYW1wO3NvdXJjZT1kaXNwbGF5XCIgdGFyZ2V0PVwiX2JsYW5rXCI%2BPGRpdiBjbGFzcz1cImlsLXdyYXAgZXhwXCI%2BPGRpdiBjbGFzcz1cImlsLXRleHRcIj48c3ZnIHhtbG5zPVwiaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmdcIiB4bWxuczp4bGluaz1cImh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmtcIiB2aWV3Qm94PVwiMCAwIDU5IDE2XCI%2BPHBhdGggZD1cIk00LjUxIDQuMjRMOC4wMiAxMi44M0w2LjczIDEyLjgzTDUuNzIgMTAuMjFMMi4xNCAxMC4yMUwxLjE5IDEyLjgzTC0wLjAxIDEyLjgzTDMuMjkgNC4yNEw0LjUxIDQuMjRaTTIuNDYgOS4zMUw1LjM4IDkuMzFMNS4zOCA5LjMxUTQuMzIgNi41MiA0LjE5IDYuMTRMNC4xOSA2LjE0TDQuMTkgNi4xNFE0LjA1IDUuNzcgMy44OSA1LjEzTDMuODkgNS4xM0wzLjg2IDUuMTNMMy44NiA1LjEzUTMuNzAgNiAzLjQyIDYuNzRMMy40MiA2Ljc0TDIuNDYgOS4zMVpNMTMuODMgNC4yNEwxMy44MyAxMi44M0wxMi44NSAxMi44M0wxMi44NSAxMi4wNEwxMi44MyAxMi4wNEwxMi44MyAxMi4wNFExMi4yNiAxMi45NyAxMS4xMSAxMi45N0wxMS4xMSAxMi45N0wxMS4xMSAxMi45N1E5Ljk3IDEyLjk3IDkuMjAgMTIuMDdMOS4yMCAxMi4wN0w5LjIwIDEyLjA3UTguNDQgMTEuMTYgOC40NCA5LjcyTDguNDQgOS43Mkw4LjQ0IDkuNzJROC40NCA4LjIxIDkuMTYgNy4zNEw5LjE2IDcuMzRMOS4xNiA3LjM0UTkuODggNi40NyAxMS4wNiA2LjQ3TDExLjA2IDYuNDdMMTEuMDYgNi40N1ExMi4xOCA2LjQ3IDEyLjc2IDcuMzJMMTIuNzYgNy4zMkwxMi43OCA3LjMyTDEyLjc4IDQuMjRMMTMuODMgNC4yNFpNMTEuMjIgMTIuMTFMMTEuMjIgMTIuMTFMMTEuMjIgMTIuMTFRMTEuOTEgMTIuMTEgMTIuMzkgMTEuNTRMMTIuMzkgMTEuNTRMMTIuMzkgMTEuNTRRMTIuODcgMTAuOTcgMTIuODcgOS44MUwxMi44NyA5LjgxTDEyLjg3IDkuODFRMTIuODcgOC42OCAxMi40MyA4LjAwTDEyLjQzIDguMDBMMTIuNDMgOC4wMFExMS45OSA3LjMzIDExLjE3IDcuMzNMMTEuMTcgNy4zM0wxMS4xNyA3LjMzUTEwLjM1IDcuMzMgOS45MyA3Ljk5TDkuOTMgNy45OUw5LjkzIDcuOTlROS41MiA4LjY1IDkuNTIgOS43Mkw5LjUyIDkuNzJMOS41MiA5LjcyUTkuNTIgMTAuNDkgOS43NCAxMS4wM0w5Ljc0IDExLjAzTDkuNzQgMTEuMDNROS45NyAxMS41NyAxMC4zNyAxMS44NEwxMC4zNyAxMS44NEwxMC4zNyAxMS44NFExMC43OCAxMi4xMSAxMS4yMiAxMi4xMVpNMjEuNzQgOS44MUwyMi44OCAxMC4xMEwyMi44OCAxMC4xMFEyMi41MCAxMS41NSAyMS41NyAxMi4yNkwyMS41NyAxMi4yNkwyMS41NyAxMi4yNlEyMC42MyAxMi45NyAxOS4zMiAxMi45N0wxOS4zMiAxMi45N0wxOS4zMiAxMi45N1ExNy4yMSAxMi45NyAxNi4yNSAxMS42NUwxNi4yNSAxMS42NUwxNi4yNSAxMS42NVExNS4yOSAxMC4zMyAxNS4yOSA4LjQ3TDE1LjI5IDguNDdMMTUuMjkgOC40N1ExNS4yOSA2LjQyIDE2LjQyIDUuMjVMMTYuNDIgNS4yNUwxNi40MiA1LjI1UTE3LjU1IDQuMDkgMTkuMzQgNC4wOUwxOS4zNCA0LjA5TDE5LjM0IDQuMDlRMjAuNTkgNC4wOSAyMS40OCA0LjczTDIxLjQ4IDQuNzNMMjEuNDggNC43M1EyMi4zNyA1LjM3IDIyLjczIDYuNjBMMjIuNzMgNi42MEwyMS42MiA2Ljg2TDIxLjYyIDYuODZRMjEuMzMgNS45NiAyMC43NiA1LjUxTDIwLjc2IDUuNTFMMjAuNzYgNS41MVEyMC4xOSA1LjA2IDE5LjMyIDUuMDZMMTkuMzIgNS4wNkwxOS4zMiA1LjA2UTE3LjkyIDUuMDYgMTcuMTkgNS45OUwxNy4xOSA1Ljk5TDE3LjE5IDUuOTlRMTYuNDYgNi45MSAxNi40NiA4LjQ2TDE2LjQ2IDguNDZMMTYuNDYgOC40NlExNi40NiAxMC4yNSAxNy4yMyAxMS4xM0wxNy4yMyAxMS4xM0wxNy4yMyAxMS4xM1ExNy45OSAxMiAxOS4yMiAxMkwxOS4yMiAxMkwxOS4yMiAxMlEyMC4yMyAxMiAyMC44NiAxMS40NkwyMC44NiAxMS40NkwyMC44NiAxMS40NlEyMS40OSAxMC45MSAyMS43NCA5LjgxTDIxLjc0IDkuODFaTTI5LjIzIDguODlMMjkuMjMgMTIuODNMMjguMTcgMTIuODNMMjguMTcgOC45MEwyOC4xNyA4LjkwUTI4LjE3IDguMTQgMjcuODQgNy43NkwyNy44NCA3Ljc2TDI3Ljg0IDcuNzZRMjcuNTEgNy4zOCAyNi44NiA3LjM4TDI2Ljg2IDcuMzhMMjYuODYgNy4zOFEyNi4yMSA3LjM4IDI1LjcxIDcuODNMMjUuNzEgNy44M0wyNS43MSA3LjgzUTI1LjIwIDguMjcgMjUuMjAgOS40M0wyNS4yMCA5LjQzTDI1LjIwIDEyLjgzTDI0LjE1IDEyLjgzTDI0LjE1IDQuMjRMMjUuMjAgNC4yNEwyNS4yMCA3LjMyTDI1LjIwIDcuMzJRMjUuOTUgNi40NyAyNy4wOCA2LjQ3TDI3LjA4IDYuNDdMMjcuMDggNi40N1EyNy42OCA2LjQ3IDI4LjIzIDYuNzFMMjguMjMgNi43MUwyOC4yMyA2LjcxUTI4Ljc4IDYuOTYgMjkuMDAgNy40N0wyOS4wMCA3LjQ3TDI5LjAwIDcuNDdRMjkuMjMgNy45OCAyOS4yMyA4Ljg5TDI5LjIzIDguODlaTTMzLjM1IDYuNDdMMzMuMzUgNi40N0wzMy4zNSA2LjQ3UTM0LjYxIDYuNDcgMzUuNDQgNy4yOUwzNS40NCA3LjI5TDM1LjQ0IDcuMjlRMzYuMjcgOC4xMSAzNi4yNyA5LjYyTDM2LjI3IDkuNjJMMzYuMjcgOS42MlEzNi4yNyAxMS40NiAzNS4zNyAxMi4yMUwzNS4zNyAxMi4yMUwzNS4zNyAxMi4y&i=3-6&t=adltag_kgwrwklw_rrM4X63v0cE&r=2e511a72bb7ad7582eb7de24a38f307&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.20.54 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 f857c6fa23ed7b2d0b237aefe9c50960.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 29050
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Fri, 30 Oct 2020 13:28:57 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
x-amz-cf-id: WkiTHunY8QpXeCu-t745cczqjjJZj0rqOcSQ-eEweBM9aM4gUVU8vA==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame B4A2 0
427 B 92ms
91ms Other
text/plain 65.9.20.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=MVEzNC40OCAxMi45NyAzMy4zNSAxMi45N0wzMy4zNSAxMi45N0wzMy4zNSAxMi45N1EzMi4xNyAxMi45NyAzMS4zMSAxMi4xOUwzMS4zMSAxMi4xOUwzMS4zMSAxMi4xOVEzMC40NCAxMS40MSAzMC40NCA5LjcyTDMwLjQ0IDkuNzJMMzAuNDQgOS43MlEzMC40NCA4LjA4IDMxLjI4IDcuMjdMMzEuMjggNy4yN0wzMS4yOCA3LjI3UTMyLjEyIDYuNDcgMzMuMzUgNi40N1pNMzMuMzUgMTIuMTFMMzMuMzUgMTIuMTFMMzMuMzUgMTIuMTFRMzQuMjUgMTIuMTEgMzQuNzIgMTEuNDRMMzQuNzIgMTEuNDRMMzQuNzIgMTEuNDRRMzUuMTkgMTAuNzcgMzUuMTkgOS42OEwzNS4xOSA5LjY4TDM1LjE5IDkuNjhRMzUuMTkgOC41MSAzNC42NiA3LjkyTDM0LjY2IDcuOTJMMzQuNjYgNy45MlEzNC4xMyA3LjMzIDMzLjM1IDcuMzNMMzMuMzUgNy4zM0wzMy4zNSA3LjMzUTMyLjU1IDcuMzMgMzIuMDMgNy45M0wzMi4wMyA3LjkzTDMyLjAzIDcuOTNRMzEuNTIgOC41MyAzMS41MiA5LjcyTDMxLjUyIDkuNzJMMzEuNTIgOS43MlEzMS41MiAxMC45MCAzMi4wNCAxMS41MEwzMi4wNCAxMS41MEwzMi4wNCAxMS41MFEzMi41NyAxMi4xMSAzMy4zNSAxMi4xMVpNMzguNTUgNi42MUwzOC41NSAxMi44M0wzNy40OSAxMi44M0wzNy40OSA2LjYxTDM4LjU1IDYuNjFaTTM4LjU1IDQuMjRMMzguNTUgNS40M0wzNy40OSA1LjQzTDM3LjQ5IDQuMjRMMzguNTUgNC4yNFpNNDQuMjAgMTAuNTVMNDUuMjUgMTAuNjhMNDUuMjUgMTAuNjhRNDUuMDUgMTEuODcgNDQuMzEgMTIuNDJMNDQuMzEgMTIuNDJMNDQuMzEgMTIuNDJRNDMuNTggMTIuOTcgNDIuNjYgMTIuOTdMNDIuNjYgMTIuOTdMNDIuNjYgMTIuOTdRNDEuMzAgMTIuOTcgNDAuNTYgMTIuMDhMNDAuNTYgMTIuMDhMNDAuNTYgMTIuMDhRMzkuODMgMTEuMjAgMzkuODMgOS43M0wzOS44MyA5LjczTDM5LjgzIDkuNzNRMzkuODMgOC41MiA0MC4yNSA3Ljc5TDQwLjI1IDcuNzlMNDAuMjUgNy43OVE0MC42OCA3LjA2IDQxLjMxIDYuNzZMNDEuMzEgNi43Nkw0MS4zMSA2Ljc2UTQxLjk1IDYuNDcgNDIuNjYgNi40N0w0Mi42NiA2LjQ3TDQyLjY2IDYuNDdRNDMuNjIgNi40NyA0NC4zMCA2Ljk3TDQ0LjMwIDYuOTdMNDQuMzAgNi45N1E0NC45OCA3LjQ2IDQ1LjE0IDguNDNMNDUuMTQgOC40M0w0NC4xMiA4LjU5TDQ0LjEyIDguNTlRNDMuOTYgNy45NiA0My42MSA3LjY1TDQzLjYxIDcuNjVMNDMuNjEgNy42NVE0My4yNSA3LjMzIDQyLjcwIDcuMzNMNDIuNzAgNy4zM0w0Mi43MCA3LjMzUTQxLjgyIDcuMzMgNDEuMzYgNy45Nkw0MS4zNiA3Ljk2TDQxLjM2IDcuOTZRNDAuOTAgOC41OCA0MC45MCA5LjcxTDQwLjkwIDkuNzFMNDAuOTAgOS43MVE0MC45MCAxMC44NiA0MS4zNSAxMS40OEw0MS4zNSAxMS40OEw0MS4zNSAxMS40OFE0MS44MCAxMi4xMSA0Mi42NCAxMi4xMUw0Mi42NCAxMi4xMUw0Mi42NCAxMi4xMVE0My4zMiAxMi4xMSA0My43MSAxMS43Mkw0My43MSAxMS43Mkw0My43MSAxMS43MlE0NC4xMCAxMS4zMyA0NC4yMCAxMC41NUw0NC4yMCAxMC41NVpNNTEuNTYgOS45OEw1MS41NiA5Ljk4TDQ2LjkwIDkuOThMNDYuOTAgOS45OFE0Ni45NyAxMS4wMiA0Ny40OSAxMS41Nkw0Ny40OSAxMS41Nkw0Ny40OSAxMS41NlE0OC4wMiAxMi4xMSA0OC44MCAxMi4xMUw0OC44MCAxMi4xMUw0OC44MCAxMi4xMVE0OS40MSAxMi4xMSA0OS44MiAxMS43OUw0OS44MiAxMS43OUw0OS44MiAxMS43OVE1MC4yMyAxMS40NyA1MC40NCAxMC44Mkw1MC40NCAxMC44Mkw1MS41MyAxMC45Nkw1MS41MyAxMC45NlE1MS4yNiAxMS45MyA1MC41NiAxMi40NUw1MC41NiAxMi40NUw1MC41NiAxMi40NVE0OS44NiAxMi45NyA0OC44MCAxMi45N0w0OC44MCAxMi45N0w0OC44MCAxMi45N1E0Ny40MCAxMi45NyA0Ni42MSAxMi4xMUw0Ni42MSAxMi4xMUw0Ni42MSAxMi4xMVE0NS44MyAxMS4yNiA0NS44MyA5Ljc3TDQ1LjgzIDkuNzdMNDUuODMgOS43N1E0NS44MyA4LjMwIDQ2LjU5IDcuMzhMNDYuNTkgNy4zOEw0Ni41OSA3LjM4UTQ3LjM2IDYuNDcgNDguNzQgNi40N0w0OC43NCA2LjQ3TDQ4Ljc0IDYuNDdRNDkuNDIgNi40NyA1MC4wNSA2Ljc3TDUwLjA1IDYuNzdMNTAuMDUgNi43N1E1MC42OCA3LjA3IDUxLjEyIDcuNzhMNTEuMTIgNy43OEw1MS4xMiA3Ljc4UTUxLjU2IDguNTAgNTEuNTYgOS45OFpNNDYuOTYgOS4xMkw1MC40OCA5LjEyTDUwLjQ4IDkuMTJRNTAuNDEgOC4xNyA0OS44OSA3Ljc1TDQ5Ljg5IDcuNzVMNDkuODkgNy43NVE0OS4zNyA3LjMzIDQ4Ljc0IDcuMzNMNDguNzQgNy4zM0w0OC43NCA3LjMzUTQ4IDcuMzMgNDcuNTIgNy44M0w0Ny41MiA3LjgzTDQ3LjUyIDcuODNRNDcuMDQgOC4zMyA0Ni45NiA5LjEyTDQ2Ljk2IDkuMTJaTTU3LjMzIDguMjFMNTYuMzAgOC4zNUw1Ni4zMCA4LjM1UTU2LjIzIDcuODQgNTUuODkgNy41OEw1NS44OSA3LjU4TDU1Ljg5IDcuNThRNTUuNTUgNy4zMyA1NC45NCA3LjMzTDU0Ljk0IDcuMzNMNTQuOTQgNy4zM1E1NC4zMyA3LjMzIDUzLjk2IDcuNTRMNTMuOTYgNy41NEw1My45NiA3LjU0UTUzLjU5IDcuNzQgNTMuNTkgOC4xM0w1My41OSA4LjEzTDUzLjU5IDguMTNRNTMuNTkgOC41MCA1My44OSA4LjY2TDUzLjg5IDguNjZMNTMuODkgOC42NlE1NC4xOCA4LjgyIDU1LjA1IDkuMDVMNTUuMDUgOS4wNUw1NS4wNSA5LjA1UTU2LjA0IDkuMzAgNTYuNTMgOS40OUw1Ni41MyA5LjQ5TDU2LjUzIDkuNDlRNTcuMDIgOS42OSA1Ny4yOSAxMC4wM0w1Ny4yOSAxMC4wM0w1Ny4yOSAxMC4wM1E1Ny41NiAxMC4zOCA1Ny41NiAxMS4wMEw1Ny41NiAxMS4wMEw1Ny41NiAxMS4wMFE1Ny41NiAxMS44NCA1Ni44OCAxMi40MEw1Ni44OCAxMi40MEw1Ni44OCAxMi40MFE1Ni4yMCAxMi45NyA1NS4wNyAxMi45N0w1NS4wNyAxMi45N0w1NS4wNyAxMi45N1E1My44OCAxMi45NyA1My4yMiAxMi40N0w1My4yMiAxMi40N0w1My4yMiAxMi40N1E1Mi41NSAxMS45NyA1Mi40MCAxMC45N0w1Mi40MCAxMC45N0w1My40NSAxMC44MUw1My40NSAxMC44MVE1My41MyAxMS40NiA1My45MyAxMS43OEw1My45MyAxMS43OEw1My45MyAxMS43OFE1NC4zMyAxMi4xMSA1NS4wNSAxMi4xMUw1NS4wNSAxMi4xMUw1NS4wNSAxMi4xMVE1NS43NSAxMi4xMSA1Ni4xMiAxMS44Mkw1Ni4xMiAxMS44Mkw1Ni4xMiAxMS44MlE1Ni40OCAxMS41MyA1Ni40OCAxMS4xMUw1Ni40OCAxMS4xMUw1Ni40OCAxMS4xMVE1Ni40OCAxMC44MyA1Ni4zMSAxMC42Nkw1Ni4zMSAxMC42Nkw1Ni4zMSAxMC42NlE1Ni4xNCAxMC40OSA1NS44OSAxMC40MEw1NS44OSAxMC40MEw1NS44OSAxMC40MFE1NS42MyAxMC4zMiA1NC43NCAxMC4xMEw1NC43NCAxMC4xMEw1NC43NCAxMC4xMFE1My40MiA5Ljc5IDUzLjAwIDkuMzNMNTMuMDAgOS4zM0w1My4wMCA5LjMzUTUyLjU3IDguODggNTIuNTcgOC4yNkw1Mi41NyA4LjI2TDUyLjU3IDguMjZRNTIuNTcgNy40OCA1My4xOSA2Ljk3TDUzLjE5IDYuOTdMNTMuMTkgNi45N1E1My44MSA2LjQ3IDU0Ljg2IDYuNDdMNTQuODYgNi40N0w1NC44NiA2LjQ3UTU1Ljk3IDYuNDcgNTYuNTkgNi45MUw1Ni41OSA2LjkxTDU2LjU5IDYuOTFRNTcuMjEgNy4zNCA1Ny4zMyA4LjIxTDU3LjMzIDguMjFaXCI%2BPC9wYXRoPjwvc3ZnPjwvZGl2PjxkaXYgY2xhc3M9XCJpbC1pY29uXCI%2BPHN2ZyB4bWxucz1cImh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnXCIgeG1sbnM6eGxpbms9XCJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rXCIgdmlld0JveD1cIjAgMCAxNSAxNVwiPjxjaXJjbGUgY3g9XCI2XCIgY3k9XCI2XCIgcj1cIjAuNjdcIj48L2NpcmNsZT48cGF0aCBkPVwiTTQuMiwxMS4zUTMuMywxMS44LDMuMywxMC43NUwzLjMsNC4xUTMuMywzLjEsNC4zLDMuNUwxMC40LDcuMFExMi4wLDcuNSwxMC40LDguMEw2LjY1LDEwLjBMNi42NSw3Ljc1YTAuNjUsMC42NSwwLDEsMCwtMS4zLDBMNS4zNSwxMC43NWEwLjksMC45LDAsMCwwLDEuMywwLjhMMTIuNyw4LjJRMTMuNyw3LjUsMTIuNyw2LjdMMy4zLDEuNlEyLjIsMS4zLDEuOCwyLjVMMS44LDEyLjVRMi4yLDEzLjksMy4zLDEzLjNMNC44LDEyLjVBMC4zLDAuMywwLDEsMCw0LjIsMTEuM1pcIj48L3BhdGg%2BPC9zdmc%2BPC9kaXY%2BPC9kaXY%2BPC9hPjwvZGl2PjwvZGl2PjxkaXYgaWQ9XCJjYmJcIiBjbGFzcz1cImNiYlwiIGFyaWEtaGlkZGVuPVwidHJ1ZVwiPjxzdmcgeG1sbnM9XCJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2Z1wiIHhtbG5zOnhsaW5rPVwiaHR0cDovL3d3dy53My5vcmcvMTk5OS94bGlua1wiIHZpZXdCb3g9XCIwIDAgMTUgMTVcIj48cGF0aCBkPVwiTTMuMjUsMy4yNWw4LjUsOC41TTExLjc1LDMuMjVsLTguNSw4LjVcIj48L3BhdGg%2BPC9zdmc%2BPC9kaXY%2BPHN0eWxlPi5tdXRlX3BhbmVse3otaW5kZXg6MjE0NzQ4MzY0Njt9LmFiZ2Fje3Bvc2l0aW9uOmFic29sdXRlO2xlZnQ6MHB4O3RvcDowcHg7ei1pbmRleDoyMTQ3NDgzNjQ2O2Rpc3BsYXk6bm9uZTt3aWR0aDoxMDAlO2hlaWdodDoxMDAlO2JhY2tncm91bmQtY29sb3I6I0ZBRkFGQTt9Lm1sc2N7aGVpZ2h0OjEwMCU7ZGlzcGxheTpmbGV4O2p1c3RpZnktY29udGVudDpjZW50ZXI7YWxpZ24taXRlbXM6Y2VudGVyO30ubWxze2FuaW1hdGlvbjptbHNrZiAycyBsaW5lYXIgaW5maW5pdGU7aGVpZ2h0OjUwJTt3aWR0aDo1MCU7fS5tbHNke3N0cm9rZS1kYXNoYXJyYXk6MSwxODk7c3Ryb2tlLWRhc2hvZmZzZXQ6MDthbmltYXRpb246bWxzZGtmIDEuNHMgZWFzZS1pbi1vdXQgaW5maW5pdGU7fUBrZXlmcmFtZXMgbWxza2Z7MTAwJXt0cmFuc2Zvcm06cm90YXRlKDM2MGRlZyk7fX1Aa2V5ZnJhbWVzIG1sc2RrZnswJXtzdHJva2UtZGFzaGFycmF5OjEsMTg5O3N0cm9rZS1kYXNob2Zmc2V0OjA7fTUwJXtzdHJva2UtZGFzaGFycmF5OjEzNCwxODk7c3Ryb2tlLWRhc2hvZmZzZXQ6LTUzcHg7fTEwMCV7c3Ryb2tlLWRhc2hhcnJheToxMzQsMTg5O3N0cm9rZS1kYXNob2Zmc2V0Oi0xODhweDt9fTwvc3R5bGU%2BPGRpdiBpZD1cIm11dGVfcGFuZWxcIiBjbGFzcz1cIm11dGVfcGFuZWxcIiBhcmlhLWhpZGRlbj1cInRydWVcIj48ZGl2IGlkPVwiYWJnYWNcIiBjbGFzcz1cImFiZ2FjXCIgYXJpYS1oaWRkZW49XCJ0cnVlXCI%2BPGRpdiBpZD1cIm1sc2NcIiBjbGFzcz1cIm1sc2NcIj48c3ZnIGNsYXNzPVwibWxzXCIgdmlld0JveD1cIjUwIDUwIDEwMCAxMDBcIj48Y2lyY2xlIGNsYXNzPVwibWxzZFwiIGN4PVwiMTAwXCIgY3k9XCIxMDBcIiByPVwiMzBcIiBmaWxsPVwibm9uZVwiIHN0cm9rZT1cIiM5RTlFOUVcIiBzdHJva2Utd2lkdGg9XCIzXCI%2BPC9jaXJjbGU%2BPC9zdmc%2BPC9kaXY%2BPC9kaXY%2BPC9kaXY%2BPHNjcmlwdCBkYXRhLWpjPVwiNjBcIiBzcmM9XCJodHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2pzL3IyMDIwMTAyNy9yMjAxMTA5MTQvYWJnX2xpdGVfZnkyMDE5LmpzXCIgZGF0YS1qYy12ZXJzaW9uPVwicjIwMjAxMDI3XCI%2BPC9zY3JpcHQ%2BPHNjcmlwdD5idWlsZEF0dHJpYnV0aW9uKFtbbnVsbCxcImh0dHBzOi8vZ29vZ2xlYWRzLmcuZG91YmxlY2xpY2submV0L3BhZ2VhZC9pbWFnZXMvbXRhZC94X2JsdWUucG5nXCIsbnVsbCxcImh0dHBzOi8vZ29vZ2xlYWRzLmcuZG91YmxlY2xpY2submV0L3BhZ2VhZC9pbWFnZXMvbXRhZC94X2JsdWUucG5nXCIsXCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wYWdlYWQvY29udmVyc2lvbi8%2FYWk9Qjg5MHprWWFjWDkzNUt0U2JnUWV1Z2FDSUEtbnd3OU5GQUFBQUVBRWcySUxDWlRnQVdJenFwcHVEQkdEMWxjNkI0QVN5QVE1MGFISmxZWFJ3YjNOMExtTnZiYm9CQ1dkbWNGOXBiV0ZuWmNnQkF0b0JVV2gwZEhCek9pOHZkR2h5WldGMGNHOXpkQzVqYjIwdmMyaHNZWGxsY2kxdFlXTXRiV0ZzZDJGeVpTMWxlSFJ5WVMxemJtVmhhMmx1WlhOekx6RTFOalkyT1M4X2QyVmlYM1pwWlhjOWRISjFaY0FDQXVBQ0FPb0NJQzh5TVRjd056RXlORE16Tmk5VWFISmxZWFJRYjNOMExUSjRNaTFUYTJsdS1BTHcwUjZRQTR3R21BUGdB&i=4-6&t=adltag_kgwrwklw_rrM4X63v0cE&r=2e511a72bb7ad7582eb7de24a38f307&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.20.54 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 f857c6fa23ed7b2d0b237aefe9c50960.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 29050
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Fri, 30 Oct 2020 13:28:57 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
x-amz-cf-id: PDa-yjxhOAdp0ijvJNv6ZqoDDafhxNrB1fq55RfGB1zbQjt5ECdgFw==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame B4A2 0
427 B 95ms
94ms Other
text/plain 65.9.20.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=NmdEQWNnRG1RVFFCSkJPNEFRQjBnVUdFTGFOdU5jVGtBWUJvQVlVcUFmczFSdW9CX1BSRzZnSGx0Z2JxQWZDMmh2WUJ3SGdCeF9TQ0FrSWdPR0FRQkFCR0IzWUNBS0FDZ1dZQ3dFXFx1MDAyNnNpZ2g9ZzBPd2JlOEU2TkFcXHUwMDI2Y2lkPUNBUVNQZ0NOSXJMTUE0b180WkpPd0FRMFhFTUlWajRRMWE1QnYzWW5GNjRCcjNDTTVza0ljU1M3Y000dzhTUHEzOVNhTlFjU0YxcGU0bnI3OXZmVUNTWE5cIixcIlBiME84c2N2bWdBSUFCQ093YTNrQ0JnQUlnQkNGMk5oTFhCMVlpMDNOVEF3TlRrek1qTTJOekEzTXpJMVNBSllGSEFCdUFHTTZxYWJnd1FcIixbXCJ1c2VyX2ZlZWRiYWNrX21lbnVfaW50ZXJhY3Rpb25cIixcIlwiLDBdLG51bGwsbnVsbCxudWxsLG51bGwsXCJXaGF0IHdhcyB3cm9uZyB3aXRoIHRoaXMgYWQ%2FXCIsbnVsbCxcImh0dHBzOi8vZ29vZ2xlYWRzLmcuZG91YmxlY2xpY2submV0L3BhZ2VhZC9pbWFnZXMvbXRhZC9iYWNrX2JsdWUucG5nXCIsXCJUaGFua3MgZm9yIHRoZSBmZWVkYmFjayFcIixcIldl4oCZbGwgcmV2aWV3IHRoaXMgYWQgdG8gaW1wcm92ZSB0aGUgZXhwZXJpZW5jZSBpbiB0aGUgZnV0dXJlLlwiLFwiVGhhbmtzIGZvciB0aGUgZmVlZGJhY2shXCIsXCJXZeKAmWxsIHVzZSB5b3VyIGZlZWRiYWNrIHRvIHJldmlldyBhZHMgb24gdGhpcyBzaXRlLlwiLG51bGwsbnVsbCxudWxsLFwiQ2xvc2luZyBhZDogJTEkZFwiLFwiQWRDaG9pY2VzXCIsXCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wYWdlYWQvaW1hZ2VzL210YWQvYWRfY2hvaWNlc19ibHVlLnBuZ1wiLFwiaHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS91cmw%2FY3Q9YWJnXFx1MDAyNnE9aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS9hZHNlbnNlL3N1cHBvcnQvYmluL3JlcXVlc3QucHklM0Zjb250YWN0JTNEYWJnX2FmYyUyNnVybCUzRGh0dHBzOi8vdGhyZWF0cG9zdC5jb20vc2hsYXllci1tYWMtbWFsd2FyZS1leHRyYS1zbmVha2luZXNzLzE1NjY2OS8lMjUzRndlYl92aWV3JTI1M0R0cnVlJTI2Z2wlM0RDSCUyNmhsJTNEZW4lMjZjbGllbnQlM0RjYS1wdWItNzUwMDU5MzIzNjcwNzMyNSUyNmFpMCUzREI4OTB6a1lhY1g5MzVLdFNiZ1FldWdhQ0lBLW53dzlORkFBQUFFQUVnMklMQ1pUZ0FXSXpxcHB1REJHRDFsYzZCNEFTeUFRNTBhSEpsWVhSd2IzTjBMbU52YmJvQkNXZG1jRjlwYldGblpjZ0JBdG9CVVdoMGRIQnpPaTh2ZEdoeVpXRjBjRzl6ZEM1amIyMHZjMmhzWVhsbGNpMXRZV010YldGc2QyRnlaUzFsZUhSeVlTMXpibVZoYTJsdVpYTnpMekUxTmpZMk9TOF9kMlZpWDNacFpYYzlkSEoxWmNBQ0F1QUNBT29DSUM4eU1UY3dOekV5TkRNek5pOVVhSEpsWVhSUWIzTjBMVEo0TWkxVGEybHUtQUx3MFI2UUE0d0dtQVBnQTZnREFjZ0RtUVRRQkpCTzRBUUIwZ1VHRUxhTnVOY1RrQVlCb0FZVXFBZnMxUnVvQl9QUkc2Z0hsdGdicUFmQzJodllCd0hnQnhfU0NBa0lnT0dBUUJBQkdCM1lDQUtBQ2dXWUN3RVxcdTAwMjZ1c2c9QUZRakNORko4aEhyNXAzajZnbTBwWnc1TnpvR0RCYmxWZ1wiLFwiaHR0cHM6Ly9nb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQvcGFnZWFkL2ltYWdlcy9tdGFkL3hfYmx1ZS5wbmdcIiwwLFtbXCJTZW5kIGZlZWRiYWNrXCIsW1widXNlcl9mZWVkYmFja19tZW51X29wdGlvblwiLFwiMVwiLDFdLFtcIldoYXQgd2FzIHdyb25nIHdpdGggdGhpcyBhZD9cIixbW1wiTm90IGludGVyZXN0ZWQgaW4gdGhpcyBhZFwiLFtcIm11dGVfc3VydmV5X29wdGlvblwiLFwiN1wiLDFdXSxbXCJBZCBjb3ZlcmVkIGNvbnRlbnRcIixbXCJtdXRlX3N1cnZleV9vcHRpb25cIixcIjNcIiwxXV0sW1wiQWQgd2FzIGluYXBwcm9wcmlhdGVcIixbXCJtdXRlX3N1cnZleV9vcHRpb25cIixcIjhcIiwxXV0sW1wiU2VlbiB0aGlzIGFkIG11bHRpcGxlIHRpbWVzXCIsW1wibXV0ZV9zdXJ2ZXlfb3B0aW9uXCIsXCIyXCIsMV1dXV0sW1widXNlcl9mZWVkYmFja191bmRvXCIsXCIxXCIsMV1dXSxbXCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wYWdlYWQvaW1hZ2VzL2FkY2hvaWNlcy9pY29ueDItMDAwMDAwLnBuZ1wiLFwiQWRDaG9pY2VzXCIsXCJBZCBjbG9zZWQgYnkgJTEkc1wiLG51bGwsXCJodHRwczovL3d3dy5nc3RhdGljLmNvbS9pbWFnZXMvYnJhbmRpbmcvZ29vZ2xlbG9nby8yeC9nb29nbGVsb2dvX2RhcmtfY29sb3JfODR4MjhkcC5wbmdcIixcIlNlbmQgZmVlZGJhY2tcIixcIlRoYW5rcy4gRmVlZGJhY2sgaW1wcm92ZXMgR29vZ2xlIGFkc1wiLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFwiU2VlIG15IEdvb2dsZSBhZCBzZXR0aW5nc1wiLG51bGwsXCJodHRwczovL3d3dy5nc3RhdGljLmNvbVwiLFwiXCIsXCJBZHMgYnkgJTEkc1wiLFwiQWQgc2V0dGluZ3NcIixcImh0dHBzOi8vYWRzc2V0dGluZ3MuZ29vZ2xlLmNvbVwiLFwiUG9saXRpY2FsIEFkXCIsbnVsbCxudWxsLDBdLFwiQUIzYWZHRUFBQVAxVzF0YlcxMHNXMjUxYkd3c0ltaDBkSEJ6T2k4dloyOXZaMnhsWVdSekxtY3VaRzkxWW14bFkyeHBZMnN1Ym1WMEwzQmhaMlZoWkM5amIyNTJaWEp6YVc5dUx6OWhhVDFDT0Rrd2VtdFpZV05ZT1RNMVMzUlRZbWRSWlhWbllVTkpRUzF1ZDNjNVRrWkJRVUZCUlVGRlp6SkpURU5hVkdkQlYwbDZjWEJ3ZFVSQ1IwUXhiR00yUWpSQlUzbEJVVFV3WVVoS2JGbFlVbmRpTTA0d1RHMU9kbUppYjBKRFYyUnRZMFk1Y0dKWFJtNWFZMmRDUVhSdlFsVlhhREJrU0VKNlQyazRkbVJIYUhsYVYwWXdZMGM1ZW1SRE5XcGlNakIyWXpKb2MxbFliR3hqYVRGMFdWZE5kR0pYUm5Oa01rWjVXbE14YkdWSVVubFpVekY2WW0xV2FHRXliSFZhV0U1NlRIcEZNVTVxV1RKUFV6aGZaREpXYVZnelduQmFXR001WkVoS01WcGpRVU5CZFVGRFFVOXZRMGxET0hsTlZHTjNUbnBGZVU1RVRYcE9hVGxWWVVoS2JGbFlVbEZpTTA0d1RGUktORTFwTVZSaE1teDFMVUZNZHpCU05sRkJOSGRIYlVGUVowRTJaMFJCWTJkRWJWRlVVVUpLUWs4MFFWRkNNR2RWUjBWTVlVNTFUbU5VYTBGWlFtOUJXVlZ4UVdaek1WSjFiMEpmVUZKSE5tZEliSFJuWW5GQlprTXlhSFpaUW5kSVowSjRYMU5EUVd0SlowOUhRVkZDUVVKSFFqTlpRMEZMUVVOblYxbERkMFZjZFRBd01qWnphV2RvUFdjd1QzZGlaVGhGTms1QlhIVXdNREkyWTJsa1BVTkJVVk5RWjBOT1NYSk1UVUUwYjE4MFdrcFBkMEZSTUZoRlRVbFdhalJSTVdFMVFuWXpXVzVHTmpSQ2NqTkRUVFZ6YTBsalUxTTNZMDAwZHpoVFVIRXpPVk5oVGxGalUwWXhjR1UwYm5JM09YWm1WVU5UV0U0aUxGdHVkV3hzTEc1MWJHd3NiblZzYkN3aWFIUjBjSE02THk5a2FYTndiR0Y1WVdSekxXWnZjbTFoZEhNdVoyOXZaMnhsZFhObGNtTnZiblJsYm5RdVkyOXRMMkZrY3k5d2NtVjJhV1YzTDJOdmJuUmxiblF1YW5NX1kyeHBaVzUwUFhkMFlWeDFNREF5Tm05aVpuVnpZMkYwWldSRGRYTjBiMjFsY2tsa1BURXdNREF3TURBd01EQmNkVEF3TWpaamNtVmhkR2wyWlVsa1BURXpPRE13TVRVeE9URXhObHgxTURBeU5uWmxjbk5wYjI1SlpEMHdYSFV3TURJMllXUkhjbTkxY0VOeVpXRjBhWFpsU1dROU1GeDFNREF5Tm1oMGJXeFFZWEpsYm5SSlpEMXdjbVYyTFRCY2RUQXdNalpvWldsbmFIUTlNbHgxTURBeU5uZHBaSFJvUFRKY2RUQXdNalp6YVdjOVFVTnBWa0pmZDJWRGMxSjBVbkE1TjNGeGNsZFRTSFIwYkc1NGJtNW5SRFU1WnlKZExHNTFiR3dzYm5Wc2JDd3hMQ0pRWWpCUE9ITmpkbTFuUVVsQlFrTlBkMkV6YTBOQ1owRkpaMEpEUmpKT2FFeFlRakZaYVRBelRsUkJkMDVVYTNwTmFrMHlUbnBCTTAxNlNURlRRVXBaUmtoQlFuVkJSMDAyY1dGaVozZFJJaXdpTWpNMU56azBORFEyTWlKZFhWMHNXekVzTVN3eFhWMktzLXEyd2E5S1o3ZFhmcVIwVUZpZGdMQllVMlpYbEltREU3YzlXUmFSR3FMdHdaM3hubnpxMGhhRU1EWm5NNTZvVDA0MkVkODZBeVNXQ2oxeV83UGszbTRIWFdZdGoyNlV1YU53Ym44WUxlWTg2SHFIVnlQRHFnWlJqcGpFM1g5OFBVOGZRakVBMkk4XzVKRWJTVDBaak1VZkFQMzF1dzlrUkdlV19XM2owX3hsTmg5RWp0QmxySGc2NjlfamNBRHpjclhWdVFCZzM1WXRhNUpDS01RaVpyQlZRRWRpSkctZFRhZ0xkTVdtZ2NCOTdVcVhlRHhSTW1YNzdtWjEwR3pTX0Q1Rm14WUdfWnVKTVh6RFBBVnBfMlVGZ2E0dDlQek96azBwVy1XVmE1NkJGMFFjeW9Zem9RelNwWDF6VGlMM1VEQnNEb3p1VmF6R1pkdnl3a3RtLDhXYnIwalVHMU5odHVoel9VaHBjZWdcIixcImh0dHBzOi8vYWRzc2V0dGluZ3MuZ29vZ2xlLmNvbS93aHl0aGlzYWQ%2FcmVhc29ucz1BQjNhZkdFQUFBUDFXMXRiVzEwc1cyNTFiR3dzSW1oMGRIQnpPaTh2WjI5dloyeGxZV1J6TG1jdVpHOTFZbXhsWTJ4cFkyc3VibVYwTDNCaFoyVmhaQzlqYjI1MlpYSnphVzl1THo5aGFUMUNPRGt3ZW10WllXTllPVE0xUzNSVFltZFJaWFZuWVVOSlFTMXVkM2M1VGtaQlFVRkJSVUZGWnpKSlRFTmFWR2RCVjBsNmNYQndkVVJDUjBReGJHTTJRalJCVTNsQlVUVXdZVWhLYkZsWVVuZGlNMDR3VEcxT2RtSmliMEpEVjJSdFkwWTVjR0pYUm01YVkyZENRWFJ2UWxWWGFEQmtTRUo2VDJrNGRtUkhhSGxhVjBZd1kwYzVlbVJETldwaU1qQjJZekpvYzFsWWJHeGphVEYwV1ZkTmRHSlhSbk5rTWtaNVdsTXhiR1ZJVW5sWlV6RjZZbTFXYUdFeWJIVmFXRTU2VEhwRk1VNXFXVEpQVXpoZlpESldhVmd6V25CYVdHTTVaRWhLTVZwalFVTkJkVUZEUVU5dlEwbERPSGxOVkdOM1RucEZlVTVFVFhwT2FUbFZZVWhLYkZsWVVsRmlNMDR3VEZSS05FMXBNVlJoTW14MUxVRk1kekJTTmxGQk5IZEhiVUZRWjBFMlowUkJZMmRFYlZGVVVVSktRazgwUVZGQ01HZFZSMFZNWVU1MVRtTlVhMEZaUW05QldWVnhRV1p6TVZKMWIwSmZVRkpITm1kSWJIUm5ZbkZCWmtNeWFIWlpRbmRJWjBKNFgxTkRRV3RKWjA5SFFWRkNRVUpIUWpOWlEwRkxRVU5uVjFsRGQwVmNkVEF3TWpaemFXZG9QV2N3VDNkaVpUaEZOazVCWEhVd01ESTJZMmxrUFVOQlVWTlFaME5PU1hKTVRVRTBiMTgwV2twUGQwRlJNRmhGVFVsV2FqUlJNV0UxUW5ZeldXNUdOalJDY2pORFRUVnphMGxqVTFNM1kwMDBkemhUVUhFek9WTmhUbEZqVTBZeGNHVTBibkkzT1habVZVTlRXRTRpTEZ0dWRXeHNMRzUxYkd3c2JuVnNiQ3dpYUhSMGNITTZMeTlrYVhOd2JHRjVZV1J6TFdadmNtMWhkSE11WjI5dloyeGxkWE5sY21OdmJuUmxiblF1WTI5dEwyRmtjeTl3Y21WMmFXVjNMMk52Ym5SbGJuUXVhbk1fWTJ4cFpXNTBQWGQwWVZ4MU1EQXlObTlpWm5WelkyRjBaV1JEZFhOMGIyMWxja2xrUFRFd01EQXdNREF3TURCY2RUQXdNalpqY21WaGRHbDJaVWxrUFRFek9ETXdNVFV4T1RFeE5seDFNREF5Tm5abGNuTnBiMjVKWkQwd1hIVXdNREkyWVdSSGNtOTFjRU55WldGMGFYWmxTV1E5TUZ4MU1EQXlObWgwYld4UVlYSmxiblJKWkQxd2NtVjJMVEJjZFRBd01qWm9aV2xuYUhROU1seDFNREF5Tm5kcFpIUm9QVEpjZFRBd01qWnphV2M5UVVOcFZrSmZkMlZEYzFKMFVuQTVOM0Z4Y2xkVFNIUjBiRzU0Ym01blJEVTVaeUpkTEc1MWJHd3NiblZzYkN3eExDSlFZakJQT0hOamRtMW5RVWxCUWtOUGQyRXphME5DWjBGSlowSkRSakpPYUV4WVFqRlphVEF6VGxSQmQwNVVhM3BOYWsweVRucEJNMDE2U1RGVFFVcFpSa2hCUW5WQlIwMDJjV0ZpWjNkUklpd2lNak0xTnprME5EUTJNaUpkWFYwc1d6RXNNU3d4WFYyS3MtcTJ3YTlLWjdkWGZxUjBVRmlkZ0xCWVUyWlhsSW1ERTdjOVdSYVJHcUx0d1ozeG5uenEwaGFFTURabk01Nm9UMDQyRWQ4NkF5U1dDajF5XzdQazNtNEhYV1l0ajI2VXVhTndibjhZTGVZODZIcUhWeVBEcWdaUmpwakUzWDk4UFU4ZlFqRUEySThfNUpFYlNUMFpqTVVmQVAzMXV3OWtSR2VXX1czajBfeGxOaDlFanRCbHJIZzY2OV9qY0FEemNyWFZ1UUJnMzVZdGE1SkNLTVFpWnJCVlFFZGlKRy1kVGFnTGRNV21nY0I5N1VxWGVEeFJNbVg3N21aMTBHelNfRDVGbXhZR19adUpNWHpEUEFWcF8yVUZnYTR0OVB6T3prMHBXLVdWYTU2QkYwUWN5b1l6b1F6U3BYMXpUaUwzVURCc0RvenVWYXpHWmR2eXdrdG0sOFdicjBqVUcxTmh0dWh6X1VocGNlZ1xcdTAwMjZzb3VyY2U9ZGlzcGxheVwiLFwiV2h5IHRoaXMgYWQ%2F&i=5-6&t=adltag_kgwrwklw_rrM4X63v0cE&r=2e511a72bb7ad7582eb7de24a38f307&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.20.54 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 f857c6fa23ed7b2d0b237aefe9c50960.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 29050
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Fri, 30 Oct 2020 13:28:57 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
x-amz-cf-id: wF9dIfTUy822vYQsVhK0MM7YgrLNJw1C45Gh4ukNxNHroogZtGju9g==

