urlscan.io logo urlscan.io
SecurityTrails logo

blog.confiant.com Open in urlscan Pro
52.1.173.203  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd...
Effective URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd...
Submission: On December 19 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 13 IPs in 3 countries across 9 domains to perform 91 HTTP transactions. The main IP is 52.1.173.203, located in Ashburn, United States and belongs to AMAZON-AES - Amazon.com, Inc., US. The main domain is blog.confiant.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on August 29th 2019. Valid for: a year.
This is the only time blog.confiant.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 6 52.1.173.203 14618 (AMAZON-AES)
1 1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
16 2606:4700::68... 13335 (CLOUDFLAR...)
47 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 99.84.87.217 16509 (AMAZON-02)
1 99.84.92.78 16509 (AMAZON-02)
2 34.231.83.215 14618 (AMAZON-AES)
1 2600:9000:20c... 16509 (AMAZON-02)
3 2600:9000:20e... 16509 (AMAZON-02)
2 3.225.17.244 14618 (AMAZON-AES)
10 54.164.26.255 14618 (AMAZON-AES)
91 13
6    52.1.173.203 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-1-173-203.compute-1.amazonaws.com
blog.confiant.com
1    2606:4700::6810:7a7f (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
medium.com
1    2a02:26f0:6c00:18b::13b8 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
cdn.optimizely.com
16    2606:4700::6810:7791 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
glyph.medium.com
cdn-client.medium.com
47    2606:4700::6810:7891 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
miro.medium.com
2    2a00:1450:4001:814::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
1    99.84.87.217 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-99-84-87-217.muc50.r.cloudfront.net
d1z2jf7jlzjs58.cloudfront.net
1    99.84.92.78 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-99-84-92-78.muc50.r.cloudfront.net
cdn.branch.io
2    34.231.83.215 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-231-83-215.compute-1.amazonaws.com
srv-2019-12-19-20.pixel.parsely.com
1    2600:9000:20c3:ae00:19:9934:6a80:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
app.link
3    2600:9000:20eb:ec00:11:f728:3040:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
api2.branch.io
2    3.225.17.244 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-3-225-17-244.compute-1.amazonaws.com
errors.client.optimizely.com
10    54.164.26.255 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-164-26-255.compute-1.amazonaws.com
collector-medium.lightstep.com
Domain Requested by
47 miro.medium.com blog.confiant.com
10 collector-medium.lightstep.com cdn-client.medium.com
10 cdn-client.medium.com blog.confiant.com
cdn-client.medium.com
6 glyph.medium.com blog.confiant.com
6 blog.confiant.com 1 redirects cdn-client.medium.com
3 api2.branch.io cdn-client.medium.com
2 errors.client.optimizely.com cdn-client.medium.com
2 srv-2019-12-19-20.pixel.parsely.com d1z2jf7jlzjs58.cloudfront.net
2 www.google-analytics.com blog.confiant.com
1 app.link cdn.branch.io
1 cdn.branch.io blog.confiant.com
1 d1z2jf7jlzjs58.cloudfront.net cdn-client.medium.com
1 cdn.optimizely.com blog.confiant.com
1 medium.com 1 redirects
91 14

This site contains links to these domains. Also see Links.

Domain
medium.com
s.ad-pixel.com
www.virustotal.com
twitter.com
help.medium.com
Subject Issuer Validity Valid
blog.confiant.com
Sectigo RSA Domain Validation Secure Server CA		 2019-08-29 -
2020-08-28		 a year crt.sh
cdn.optimizely.com
DigiCert ECC Secure Server CA		 2018-11-24 -
2020-02-23		 a year crt.sh
*.medium.com
DigiCert SHA2 Secure Server CA		 2018-07-31 -
2020-09-09		 2 years crt.sh
*.google-analytics.com
GTS CA 1O1		 2019-12-03 -
2020-02-25		 3 months crt.sh
*.cloudfront.net
DigiCert Global CA G2		 2019-07-17 -
2020-07-05		 a year crt.sh
*.branch.io
DigiCert SHA2 Secure Server CA		 2018-12-05 -
2020-12-08		 2 years crt.sh
*.pixel.parsely.com
Let's Encrypt Authority X3		 2019-12-02 -
2020-03-01		 3 months crt.sh
appipv4.link
Amazon		 2019-08-19 -
2020-09-19		 a year crt.sh
errors.client.optimizely.com
DigiCert SHA2 High Assurance Server CA		 2018-09-24 -
2020-09-28		 2 years crt.sh
*.lightstep.com
Let's Encrypt Authority X3		 2019-09-24 -
2019-12-23		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Frame ID: 275F5BD35C46310957B6ABFD67700B1D
Requests: 95 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shla... HTTP 302
    https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fblog.confiant.com%2Fconfiant-mal... HTTP 302
    https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shla... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