POST
H2 200 place
math-aids-threatpost-tagan.adlightning.com/ Frame B4A2 0
427 B 97ms
96ms Other
text/plain 65.9.20.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/place?p=1&d=XCIsMSwwXSxudWxsLG51bGwsMCxudWxsLDAsMCwxLDAsMCwwLDAsMCwwLDAsbnVsbCwwLDEsMCxudWxsLFtbXCJqYWtlX3VpX2V4dGVuc2lvblwiLFwiamFrZV9kZWZhdWx0X3VpXCJdXSwyLDIsMCxudWxsLG51bGwsMCxudWxsLG51bGwsXCJyaWdodFwiLDAsMF0pOzwvc2NyaXB0PjwvZGl2PjxzY3JpcHQgZGF0YS1qYz1cIjIyXCIgc3JjPVwiaHR0cHM6Ly90cGMuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9qcy9yMjAyMDEwMjcvcjIwMTEwOTE0L2NsaWVudC93aW5kb3dfZm9jdXNfZnkyMDE5LmpzXCIgYXN5bmM9XCJcIiBkYXRhLWpjLXZlcnNpb249XCJyMjAyMDEwMjdcIiBkYXRhLWpjcC11cmw9XCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wYWdlYWQvY29udmVyc2lvbi8%2FYWk9JmFtcDtzaWdoPUJwbmZ4SWFhdVFVJmFtcDtjaWQ9Q0FRU1BnQ05JckxNQTRvXzRaSk93QVEwWEVNSVZqNFExYTVCdjNZbkY2NEJyM0NNNXNrSWNTUzdjTTR3OFNQcTM5U2FOUWNTRjFwZTRucjc5dmZVQ1NYTlwiIGRhdGEtamNwLWd3cy1pZD1cIlwiIGRhdGEtamNwLXFlbS1pZD1cIkNKMkc4NktpM2V3Q0ZkUk40QW9kcmdBSU1RXCI%2BPC9zY3JpcHQ%2BPHNjcmlwdCBzcmM9XCJodHRwczovL3d3dy5nb29nbGV0YWdzZXJ2aWNlcy5jb20vYWN0aXZldmlldy9qcy9jdXJyZW50L29zZF9saXN0ZW5lci5qcz9jYWNoZT1yMjAxMTA5MTRcIj48L3NjcmlwdD48c2NyaXB0IHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIj5vc2RsZm0oLTEsJycsJ0JNT2gya1lhY1g5MzVLdFNiZ1FldWdhQ0lBd0FBQUFBUUFUZ0J5QUVDd0FJQzRBSUF5QU9aQk9BRUFhQUdGTklJQndpQTRZQkFFQUUnLCcnLDMzODU5MDY2NTUsdHJ1ZSwnbGFcXHgzZDBcXHgyNnhkaVxceDNkMFxceDI2JywzLCdDQUFTUGVSb3pWZTRTV25lYjktTzNzN2tUNDhTRXQwRVRFa1B4YWJ0M001OGhVRUNLeWlhY2RnWUEtTmxGV29oSkxkbTFZcFRQM3l3bVM4V2RTdkQ3NjgnLCdodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3Bjcy9hY3RpdmV2aWV3P3hhaVxceDNkQUtBT2pzc25LWjNkbTFIWWROaXRBYzhYczdnQ2N6QXgzdzB5azlQeDgzTTA1OTRtUDYydlZWWk5zZWRXYUc1V3RXYS1YUERqYWJWaWN0RVBEUlNCX2FlYkhtUjk5dFkteVFKc1BuYUItc2d3b180XFx4MjZzaWdcXHgzZENnMEFyS0pTekRWcVBET1BiRnI1RUFFJywnJyk7PC9zY3JpcHQ%2BPHNjcmlwdD53aW5kb3cucGFyZW50LnBvc3RNZXNzYWdlKCd7XCJnb29nTXNnVHlwZVwiOlwicHZ0XCIsXCJ0b2tlblwiOlwiQUdrYi1IOFhBa2NNVWZWc2ZQVEZKU25uVWxJaTVROW5pMUpkLWJEdzdXMThLQ3BUaGVQSFRkV3lvcDBGUG9uZDVzeVNCMGFEQUw5SnNwYjBUcUFPNzFiUWhBTVA0UkZMemt3XCJ9JywgJyonKTs8L3NjcmlwdD48aW1nIHNyYz1cIi8vd3d3Lmdvb2dsZS5jb20vYWRzL21lYXN1cmVtZW50L2w%2FZWJjaWQ9QUxoN0NhVGdsRFdJbG93dGJpb0ZCVDA2amVRV0xWdlNEV1RtSDg4T1l0U2NBMXZBS0hNaE4yNWN0YmZqUWFEaGZpdG9sYkFZVVRQaFwiIHN0eWxlPVwiZGlzcGxheTpub25lO1wiIGFsdD1cIlwiPjxkaXYgc3R5bGU9XCJib3R0b206MDtyaWdodDowO3dpZHRoOjEwMHB4O2hlaWdodDoxMDBweDtiYWNrZ3JvdW5kOmluaXRpYWwgIWltcG9ydGFudDtwb3NpdGlvbjphYnNvbHV0ZSAhaW1wb3J0YW50O21heC13aWR0aDoxMDAlICFpbXBvcnRhbnQ7bWF4LWhlaWdodDoxMDAlICFpbXBvcnRhbnQ7cG9pbnRlci1ldmVudHM6bm9uZSAhaW1wb3J0YW50O2ltYWdlLXJlbmRlcmluZzpwaXhlbGF0ZWQgIWltcG9ydGFudDt6LWluZGV4OjIxNDc0ODM2NDc7YmFja2dyb3VuZC1pbWFnZTp1cmwoJ2RhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBQ3NBQUFBV0JBTUFBQUNybDNpQUFBQUFCbEJNVkVVQUFBRCtBY2lXbVp6V0FBQUFBblJTVGxNQUFwaWRyQlFBQUFCOFNVUkJWQmpUYlZDSkVjQXdDTUlOMkgvYVZoRmpyalhtOFVRa0F2OFdzbnJ1aUpYbDJubEdJZ3FZUHRHYklZbTFLbkorMXFBUE53OTM5eDZzZGRsb3JIUkxQR0xGVFNzcDdYV1pEL0x1Y1lrZ3A4dW9zSVpiUjdWSVlOcVpXZlBxV3Ira1NEOFRWSTMvNkpsQnBGMXpacllxYnU2R0UxdEpUQW53QUN4UUJaVkQyRjJDQUFBQUFFbEZUa1N1UW1DQycpICFpbXBvcnRhbnQ7XCI%2BPC9kaXY%2BPC9ib2R5PjwvaHRtbD48IS0tIElGUkFNRSBJTk5FUiBDT05URU5UIC0tPiIsIm1ldGEiOnsicGxSYXRpbyI6MC4wMX19&i=6-6&t=adltag_kgwrwklw_rrM4X63v0cE&r=2e511a72bb7ad7582eb7de24a38f307&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.20.54 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 f857c6fa23ed7b2d0b237aefe9c50960.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 29050
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Fri, 30 Oct 2020 13:28:57 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: ZAG50-C1
accept-ranges: bytes
x-amz-cf-id: uv-4JlkRObqsdGbauGGKilrrMGMvxZrmmQqStRChk0t36ixPNAFrCw==

GET
H3-Q050

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 5535
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

41ms
39ms

Image
text/html

2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date: Fri, 30 Oct 2020 21:33:06 GMT
x-content-type-options: nosniff
server: safe
status: 302
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
7 KB 36ms
17ms XHR
application/json 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020102601&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020102601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

30e0cced7a4cc5fbf3600b86a37078cbe186ff25560c37da868daa2bf1a3f0ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 30 Oct 2020 21:33:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6526
x-xss-protection: 0

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/18272868642523537273/ Frame 29CE 22 KB
22 KB 6ms
6ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/032010270040000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5514ce28663ab40231eadef99a2728a934558fb65a0a666d4d7abbea65969a3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 29 Oct 2020 09:15:18 GMT
x-content-type-options: nosniff
last-modified: Mon, 21 Sep 2020 16:30:31 GMT
server: sffe
age: 130668
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22961
x-xss-protection: 0
expires: Fri, 29 Oct 2021 09:15:18 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/18372800752111016132/ Frame 29CE 41 KB
41 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/032010270040000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b25cbe4632e8840ea52359bb65b436e23b6e435d1153925d0261936f7651daea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 29 Oct 2020 22:22:24 GMT
x-content-type-options: nosniff
last-modified: Mon, 23 Sep 2019 17:14:48 GMT
server: sffe
age: 83442
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42228
x-xss-protection: 0
expires: Fri, 29 Oct 2021 22:22:24 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 29CE 2 KB
2 KB 7ms
7ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/032010270040000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 30 Oct 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 37448
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Sat, 31 Oct 2020 11:08:58 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 29CE 295 B
319 B 7ms
6ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/032010270040000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 29 Oct 2020 22:32:01 GMT
x-content-type-options: nosniff
server: cafe
age: 82865
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 30 Oct 2020 22:32:01 GMT

GET
H3-Q050 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 16 KB
6 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1603823857801521"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6015
x-xss-protection: 0
expires: Fri, 30 Oct 2020 21:33:07 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/2620902511481989051/ Frame 5535 29 KB
29 KB 7ms
6ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/032010270040000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3865ad0db89497d72c806c4448fcd29f6dc9b1d6a72dfca1f56ebf768b50eb9f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 17:47:00 GMT
x-content-type-options: nosniff
last-modified: Wed, 26 Aug 2020 17:01:09 GMT
server: sffe
age: 13567
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29496
x-xss-protection: 0
expires: Sat, 30 Oct 2021 17:47:00 GMT

GET
H3-Q050 200 40933678460698624
tpc.googlesyndication.com/simgad/ Frame 5535 1 KB
761 B 7ms
6ms Image
image/svg+xml 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/40933678460698624

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/032010270040000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

09fba596f1ba572cf4b3ceb9c1f3962d1b75bbb4a6d6d7707f1f93e2fe889aee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 09:23:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 389350
x-dns-prefetch-control: off
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 728
x-xss-protection: 0
last-modified: Thu, 26 Oct 2017 18:18:20 GMT
server: sffe
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Oct 2021 09:23:57 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 5535 2 KB
2 KB 7ms
6ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/032010270040000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 30 Oct 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 37449
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Sat, 31 Oct 2020 11:08:58 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 5535 295 B
325 B 7ms
6ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/032010270040000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 29 Oct 2020 22:32:01 GMT
x-content-type-options: nosniff
server: cafe
age: 82866
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 30 Oct 2020 22:32:01 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 1DA5 2 KB
2 KB 8ms
7ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/032010270040000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 30 Oct 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 37449
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Sat, 31 Oct 2020 11:08:58 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 1DA5 295 B
321 B 7ms
7ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/032010270040000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 29 Oct 2020 22:32:01 GMT
x-content-type-options: nosniff
server: cafe
age: 82866
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 30 Oct 2020 22:32:01 GMT

GET
H3-Q050 200 66019e7147d963cc1f94fbdefaf0fd20.jpg
tpc.googlesyndication.com/sadbundle/14659877060161173457/media/ Frame 1DA5 42 KB
42 KB 11ms
6ms Image
image/jpeg 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/14659877060161173457/media/66019e7147d963cc1f94fbdefaf0fd20.jpg

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/032010270040000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5783dc9bd9c49e0df78654420128996461fb42be3e2874bc8ec7c96f1f2e4fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 29 Oct 2020 11:43:34 GMT
x-content-type-options: nosniff
age: 121773
x-dns-prefetch-control: off
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43480
x-xss-protection: 0
last-modified: Wed, 23 Sep 2020 07:15:43 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Oct 2021 11:43:34 GMT

GET
H3-Q050 200 32ae814996b4bb04eca4372e83a6df23.png
tpc.googlesyndication.com/sadbundle/14659877060161173457/media/ Frame 1DA5 46 KB
46 KB 11ms
6ms Image
image/png 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/14659877060161173457/media/32ae814996b4bb04eca4372e83a6df23.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/032010270040000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3be11f9ebd54a6c51e13196bfbc965a968681f5422d4ebd821eff51c6e9c8473

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 29 Oct 2020 11:43:34 GMT
x-content-type-options: nosniff
age: 121773
x-dns-prefetch-control: off
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47348
x-xss-protection: 0
last-modified: Wed, 23 Sep 2020 07:15:43 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 29 Oct 2021 11:43:34 GMT

GET
H3-Q050 200 3bdaf7e57d3639b689ad85585e344e6a.svg
tpc.googlesyndication.com/sadbundle/14659877060161173457/media/ Frame 1DA5 7 KB
3 KB 11ms
6ms Image
image/svg+xml 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/14659877060161173457/media/3bdaf7e57d3639b689ad85585e344e6a.svg

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/032010270040000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0ac7ae7534a5adac4aa0f361ee4ea6c5c98c072cfdb6f3503514f74c0b1a8509

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 17:47:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13539
x-dns-prefetch-control: off
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3005
x-xss-protection: 0
last-modified: Wed, 23 Sep 2020 07:15:43 GMT
server: sffe
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Oct 2021 17:47:28 GMT

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 34ms
33ms Other 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

status: 200
retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Fri, 30 Oct 2020 21:33:07 GMT
x-served-by: cache-hhn4073-HHN
x-cache: HIT
x-cache-hits: 0
x-timer: S1604093587.099202,VS0,VE0
cache-control: max-age=31557600
content-length: 0

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 52B6 390 KB
390 KB 35ms
35ms XHR
video/mp4 151.101.194.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 91e8f81ef3c99be20d905536aa719b1fd716ce7760080c3ca6b0cd552723535d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=456335-855191

Response headers

date: Fri, 30 Oct 2020 21:33:07 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 2808061
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5129-BWI, cache-hhn4073-HHN
status: 206
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 456335-855191/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1604093587.133982,VS0,VE0
access-control-allow-origin: *
Content-Length: 398857
x-cache-hits: 1, 3

POST
H/1.1 200
OK mq Show response
capi.connatix.com/tr/ Frame 52B6 0
323 B 142ms
141ms XHR
multipart/form-data 52.14.222.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/mq?v=72327
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.14.222.78 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-14-222-78.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Fri, 30 Oct 2020 21:33:07 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H3-Q050 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/219/ Frame EF5D 0
0 6ms
6ms Document
text/html 2a00:1450:4001:800::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/219/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/219/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 4867
date: Fri, 30 Oct 2020 21:05:14 GMT
expires: Sat, 30 Oct 2021 21:05:14 GMT
last-modified: Mon, 05 Oct 2020 22:33:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1673
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
195 B 17ms
16ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=219&t=2&li=gpt_2020102601&jk=1906112477480722&bg=!urmluZnNAAVp0lmVaVjMIMdQtdgCbAIAAABWUgAAAA4KAMZnw2kCUzpt0r8ZN0bdtcFT3A3I0es8w-cf9NvCAuFrArhrx7JMy1_O0yUAuJ9UH8bkofXrwjegpFa_phHdkXhxPQloFgNA-O_2civjO8Iqwj8xwTq-bNXKIFekKdN0dxPNH94qCpn9FwiBEmzfUBhkIgCpvha-msSImbJn4ut9iCsOUGKo2iiqUdiUpeiPw5ihlKuFDOVPI3yVll2TBYjfL3Y3b0gAHht2KLJszWRXYiu_qMVsFif7kyiy58UGGvCAJYVvz1WZAacinqTpoE8eSZCsbGUP4OMib5VaEx2vQSqhRgZfAbkRmueWIZ5ZWPZxuvPZ-_MbTMzaPqOo2tRTQtLoOGulnUQ3FIOLImAHhbdxUXw3LzFSz6EZ3YsvPpaPhlUR837vpiQTn_cJsgXmSRCAVr7E7Q0S_sOIlV53RbStFbEdbE6V-t1t4q3-KclW1l6Sixz2KfZwg54C_FWXl-o6aK70xgEli0s-VbFYZeIEFTWxv50HiSuzvdG0JNzAeEom_p9eC08nsURz5kR_Xvpd5W78phOidIVj74PcSFEEkOpce73PssOvhmilLNNy-MSYjqx29JNa3wfBhQUoAAJga8RppwvbVIxVXqFeFBIKBFtPE-K0AAFljGu1SJ-RhB-H37U4lt_xrmsFSYmK1NrSVpgZPCwTiYyQSS0gsEMn-_r8dN_E47m6DvhCc6BdM7VcJsBJde57kgzvl7u9T_I0qSsnJG67i2gRWc0VCNkzS3AfjbFd-JcVRbB0eUmSOF-u38SO-ZbIxjTcrINThuFm7R580nwFxX8RMyL0RJTsux_TxrmiKhbgNb36ktM

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK sv Show response
capi.connatix.com/tr/ Frame 52B6 0
323 B 142ms
142ms XHR
multipart/form-data 52.14.222.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/sv?v=72327
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.14.222.78 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-14-222-78.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Fri, 30 Oct 2020 21:33:07 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H3-Q050 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 29CE 42 B
93 B 22ms
21ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssKTB6J7tIzwoOU-hofzZiFI5Wn-qSSfqPzeUP968EYdLv5bsbR8jYHt6p2DD8YNSDPQ7t2lfd8OsUyzB4Hkg3m0rIAFmOS84GAjH3r03fbfQ8G1WRBwj9NoOaEysZ53BJPbLG5lTLpiHsspgBbn43Mag&sai=AMfl-YR2dPLKvhrh10kVdmQGg_wuYZhfcApQctOWJTa8XEuBfrk7Yf-JenMBdhQhKS1u2kAYf9ohiXvrR7EEEAjflFpzrCn9IWGYu1rlfKvgTSjRox7FPjPUTszfpa2Kke4&sig=Cg0ArKJSzPjmBEKm87DMEAE&cid=CAASPeRo_grE1zjJEbDvA0zBKJZLSfHIhbGBmxa4MdtKeiqW2r9RBa8mdXCa5S2CUdUR8tVMaGAg7g9W56mZttA&id=ampim&o=315,10&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1002&mtos=0,0,0,1002,1002&tos=0,0,0,1002,0&tfs=321&tls=1323&g=100&h=100&tt=1323&r=v&avms=ampa&adk=1015519800

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 5535 42 B
65 B 17ms
16ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvn6FaQEsWqFNOj27NoIqdogU4T5iXtxpsmgY7WPrDO_BTwy_8_QzAS61e8aTFQuYofqj450EcNs0M4Fhx5mc_9lXKnwqEUhFqcGgL9Z-BVekV6pBgK1rw9OqSrYA&sai=AMfl-YS8ERy292iDCN-P7cnBvwQ2TCfqgV9JFLInGrhDvOeW_ZgI_7AYGEzNBUJmMU-A8ir6rb2sDS8am3-U_im1E4F7Ol1NoFPQqCFKCzsXrnZDngsW-mVjatVdT-mr6tg&sig=Cg0ArKJSzEizDQKdZp3yEAE&cid=CAASPeRoKrEXI8TsOijchihz4SjZB0nYkumHq3vrRKHzjKMm0f76A5gU3QaQbQVuIUH3IJZHYSR-5n5JCAE2BOs&id=ampim&o=1064,417&d=336,280&ss=1600,1200&bs=1600,1200&mcvt=1005&mtos=0,0,1005,1005,1005&tos=0,0,1005,0,0&tfs=232&tls=1237&g=100&h=100&tt=1237&r=v&avms=ampa&adk=654286612