91
Requests

100 %
HTTPS

54 %
IPv6

9
Domains

14
Subdomains

13
IPs

3
Countries

1081 kB
Transfer

2836 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202 HTTP 302
    https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fblog.confiant.com%2Fconfiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202 HTTP 302
    https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

91 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
blog.confiant.com/
Redirect Chain
  • https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
  • https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fblog.confiant.com%2Fconfiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
  • https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
185 KB
38 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.1.173.203 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-1-173-203.compute-1.amazonaws.com
Software
nginx /
Resource Hash
1681185ea098e66b04f4949e27dbc364654fd466b263a774bda99062d4363919
Security Headers
Name Value
X-Frame-Options allow-from medium.com

Request headers

:method
GET
:authority
blog.confiant.com
:scheme
https
:path
/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
sec-fetch-mode
navigate
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User
?1

Response headers

status
200
server
nginx
date
Thu, 19 Dec 2019 20:29:52 GMT
content-type
text/html; charset=utf-8
set-cookie
optimizelyEndUserId=lo_MnoFTRYM9QgB; path=/; expires=Fri, 18 Dec 2020 20:29:52 GMT; secure uid=lo_MnoFTRYM9QgB; path=/; expires=Fri, 18 Dec 2020 20:29:52 GMT; secure; httponly sid=1:wKF3MD+GBoMdcNTGLI0By2dncLR5Abltu3bPctMbA41SkMkKEHR4EZj7IidEDzgA; path=/; expires=Fri, 18 Dec 2020 20:29:52 GMT; secure; httponly
sepia-upstream
production
x-frame-options
allow-from medium.com
cache-control
no-cache, no-store, max-age=0, must-revalidate
medium-fulfilled-by
lite/master-20191219-181913-44bd600411, rito/master-20191219-181814-e6a5307b5f, tutu/medium-39600
etag
W/"2e52b-b93VtWb4Bl7y4GTL0MwLeevF9Is"
vary
Accept-Encoding
content-encoding
gzip
x-envoy-upstream-service-time
424

Redirect headers

status
302
date
Thu, 19 Dec 2019 20:29:51 GMT
content-type
application/octet-stream
set-cookie
__cfduid=dd327ef232c0c3751c90b7922b88d8d781576787391; expires=Sat, 18-Jan-20 20:29:51 GMT; path=/; domain=.medium.com; HttpOnly; SameSite=Lax uid=lo_MnoFTRYM9QgB; Expires=Fri, 18-Dec-20 20:29:51 GMT; Domain=.medium.com; Path=/; Secure; HttpOnly optimizelyEndUserId=lo_MnoFTRYM9QgB; path=/; expires=Fri, 18 Dec 2020 20:29:51 GMT; domain=.medium.com; secure sid=1:/Aelh0igxVub6nc3CpKRH7LeTQ5rqzKRAK5ux2bfJix5AAm8XExXc3APn3mx+NC7; path=/; expires=Fri, 18 Dec 2020 20:29:51 GMT; domain=.medium.com; secure; httponly __cfruid=40ee3c95e2433d6e32f7c28e430025095e6fa92b-1576787391; path=/; domain=.medium.com; HttpOnly
content-security-policy
default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://medium.com https://*.medium.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
x-frame-options
sameorigin
x-content-type-options
nosniff
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge, Chrome=1
x-powered-by
Medium
x-obvious-tid
1576787391831:eb4127dc4cf8
x-obvious-info
39600-122947b,122947b47c3
link
<https://medium.com/humans.txt>; rel="humans"
cache-control
no-cache, no-store, max-age=0, must-revalidate
expires
Thu, 09 Sep 1999 09:09:09 GMT
pragma
no-cache
location
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
strict-transport-security
max-age=15552000; includeSubDomains; preload
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server
cloudflare
cf-ray
547c218e690d599a-VIE
16180790160.js
cdn.optimizely.com/js/ 		281 KB
86 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.optimizely.com/js/16180790160.js
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:18b::13b8 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a9bdc180d39df282f6121741037d2836920520ead3db9dc077a6b65d1c064845
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-meta-pci_enabled
False
x-amz-version-id
m72kTTAtTuOmE6k4zu_3n75lI0U0GbKP
content-encoding
gzip
x-amz-request-id
25DEDA45C007CB28
status
200
access-control-max-age
86400
date
Thu, 19 Dec 2019 20:29:52 GMT
x-amz-replication-status
COMPLETED
server-timing
cdn;desc="AkamaiION";dur=0,rtt;desc="4";dur=0,cdnip;desc="2a02:26f0:6c00:18b::13b8";dur=0,cdnmap;desc="";dur=0,proto;desc="h2";dur=0
strict-transport-security
max-age=15768000
content-length
87431
x-amz-id-2
VWoALtShzzbeWRJnwG/QEMJnlnROOJTyt68WRElelFN65quZt2YFjND2MUX6SgxArbuxmZ2BTXA=
last-modified
Thu, 19 Dec 2019 02:30:13 GMT
server
AmazonS3
etag
"a786dc31fb0ae39803ba042df60615d2"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
x-amz-meta-revision
cache-control
max-age=120
x-amz-meta-revision
700
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
*
m2.css
glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/ 		44 KB
29 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
087a4c7aa118304c5ce85d5917d95a49b3c93204ef3500752dfde52595e4eac6
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
837
status
200
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
86400
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
text/css
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=14400
access-control-allow-credentials
true
cf-ray
547c2193ad1759e2-VIE
access-control-allow-headers
Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires
Fri, 20 Dec 2019 00:29:52 GMT
1*lwwdz5iU5bY2ZzaF5qP-Hw.png
miro.medium.com/max/174/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/174/1*lwwdz5iU5bY2ZzaF5qP-Hw.png
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
7b291bac4cab78306a75e1a45638905656722c05eea8ddf56f41048bbd7588a9
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
7844
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c2193b970cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
analytics.js
www.google-analytics.com/ 		43 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 19 Aug 2019 17:22:41 GMT
server
Golfe2
age
6975
date
Thu, 19 Dec 2019 18:33:37 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
17803
expires
Thu, 19 Dec 2019 20:33:37 GMT
truncated
/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
99c5448d6c84fc71d6805e2485727db250113edcaea123a064f8c26ce95947d8