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 7072 0
0 146ms
66ms Document
text/html 23.210.249.92
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.92 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-92.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified: Wed, 21 Oct 2020 18:57:52 GMT
ETag: "13006b6-94f8-5b232eca8cf5e"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=88488
Expires: Sat, 31 Oct 2020 22:07:57 GMT
Date: Fri, 30 Oct 2020 21:33:09 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 pd
u.openx.net/w/1.0/ Frame DBC8 0
0 46ms
44ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.197.0 /
Resource Hash

Request headers

:method: GET
:authority: u.openx.net
:scheme: https
:path: /w/1.0/pd
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=7b2fc8f0-53df-4b51-b703-126c2014a712|1604093585
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=7b2fc8f0-53df-4b51-b703-126c2014a712|1604093585; Version=1; Expires=Sat, 30-Oct-2021 21:33:09 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1604093589|gekin0vNiygu; Version=1; Expires=Sat, 14-Nov-2020 21:33:09 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.197.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 30 Oct 2020 21:33:09 GMT
content-type: text/html
content-length: 419
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame F313 0
0 151ms
50ms Document
text/html 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: Apache
Last-Modified: Tue, 06 Oct 2020 14:04:48 GMT
ETag: "e20015-8f4-5b10114f2003a"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1136
Date: Fri, 30 Oct 2020 21:33:09 GMT
Connection: keep-alive

GET
H2 200 pd
u.openx.net/w/1.0/ Frame 0862 0
0 46ms
45ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.197.0 /
Resource Hash

Request headers

:method: GET
:authority: u.openx.net
:scheme: https
:path: /w/1.0/pd
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=7b2fc8f0-53df-4b51-b703-126c2014a712|1604093585
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=7b2fc8f0-53df-4b51-b703-126c2014a712|1604093585; Version=1; Expires=Sat, 30-Oct-2021 21:33:09 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1604093589|gekin0vNiygu; Version=1; Expires=Sat, 14-Nov-2020 21:33:09 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.197.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 30 Oct 2020 21:33:09 GMT
content-type: text/html
content-length: 419
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame FF24 0
0 131ms
47ms Document
text/html 23.210.249.83
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.83 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-83.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified: Tue, 24 Mar 2020 15:52:19 GMT
ETag: "5e7a2cb3-cefd"
Server: nginx/1.13.10
Access-Control-Allow-Origin: *
Content-Type: text/html
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 17037
Cache-Control: max-age=86402
Expires: Sat, 31 Oct 2020 21:33:11 GMT
Date: Fri, 30 Oct 2020 21:33:09 GMT
Connection: keep-alive

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame 0D4C 0
0 155ms
53ms Document
text/html 23.210.249.83
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.83 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-83.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified: Tue, 24 Mar 2020 15:52:19 GMT
ETag: "5e7a2cb3-cefd"
Server: nginx/1.13.10
Access-Control-Allow-Origin: *
Content-Type: text/html
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 17037
Cache-Control: max-age=86402
Expires: Sat, 31 Oct 2020 21:33:11 GMT
Date: Fri, 30 Oct 2020 21:33:09 GMT
Connection: keep-alive

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame AB47 0
0 148ms
69ms Document
text/html 23.210.249.92
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.92 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-92.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Last-Modified: Wed, 21 Oct 2020 18:57:52 GMT
ETag: "13006b6-94f8-5b232eca8cf5e"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=88488
Expires: Sat, 31 Oct 2020 22:07:57 GMT
Date: Fri, 30 Oct 2020 21:33:09 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame 9405 0
0 148ms
50ms Document
text/html 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: Apache
Last-Modified: Tue, 06 Oct 2020 14:04:48 GMT
ETag: "e20015-8f4-5b10114f2003a"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1136
Date: Fri, 30 Oct 2020 21:33:09 GMT
Connection: keep-alive

GET
H2

204

sync
pixel.advertising.com/ups/55953/ Frame 52B6
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1
https://pixel.advertising.com/ups/55953/sync?uid=e029b187-f4c1-4d31-9bd9-9100b93ce7cb&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=e029b187-f4c1-4d31-9bd9-9100b93ce7cb

0
124 B

46ms
45ms

Image
text/plain

35.156.106.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55953/sync?uid=e029b187-f4c1-4d31-9bd9-9100b93ce7cb&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=e029b187-f4c1-4d31-9bd9-9100b93ce7cb

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.156.106.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-156-106-231.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Fri, 30 Oct 2020 21:33:09 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:09 GMT
x-aspnet-version: 4.0.30319
status: 302
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.advertising.com/ups/55953/sync?uid=e029b187-f4c1-4d31-9bd9-9100b93ce7cb&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=e029b187-f4c1-4d31-9bd9-9100b93ce7cb
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 369

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/55986/ Frame 52B6
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_...
https://pixel.advertising.com/ups/55986/sync?uid=X5yGlQAAALBxxSzr&_origin=0&gdpr=0&gdpr_consent=&_test=X5yGlQAAALBxxSzr
https://ups.analytics.yahoo.com/ups/55986/sync?uid=X5yGlQAAALBxxSzr&_origin=0&gdpr=0&gdpr_consent=&_test=X5yGlQAAALBxxSzr&apid=1A7ecdc954-1af7-11eb-8221-12724de64e5e

0
963 B

106ms
38ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55986/sync?uid=X5yGlQAAALBxxSzr&_origin=0&gdpr=0&gdpr_consent=&_test=X5yGlQAAALBxxSzr&apid=1A7ecdc954-1af7-11eb-8221-12724de64e5e

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/7.1.2.113 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 30 Oct 2020 21:33:09 GMT
Server: ATS/7.1.2.113
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status: 302
date: Fri, 30 Oct 2020 21:33:09 GMT
location: https://ups.analytics.yahoo.com/ups/55986/sync?uid=X5yGlQAAALBxxSzr&_origin=0&gdpr=0&gdpr_consent=&_test=X5yGlQAAALBxxSzr&apid=1A7ecdc954-1af7-11eb-8221-12724de64e5e
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 %7Bcombo_uid%7D
pr-bh.ybp.yahoo.com/sync/adaptv_ortb/ Frame 52B6 43 B
839 B 130ms
43ms Image
image/gif 2a00:1288:110:c305::8000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/adaptv_ortb/%7Bcombo_uid%7D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 30 Oct 2020 21:33:09 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/57304/ Frame 52B6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc
https://pixel.advertising.com/ups/57304/sync?uid=CAESEMxggaSNfnTNzKp1f4N_Qr0&google_cver=1
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEMxggaSNfnTNzKp1f4N_Qr0&google_cver=1&apid=1A7ecdc954-1af7-11eb-8221-12724de64e5e

0
963 B

110ms
38ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEMxggaSNfnTNzKp1f4N_Qr0&google_cver=1&apid=1A7ecdc954-1af7-11eb-8221-12724de64e5e

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/7.1.2.113 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 30 Oct 2020 21:33:09 GMT
Server: ATS/7.1.2.113
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status: 302
date: Fri, 30 Oct 2020 21:33:09 GMT
location: https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEMxggaSNfnTNzKp1f4N_Qr0&google_cver=1&apid=1A7ecdc954-1af7-11eb-8221-12724de64e5e
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 sync.html
public.servenobid.com/ Frame 6D20 0
0 102ms
17ms Document
text/html 2620:1ec:bdf::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

:method: GET
:authority: public.servenobid.com
:scheme: https
:path: /sync.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
cache-control: max-age=86400
content-type: text/html
content-encoding: br
last-modified: Tue, 27 Oct 2020 00:12:31 GMT
accept-ranges: bytes
etag: "834d0054029be21b49b8bf287a72afac"
server: AmazonS3
x-cache: TCP_HIT
x-amz-id-2: xUMQcJ/0hriDGiAFYpmFIQbGwEJMTxHKa0o0rbfuVVntivHRPISbpg5IM74ecrdkLKIj7JHoWy8=
x-amz-request-id: 6DC15474778C7770
x-azure-ref-originshield: 0nVubXwAAAABNLBSvrOJsRKnQGQNYORVhTE9OMjFFREdFMDIwNgA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
x-azure-ref: 0loacXwAAAACnSeJPq8FKTLMF/3ziH1DVQlJVMzBFREdFMDQxNgA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
date: Fri, 30 Oct 2020 21:33:10 GMT

GET
H/1.1

200
OK

2000891.html
serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/ Frame FC30
Redirect Chain

https://sync.serverbid.com/ss/2000891.html
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

0
0

313ms
59ms

Document
text/html

205.185.216.42
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US),

Reverse DNS

map2.hwcdn.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Date: Fri, 30 Oct 2020 21:33:11 GMT
Connection: Keep-Alive
Cache-Control: max-age=45063
Content-Length: 4947
Content-Type: text/html
Last-Modified: Wed, 20 Nov 2019 20:29:05 GMT
Accept-Ranges: bytes
ETag: "1b0ebac83fe30af80513039edbdf566f"
x-amz-request-id: tx0000000000000005a543a-005f9be51e-408cf2d-nyc3a
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
Vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW: 1604093591.dop216.pa1.t,1604093591.cds022.pa1.shn,1604093591.cds022.pa1.c

Redirect headers

status: 302
content-length: 0
location: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
cache-control: no-cache

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame 281E 0
0 133ms
41ms Document
text/html 104.111.230.142
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.230.142 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-230-142.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: rsid=1|AIfsdBUH+v3fWCPuzNowDE/csJlhKa2tgCFRUZWfOQd0q435P2/gQaqTCqCKieGkTxzCtz/GWjvGSkTNWjmsGgfE/2wGlVwK8BMqZcvhERo6qmPGCb9ZP8X4JPKBYjCRbro=; ses15=; vis15=300372^1; khaos=KGWRWJQP-L-BA3M; ses2=; vis2=300372^1; audit=1|hLZGFuTafB3+wMe9sI2/iXp4/TMPY9XwwNPOYNjVSL7rH3lk51lEQED3pCcW8TpHcpj76PKZXj8oT2OqK/B16qwRNgFmLHdP
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Mon, 28 Sep 2020 17:02:39 GMT
ETag: "4000c-123-5b062a240e9c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 238
Content-Type: text/html; charset=UTF-8
Date: Fri, 30 Oct 2020 21:33:10 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2

200

sync
eb2.3lift.com/ Frame C98B
Redirect Chain

https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

0
0

39ms
36ms

Document
text/html

52.58.138.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.58.138.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: eb2.3lift.com
:scheme: https
:path: /sync?&ld=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: tluid=298779486498374607
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
date: Fri, 30 Oct 2020 21:33:10 GMT
content-type: text/html; charset=utf-8
content-length: 495
set-cookie: sync=CgoIgQIQkfq229cuCgoIoQEQkfq229cuCgoI4gEQkfq229cuCgoI5gEQkfq229cuCgoIhwIQkfq229cuCgkIORCR-rbb1y4KCQg6EJH6ttvXLgoJCAsQkfq229cuCgkIXxCR-rbb1y4KCQgfEJH6ttvXLg==; Max-Age=7776000; Expires=Thu, 28 Jan 2021 21:33:10 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=298779486498374607; Max-Age=7776000; Expires=Thu, 28 Jan 2021 21:33:10 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
content-encoding: gzip
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control: no-cache, no-store, must-revalidate

Redirect headers

status: 302
date: Fri, 30 Oct 2020 21:33:10 GMT
content-length: 0
set-cookie: tluid=298779486498374607; Max-Age=7776000; Expires=Thu, 28 Jan 2021 21:33:10 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
location: /sync?&ld=1
cache-control: no-cache, no-store, must-revalidate
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 pd
eu-u.openx.net/w/1.0/ Frame AB26 0
0 58ms
58ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.197.0 /
Resource Hash

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=7b2fc8f0-53df-4b51-b703-126c2014a712|1604093585; pd=v2|1604093589|gekin0vNiygu
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=7b2fc8f0-53df-4b51-b703-126c2014a712|1604093585; Version=1; Expires=Sat, 30-Oct-2021 21:33:10 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1604093589.1|kiiygevNgun0.mWgqsLommOns; Version=1; Expires=Sat, 14-Nov-2020 21:33:10 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.197.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 30 Oct 2020 21:33:10 GMT
content-type: text/html
content-length: 315
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 3318 0
0 52ms
52ms Document
text/html 23.210.249.92
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.92 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-92.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: KTPCACOOKIE=YES; KCCH=YES; pi=156858:2; KADUSERCOOKIE=91CD759C-5C3C-4BBF-9313-2787347E43B7; chkChromeAb67Sec=1; DPSync3=1605225600%3A201_197_219%7C1604102400%3A174; SyncRTB3=1605225600%3A220_21_13_56_161%7C1605312000%3A35; PUBMDCID=3; KRTBCOOKIE_80=16514-CAESEOi1a34z9HVQMXOquwNBK-Y&KRTB&22987-CAESEOi1a34z9HVQMXOquwNBK-Y&KRTB&23025-CAESEOi1a34z9HVQMXOquwNBK-Y; SPugT=1604093589; KRTBCOOKIE_391=22924-518926279747910331; KRTBCOOKIE_336=5844-1384751050131730543; PugT=1604093588
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Last-Modified: Wed, 21 Oct 2020 18:57:52 GMT
ETag: "13006b6-94f8-5b232eca8cf5e"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=88487
Expires: Sat, 31 Oct 2020 22:07:57 GMT
Date: Fri, 30 Oct 2020 21:33:10 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame C313 0
0 57ms
57ms Document
text/html 23.210.249.83
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.83 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-83.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Last-Modified: Tue, 24 Mar 2020 15:52:19 GMT
ETag: "5e7a2cb3-cefd"
Server: nginx/1.13.10
Access-Control-Allow-Origin: *
Content-Type: text/html
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 17037
Cache-Control: max-age=86402
Expires: Sat, 31 Oct 2020 21:33:12 GMT
Date: Fri, 30 Oct 2020 21:33:10 GMT
Connection: keep-alive

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame 3938 0
0 60ms
51ms Document
text/html 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Server: Apache
Last-Modified: Tue, 06 Oct 2020 14:04:48 GMT
ETag: "e20015-8f4-5b10114f2003a"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1136
Date: Fri, 30 Oct 2020 21:33:10 GMT
Connection: keep-alive

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D86b9a153-a242-4608-9453-d46185baaaf3%26D%3D%26bidder%3Dappnexus%26uid%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fprebid.a-mo.net%252Fsetuid%253FA%253D86b9a153-a242-4608-9453-d46185baaaf3%2526D%253D%2526bidder%253Dappnexus%2526uid%253D%2524UID
https://prebid.a-mo.net/setuid?A=86b9a153-a242-4608-9453-d46185baaaf3&D=&bidder=appnexus&uid=9101200317742800161

0
117 B

127ms
122ms

Image
text/plain

136.144.59.88
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=86b9a153-a242-4608-9453-d46185baaaf3&D=&bidder=appnexus&uid=9101200317742800161
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.144.59.88 , United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Fri, 30 Oct 2020 21:33:10 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 3
server: envoy

Redirect headers

Pragma: no-cache
Date: Fri, 30 Oct 2020 21:33:10 GMT
X-Proxy-Origin: 185.156.175.107; 185.156.175.107; 721.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.133:80
AN-X-Request-Uuid: d19851b3-8316-4be8-9617-2512377e8c4a
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://prebid.a-mo.net/setuid?A=86b9a153-a242-4608-9453-d46185baaaf3&D=&bidder=appnexus&uid=9101200317742800161
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 403 /
c1.adform.net/serving/cookie/match/ 0
187 B 62ms
57ms Image
text/plain 37.157.2.237
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match/?CC=1&party=15&gdpr=1&gdpr_consent=&curl=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55944%2Fsync%3Fuid%3D%24UID%26_origin%3D0%26gdpr%3d1%26gdpr_consent%3d

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.237 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:10 GMT
server: nginx
status: 403
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
expires: -1

GET
H2

204

sync
pixel.advertising.com/ups/55965/
Redirect Chain

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent=
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=vzQNhbJkDdanN1WC62QZ1e8zAoWnNgzesmRcpsZF

0
124 B

52ms
46ms

Image
text/plain

35.156.106.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=vzQNhbJkDdanN1WC62QZ1e8zAoWnNgzesmRcpsZF

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.156.106.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-156-106-231.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Fri, 30 Oct 2020 21:33:10 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:10 GMT
status: 302
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=vzQNhbJkDdanN1WC62QZ1e8zAoWnNgzesmRcpsZF
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 204 sync
pixel.advertising.com/ups/56465/ 0
124 B 49ms
45ms Image
text/plain 35.156.106.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/56465/sync?_origin=0&redir=true&gdpr=1&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.156.106.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-156-106-231.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Fri, 30 Oct 2020 21:33:10 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 generic
match.adsrvr.org/track/cmf/ 70 B
264 B 153ms
150ms Image
image/gif 54.229.128.207
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=aoladtech&gdpr=1&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.229.128.207 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-229-128-207.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:10 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
status: 200
cache-control: private,no-cache, must-revalidate
content-type: image/gif
content-length: 70

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=false&gdpr_consent=&us_privacy=1---&redirectUri=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D86b9a153-a242-4608-9453-d46185baaaf3%2...
https://prebid.a-mo.net/setuid?A=86b9a153-a242-4608-9453-d46185baaaf3&D=&bidder=smartadserver&uid=8212392075593889733

0
123 B

131ms
129ms

Image
text/plain

136.144.59.88
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=86b9a153-a242-4608-9453-d46185baaaf3&D=&bidder=smartadserver&uid=8212392075593889733
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.144.59.88 , United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Fri, 30 Oct 2020 21:33:10 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 3
server: envoy

Redirect headers

location: https://prebid.a-mo.net/setuid?A=86b9a153-a242-4608-9453-d46185baaaf3&D=&bidder=smartadserver&uid=8212392075593889733
date: Fri, 30 Oct 2020 21:33:10 GMT
content-length: 0

GET
H2 204 current
aol-match.dotomi.com/match/bounce/ 0
103 B 45ms
41ms Image
text/plain 2a02:fa8:8806:20::2010
VCLK-EU-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aol-match.dotomi.com/match/bounce/current?networkId=60&version=1&nuid=1A7ecd6cfc-1af7-11eb-b364-126de4777bf4&gdpr=1&gdpr_consent=&rurl=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55853%2Fsync%3Fuid%3D%24UID%26_origin%3D0%26gdpr%3D1%26gdpr_consent%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:20::2010 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Fri, 30 Oct 2020 21:33:10 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D86b9a153-a242-4608-9453-d46185baaaf3%26D%3D%26bidder%3Dindex_rtb%26uid%3D
https://prebid.a-mo.net/setuid?A=86b9a153-a242-4608-9453-d46185baaaf3&D=&bidder=index_rtb&uid=X5yGkeyUorqmdH4ySV0EAQAA%261208

0
115 B

126ms
123ms

Image
text/plain

136.144.59.88
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=86b9a153-a242-4608-9453-d46185baaaf3&D=&bidder=index_rtb&uid=X5yGkeyUorqmdH4ySV0EAQAA%261208
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.144.59.88 , United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Fri, 30 Oct 2020 21:33:10 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 3
server: envoy

Redirect headers

Pragma: no-cache
Date: Fri, 30 Oct 2020 21:33:10 GMT
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://prebid.a-mo.net/setuid?A=86b9a153-a242-4608-9453-d46185baaaf3&D=&bidder=index_rtb&uid=X5yGkeyUorqmdH4ySV0EAQAA%261208
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 321
Expires: Fri, 30 Oct 2020 21:33:10 GMT

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D86b9a153-a242-4608-9453-d46185baaaf3%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID
https://prebid.a-mo.net/setuid?A=86b9a153-a242-4608-9453-d46185baaaf3&D=&bidder=sovrn&uid=2a7dc972243b036c5b9bef9b

0
141 B

123ms
120ms

Image
text/plain

136.144.59.88
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=86b9a153-a242-4608-9453-d46185baaaf3&D=&bidder=sovrn&uid=2a7dc972243b036c5b9bef9b
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.144.59.88 , United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Fri, 30 Oct 2020 21:33:10 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy

Redirect headers

Date: Fri, 30 Oct 2020 21:33:10 GMT
Server: nginx
Location: https://prebid.a-mo.net/setuid?A=86b9a153-a242-4608-9453-d46185baaaf3&D=&bidder=sovrn&uid=2a7dc972243b036c5b9bef9b
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H2

204

sync
pixel.advertising.com/ups/55946/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_cm&google_hm=MUE3ZWNkNmNmYy0xYWY3LTExZWItYjM2NC0xMjZkZTQ3NzdiZjQ%3D&gdpr=1&gdpr_consent=&_origin=0
https://pixel.advertising.com/ups/55946/sync?uid=CAESEH0SDcnxNvaLIvFsWoyJbj8&gdpr=1&gdpr_consent=&_origin=0&google_cver=1

0
124 B

48ms
46ms

Image
text/plain

35.156.106.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55946/sync?uid=CAESEH0SDcnxNvaLIvFsWoyJbj8&gdpr=1&gdpr_consent=&_origin=0&google_cver=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.156.106.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-156-106-231.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Fri, 30 Oct 2020 21:33:10 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Fri, 30 Oct 2020 21:33:10 GMT
server: HTTP server (unknown)
status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel.advertising.com/ups/55946/sync?uid=CAESEH0SDcnxNvaLIvFsWoyJbj8&gdpr=1&gdpr_consent=&_origin=0&google_cver=1
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 334
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK abt Show response
capi.connatix.com/tr/ Frame 52B6 0
323 B 144ms
143ms XHR
multipart/form-data 52.14.222.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/abt?v=72327
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.14.222.78 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-14-222-78.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Fri, 30 Oct 2020 21:33:10 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK st Show response
capi.connatix.com/tr/ Frame 52B6 0
323 B 142ms
141ms XHR
multipart/form-data 52.14.222.78
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/st?v=72327
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.14.222.78 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-14-222-78.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Fri, 30 Oct 2020 21:33:12 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.threatpost.com/	1970-01-19 22:56:29	Name: __gads Value: ID=1f28de91245204b2-22c4c57f1cb9004f:T=1604093585:S=ALNI_Mbm2egr2-cBpXxiUaJykCD0_hbHfA
.threatpost.com/	1970-01-19 22:59:22	Name: __qca Value: P0-1863969756-1604093584932
.threatpost.com/	1970-01-20 07:06:05	Name: _ga Value: GA1.2.746451303.1604093585
.threatpost.com/	1970-01-19 13:36:19	Name: _gid Value: GA1.2.341230511.1604093585
.threatpost.com/	1970-01-19 13:34:53	Name: _gat_UA-35676203-21 Value: 1
.amazon-adsystem.com/	1970-01-21 10:55:03	Name: ad-privacy Value: 0
.amazon-adsystem.com/	1970-01-19 19:26:15	Name: ad-id Value: A5e7-Abn-0YasHcEo8Q6Sbs
threatpost.com/	1970-01-29 13:33:27	Name: usprivacy Value: 1---