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin
https://blog.confiant.com

Response headers

Content-Type
font/opentype
collect
www.google-analytics.com/r/ 		35 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j79&a=2118661932&t=pageview&_s=1&dl=https%3A%2F%2Fblog.confiant.com%2Fconfiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202%3Fgi%3D67d7f3cd0cad&ul=en-us&de=UTF-8&dt=Confiant%20%26%20Malwarebytes%20Uncover%20Steganography%20Based%20Ad%20Payload%20That%20Drops%20Shlayer%20Trojan%20On%20Mac%20Users&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=138683946&gjid=520545746&cid=19374684.1576787393&tid=UA-24232453-2&_gid=1763042181.1576787393&_r=1&z=511591583
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
1*6g6sWeOzruzLd-7jotXC9A.png
miro.medium.com/fit/c/96/96/ 		17 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/fit/c/96/96/1*6g6sWeOzruzLd-7jotXC9A.png
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
d0802dae7dcd24caf6e0b7476de116171c46c668553fd8306dad94d14c9de092
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
17899
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941a9dcbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*DimzYIT6p9LkmCFDLkF5og.png
miro.medium.com/max/60/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/60/1*DimzYIT6p9LkmCFDLkF5og.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
39218eb69121074a8f03387564b81dfd3da1a38149bcf53ea1a28994ae672d82
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
1771
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941aa5cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*gP7rtgm8QWyiUo8EH17FiQ.png
miro.medium.com/max/20/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/20/1*gP7rtgm8QWyiUo8EH17FiQ.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
945a78076e0be30d5e019d05d9d67551241e37359ab8610bc979dd8b415b7c40
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3217-8161a0a
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
2358
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941ab5cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*Dl66dQtk32zFj7aRs_GYkA.png
miro.medium.com/max/60/ 		1021 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/60/1*Dl66dQtk32zFj7aRs_GYkA.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
fd152c5b634c1c8625334417c3b88c7d477badf8fba098ad4fb2bb9a4f732a3f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
1021
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941ab9cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*PhQSFsDbA0RUDIEr8aQd1Q.png
miro.medium.com/max/60/ 		546 B
615 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/60/1*PhQSFsDbA0RUDIEr8aQd1Q.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
4c782e275ef9df214917616e5a8e0df47a02ad38b7f83784b28d9ed3e5a5ef5e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
546
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941abccbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*bG9--Ph8E_VYKL-r7pkY_Q.png
miro.medium.com/max/60/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/60/1*bG9--Ph8E_VYKL-r7pkY_Q.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
32c7abf353761b934b27b73252f377f6dd0a86fd42e4f302c6699f53a73082f8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
1142
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941abecbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*n4BD9czicUuF4HFnmPCKTg.png
miro.medium.com/max/60/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/60/1*n4BD9czicUuF4HFnmPCKTg.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
adfdec939b9d026bda403612d5e550267d36600f7a4bfe41983e2fe76c3515fc
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3217-8161a0a
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
1075
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941abfcbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*i35j9Y1brBOKXYAodMnadA.png
miro.medium.com/max/60/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/60/1*i35j9Y1brBOKXYAodMnadA.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
b2d2fca9f2cde26b3647695ec100310c974f36ea57219a3faadac8b0424cadb7
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3203-7aaf868
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
1208
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941ac2cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*SLDOgLQ7aMeoXCX5W-la9w.png
miro.medium.com/max/60/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/60/1*SLDOgLQ7aMeoXCX5W-la9w.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
4836133ca03b8a2808e36cb7928c00e437f1e1e32743bd21bb542b880ff8e664
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
4289
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941ac5cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*kXdFy8KnilomuXeAOzuKsA.png
miro.medium.com/max/60/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/60/1*kXdFy8KnilomuXeAOzuKsA.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
b8d6022fa7d7d3a7f3eb4846b5932cb1ee07bfc34c7b88f7afe0a85fc91ecd0d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
6264
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941ac8cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*GmJPVaKouDTfp9LkSLpc3g.png
miro.medium.com/max/16/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/16/1*GmJPVaKouDTfp9LkSLpc3g.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