66 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 372) Message: gBrowserWidth =1600
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-970x250-ATF div-gpt-ad-6794670-2
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-300x250-ATF div-gpt-ad-6794670-3
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-300x600-ATF div-gpt-ad-6794670-5
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-2x2-Skin div-gpt-ad-6794670-1
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: %cCMP: Startup v270 color: #555599
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: uspapi_init() - v0.105
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: USP: Locale=en-us gdpr= false
console-api	warning	URL: https://qd.admetricspro.com/js/threatpost/prebid.js(Line 3) Message: fun-hooks: referenced 'registerAdserver' but it was never created
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: ENGINE: gAMPidentityLinkID not present, prebid configured without identyLink
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: ENGINE: gSChainNodes found, prebid configured with 1 supply chain object(s)
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: ENGINE: final pbjs config
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: Initial Ad Load
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: No existing consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: %cCMP: GVL version is 45 color: #555599
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: __uspLaunch begin
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: No existing consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: checking non TCF vendor cookie
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: No existing non-TCF consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP response tcData.eventStatus=cmpuishown tcData.cmpStatus=loaded
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP response tcData.eventStatus=cmpuishown tcData.cmpStatus=loaded
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: Locale=en-us gdpr= false
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: GDPR does not apply
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP response tcData.eventStatus=useractioncomplete tcData.cmpStatus=loaded
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=useractioncomplete
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests() gPBJSTimeoutTimer=null pbjs.adserverRequestSent=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: Amazon bids returned, count=4
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object],[object Object],[object Object],[object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: No existing consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs bids returned
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: gPBJSTimeoutTimer cleared
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest(): pbjsBidsBack
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest()
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs.getAdserverTargeting: >> Amazon >> Prebid
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs.getBidResponses:
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: gThisRefreshSlots=
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object],[object Object],[object Object],[object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest(): ---> Calling googletag.pubads().refresh()
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: No existing consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: console.groupEnd
console-api	warning	URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js(Line 3) Message: fun-hooks: referenced 'registerAdserver' but it was never created
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: geo IP found region Basel-Landschaft
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: USP does not apply to Basel-Landschaft
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: Setting not applicable signal
console-api	info	URL: https://cdn.ampproject.org/rtv/032010270040000/amp4ads-v0.js(Line 416) Message: Powered by AMP ⚡ HTML – Version 2010270040000 https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
console-api	info	URL: https://cdn.ampproject.org/rtv/032010270040000/amp4ads-v0.js(Line 416) Message: Powered by AMP ⚡ HTML – Version 2010270040000 https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
console-api	info	URL: https://cdn.ampproject.org/rtv/032010270040000/amp4ads-v0.js(Line 416) Message: Powered by AMP ⚡ HTML – Version 2010270040000 https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aax-eu.amazon-adsystem.com
acdn.adnxs.com
ads.adaptv.advertising.com
ads.pubmatic.com
ads.servenobid.com
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
analytics.twitter.com
aol-match.dotomi.com
ap.lijit.com
as-sec.casalemedia.com
assets.threatpost.com
c.amazon-adsystem.com
c1.adform.net
capi.connatix.com
cd.connatix.com
cdn.ampproject.org
cds.connatix.com
cm.g.doubleclick.net
ddfc2cf2e1ffe31253d42116313ebe73.safeframe.googlesyndication.com
e.serverbid.com
eb2.3lift.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
geo.ipify.org
googleads.g.doubleclick.net
graph.facebook.com
hbopenbid.pubmatic.com
htlb.casalemedia.com
ib.adnxs.com
img.connatix.com
js-sec.indexww.com
kasperskycontenthub.com
match.adsrvr.org
math-aids-threatpost-tagan.adlightning.com
media.threatpost.com
pagead2.googlesyndication.com
pixel.advertising.com
pixel.quantserve.com
pr-bh.ybp.yahoo.com
prebid.a-mo.net
public.servenobid.com
qd.admetricspro.com
rules.quantcount.com
secure.quantserve.com
securepubads.g.doubleclick.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
ssbsync-global.smartadserver.com
ssum.casalemedia.com
static.ads-twitter.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.serverbid.com
t.co
tagan.adlightning.com
teachingaids-d.openx.net
threatpost.com
tlx.3lift.com
tpc.googlesyndication.com
u.openx.net
ups.analytics.yahoo.com
vid.connatix.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.linkedin.com
www.reddit.com
104.111.215.135
104.111.230.142
104.244.42.197
104.244.42.3
134.209.131.220
136.144.59.88
151.101.112.157
151.101.114.137
151.101.14.49
151.101.194.137
165.227.252.242
172.217.21.226
172.217.22.98
185.33.221.91
185.64.189.112
185.86.138.131
199.232.53.140
205.185.216.42
23.210.249.164
23.210.249.83
23.210.249.92
2600:9000:20d7:7a00:6:44e3:f8c0:93a1
2600:9000:20eb:e000:0:5c46:4f40:93a1
2600:9000:2156:4c00:2:9275:3d40:93a1
2606:2800:233:97b6:26be:138a:cba8:bb01
2606:4700:e0::ac40:621c
2620:116:800d:21:5a23:9c4e:e774:96c1
2620:1ec:21::14
2620:1ec:bdf::10
2a00:1288:110:c305::8000
2a00:1450:4001:800::2001
2a00:1450:4001:801::2003
2a00:1450:4001:802::2002
2a00:1450:4001:806::200e
2a00:1450:4001:808::2002
2a00:1450:4001:80b::2001
2a00:1450:4001:80b::2008
2a00:1450:4001:814::2001
2a00:1450:4001:814::2003
2a00:1450:4001:815::2003
2a00:1450:4001:816::200e
2a00:1450:4001:817::2004
2a00:1450:4001:81a::2004
2a00:1450:4001:81f::200a
2a00:1450:4001:820::200a
2a00:1450:4001:824::2002
2a00:1450:400c:c07::9d
2a02:fa8:8806:20::2010
2a03:2880:f02d:e:face:b00c:0:2
3.124.44.162
3.126.56.137
35.156.106.231
35.158.194.251
35.173.160.135
35.244.159.8
37.157.2.237
52.14.222.78
52.58.138.20
52.95.124.170
54.229.128.207
54.246.70.54
64.140.160.2
65.9.20.101
65.9.20.54
65.9.24.128
69.173.144.140
72.251.249.14
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14
009664fccba2f9c378a86456d781825bb46a121105299f6364e314b8f472bd18
0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c
01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7
09fba596f1ba572cf4b3ceb9c1f3962d1b75bbb4a6d6d7707f1f93e2fe889aee
0a40c1b3bc56eeffdc9b506edb8d6b916fed7f315ad207d7df2a846476748e31
0aa4e66f2abe3d5d790dfe483c53bf8ff2fab13d8b35598c189db8c728ccca09
0ac7ae7534a5adac4aa0f361ee4ea6c5c98c072cfdb6f3503514f74c0b1a8509
0ad7287aa8d3ded883bae1d423809186572d23d758d6d7f160b076ddd04a665a
0b85e804fb251ae67618bd97df8472f3e43dd4af09857e5a2cc8a00f814facd2
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d
1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1e6cc52bffa814d7c7912cd64a2ef303e6a2f2387b428173dca05f032bfa5788
21e46fe44c6929876f5a413c843ae516c0ddfd1aad3e8e33446b7bc0a6781b08
24d4a5ecc42910ab71c4eba19b84e0a09ddeffb7c079801668e312180d497c96
25d6fd3b4dcdc05593cab2b4157e21194ada84e5b0de832011246e65d15fe8a9
28df7c560036a772abb8e8cc8c20bfb4fc134bac4d3ddc09a50f10dc82a53523
29d1ccb9c33e266c4d1c504bab358d65cdc889fc81171ab938f82fd6c36da10e
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d
3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838
30e0cced7a4cc5fbf3600b86a37078cbe186ff25560c37da868daa2bf1a3f0ff
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
36d8519b4bfc2a5ddf91ced4070562e108e5552475b78aa6fd4b702383f97466
3773223dc3f0b2c5f4ba6310b5eb478b52db9c305623545b0723b10a1e636b14
3865ad0db89497d72c806c4448fcd29f6dc9b1d6a72dfca1f56ebf768b50eb9f
38cb9a71128d5db487a5dd3563b18a480301f160f0e1f05e98199818b40d61e2
392cc23864e1d5ec27dc6db139581ea3da476624b962fb3b1f866248f554ae64
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a
3be11f9ebd54a6c51e13196bfbc965a968681f5422d4ebd821eff51c6e9c8473
3dc07588699fb0adc2702b0e8734bfabdbe45c1838e4fb2884511264bb9ef0a0
41f3222c29889fb48f5dca1d481858e5339a759655510c256ef4edf56c80f7f5
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730
4473451078db552a3e4c47e578a385fee86f57ba923d26d0516e2231a81e2a9e
448ca9555e0e11d8d459c0cda661886ae5ffcd271bd449a0ae4eddc1536dd7ff
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7
4862ab203a324923197af03cc62a93c2bdfd0b1de8fea281884b5ffc6fa880c0
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
49a1b4e1296645aa2f513c87a0e5fe56a305a7ed678c2f6499631ec1f3b35856
4edf4e4d19fa8ec8abf42e728012fb704a7d8e49a25bbf778b77abd20d90b8ce
4f558393e128fdda4f7e8cbbc093344c70d0872364c1c0a68de9910ed31b6399
506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70
51b80b713d82dafe9d86ff2b83dd557f60cbf887ac76483df35a75e6479b59c5
52d33cbb9109d91e22b889db5c3a4da3f72144d1bde597061d198b9b58c579c3
5514ce28663ab40231eadef99a2728a934558fb65a0a666d4d7abbea65969a3e
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf
5b1ac3e3dac03cc7b55db95d3e2f6db06359e9f83c31edfe7e8948fe1b005ece
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
651cc4fb61666e02141231920bd1d5eccb0244076416ce7351e40115f68d5564
66bfa6dd42535b06a283b3844a0bddcfd7f1aca1368baae035a7cda89a6b97fd
680c268c211b81fee63bd2133ddeca118e1bb9ba9f5ad107e98b3c4d230bf28c
6a084f9fa314be804daeb5314c0dcf00022a8d8a1319a990b9546860e2ca8753
6bf0418d93ba354d8bcfd041b6ee0916e99999350ca92ab6eed7849efc07b71f
6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2
6ceb2be119d08740867f19d7f3e5c2230050de29e4eb48a588b86af1a5b7db57
6f675ce5fcecaf75514fa222819eb7a8241f6b7c7b92714fe008e8dd2ad30797
73339d824e344121a3039b2e0e9c9353fb8132e005bb6d53249814c213520d5d
747a03fee397ff9cf8a76308966b2cc28f4dd00160af7610bc81ccfcb2836fab
749776f38757ca0750b01d5196331b9557fda4b4f990ff134ea32e01eb3ca128
78eac66a1d3e542e4053246d901f10492cc2e4a39ca3cc11915bf123eb202417
7e2b472509d9e149690aba45c5917ebdd2f52471b98d414c2726301b90e08f21
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83a54ca49bf0094abcede64710d7ad5b3f11ba6be51f0c4bf39c99229d5fa703
84aff23bb47fbea74e9c9944cc840a4c17dbf1c32fc9f6a5c4717417e02751c6
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
851acc60822c66c626065b3b7e8f4ff8b465e8b36d27370624adaf04f8b0751e
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb
8637b0501ace1a66eb37373c3440baf7ac214692ac755d90d901d1c1587f3f6c
87d73170be9a2e277c57d324c4e05ec0ac60ed3c0191fa29e7a31133b4c4c119
89ce08431545cd3c6d42419d99ee0152027a68c1d0c7c82838cc9a51d9d52451
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
903eb8f1cc364e01930ba03579f049a72794aa91d1a5842a2edb6365e436bb7c
91e8f81ef3c99be20d905536aa719b1fd716ce7760080c3ca6b0cd552723535d
95ed6b50d55c80e58d81b408dacf34374035d55a4aa60c382af65cb2e5414e77
960d6f50ac3a8e11b5ab68b5a561e0b330a5a9faec638023b9c8d3f1a4465711
98170098ad5b9e0e27bc80b4fab39889cb6437246979ee85680f64bb77d03a08
9b6b261d5457f85d2f3dcdf75068f904351814b5ce9e53683647190acdfa8167
9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451
9c4740903ba9c8accf0a82a96c4553065510bc6b1a486715c2cfd79b8cfd3f6c
9c8c5ae8437903bcd9d8737d4c119c14492373d06e719215ba9ef065bc5e1186
9e5fdbe89bd5441da087ec62b54d1093627a0f4f3027c162b61c8a79a4b00e45
9f4d5cca9c79886cc27246836d97c89aaf7853b2a42b09801660cb9a3df67424
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a3a444f6f0602a202e74ceaefd6f2223bb26123e65b6ea2a44833f85d3998159
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22
aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7
aae7fdb303f6427bdb7785b66824128b954e8f899c47ee1b3bbbe55b600b1110
ac1eed21fdddd6a981458cc46e79523f77a9b44b9b639d9df405c0d9827cc552
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be
b0209d39595432d762f6ba2a81dc0bffa6a6e1ed9021ba24ffa06c3c7e4bcb02
b25cbe4632e8840ea52359bb65b436e23b6e435d1153925d0261936f7651daea
b3e65f5bc65f920ed835a1329e8e585275e7c0e93de8a5c5642eab6300a11cef
b53e860d5c71786683ef080150431ccdef7f285ecc24fea1abf56f8bb41109a5
ba94eaf90519494de4ee847524ee2d3567f8518dbd66dcb0a5f610cee321976d
bd0a39feedb7e330264305916e2381653c10702bdb909ec82d1bab35f08b3b9c
c2fc358dbbf2a7c80b1f45be493848dc05b65a71a063ec4a8c620c65c0622bad
c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc
c7714be5150899442faf570cab4e7846a794e81d6b420300148d1f5a9a405c7a
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
ced9bde2b30c765bf1dafc6752d6f37cb3660281316652bff69a7798224f6c06
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
d8d326a9d025fe940aeb0589c3bed484620e8504d269fa4dc34e442673059071
d92942df06524e01550c4ceb00940a09c15bf0dae50003332280a73d3d3316e9
dd7d093a1d67babe8e574f94231253e281cf71195d34d8d7035329c655915c90
ddebf92941e44fb51a5a2c46eabc1238735a5f7ea170fe7387cd7ce5c83025d6
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e2d7133e621e56f0d57a39f36ec3fa2a93fd5e33cf167d01fe9cf56fb4d04eed
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
e6e8da7667cb5883b577c5d18614e703eacbe633b38112033220fe53c33d4009
e8c207773b5b242229f77be9cde555a9cf5ced8288409f80da3d5192706e40e3
e9508ba7940744f67cae3678cec9deeb32fa61111365ff6366fd7e28dbb4c00b
e9bc1aae5d071164156ac6685a10f027f619075588ccdfc093d8f96cd26ded26
ec95a631650981cd2ff2eecd07118042dee23fc0a3fd6ed70926fa3d94e4e5d3
ed32ae8da5321f719f046f787403ae3527b74cfbdd04ab19ed46e614fd216762
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef6f7ae704dbab0a0bdf98ae84088f1fa6601fb61021f63c1078b098beca3c8f
f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2
f40b40ca5f8e9d73bbe3d3c0097d15681646fe084ecfb05d8e02b8f851570048
f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198
f5783dc9bd9c49e0df78654420128996461fb42be3e2874bc8ec7c96f1f2e4fd
f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6
f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189
fad3898155c6342c45352367604af27c0e094701b8dcc4c4b1e05047d658bcbb

threatpost.com Open in urlscan Pro 35.173.160.135 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

253 Requests

100 %HTTPS

42 %IPv6

44 Domains

74 Subdomains

64 IPs

9 Countries

3879 kBTransfer

8774 kBSize

8 Cookies

0 Outgoing links

Redirected requests

253 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Screenshot
Live screenshot

Full Image

253
Requests

100 %
HTTPS

42 %
IPv6

44
Domains

74
Subdomains

64
IPs

9
Countries

3879 kB
Transfer

8774 kB
Size

8
Cookies

253 HTTP transactions
4 data transactions