e24a17b0cd3934971df6fd58467f1569037922c97182be753a132163887206fd
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
1387
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941ac9cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*9WYiPh_UmjvGxAxuONSoSw.png
miro.medium.com/max/60/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/60/1*9WYiPh_UmjvGxAxuONSoSw.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
d7e8d3d612acb1528743542cff0ba8410fbb272c20b8b1dfdecba4e060aafcb4
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
1748
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941acbcbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*MM-qW9p2Fw__W5H-dgs81Q.png
miro.medium.com/max/60/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/60/1*MM-qW9p2Fw__W5H-dgs81Q.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
4df16bc072fc10f555c53c887bfcf2432d37079faccce62ece2b7e6b6aebbff0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
1425
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941acdcbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*11YX4ABQuE2JbB6eLFQk7A.png
miro.medium.com/max/48/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/48/1*11YX4ABQuE2JbB6eLFQk7A.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
559d2d258b67b63c199765fedd6b8913e9244068a97622207e54974a522751ee
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3203-7aaf868
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
6102
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941acfcbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*UMRivsxI4oLQe-bupG85sA.png
miro.medium.com/max/52/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/52/1*UMRivsxI4oLQe-bupG85sA.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
a69cfd58e6996017a03f0b463e7b81301c8f97ea13408cbd3d9b200935b75b11
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
5542
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941ad1cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*qKCJR5QY1fJa5_DssYMENA.png
miro.medium.com/max/60/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/60/1*qKCJR5QY1fJa5_DssYMENA.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
eb2a2642012ee83c5fe83f0ce3bac6f76c33921dfa548caf16a5b7957ffad85b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
3702
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941ad3cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*DNZPR8c8P4f0eLkNx1Nctg.png
miro.medium.com/max/60/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/60/1*DNZPR8c8P4f0eLkNx1Nctg.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
a8892ba8098136f3d521a845be7f8a67c9dbaf63d9c829509f7ff4e6e839e54f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
3152
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941ad4cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*QaNwxoa0CijIvugF4f9JAg.png
miro.medium.com/max/60/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/60/1*QaNwxoa0CijIvugF4f9JAg.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
0abf9630cf1befba4ad08bd375233e593493d62bd23656312a6ad26848e8a6be
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
1908
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941ad8cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*ZzOZ1ZVhb9EQArJgDFFL-Q.png
miro.medium.com/max/60/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/60/1*ZzOZ1ZVhb9EQArJgDFFL-Q.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
38a6e4fabb6b7e83461ce3e4b59835107222578f4f5660f9b5043f216530dc75
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3217-8161a0a
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
3531
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941ad9cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*WUiwHhWqXMzObrMMBKRObg.png
miro.medium.com/max/60/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/60/1*WUiwHhWqXMzObrMMBKRObg.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
f62f6f59d4ed7de06bca8d2dd62e2f5d5cbde207cdb830734a6e54a0b3765176
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
1731
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941adacbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*6g6sWeOzruzLd-7jotXC9A.png
miro.medium.com/fit/c/160/160/ 		40 KB
40 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/fit/c/160/160/1*6g6sWeOzruzLd-7jotXC9A.png
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
c2095b78ac8bde0c5108f90dfb38de9132f193bbf29ae55eff39e07a5514c31c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3203-7aaf868
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
41314
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941addcbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
1*Gzx_yxzR1l1GX0h8J75gfQ.png
miro.medium.com/fit/c/160/160/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/fit/c/160/160/1*Gzx_yxzR1l1GX0h8J75gfQ.png
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
f25e38427a40e8d86aee0f6077a7dc2e8d2178a3e93d18b9e11abe025f2809cd
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3196-7da812a
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
8946
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c21941adecbb8-VIE
expires
Sat, 18 Jan 2020 20:29:52 GMT
manifest.0b999d52.js
cdn-client.medium.com/lite/static/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/manifest.0b999d52.js
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bcacc03291e15ea96d4e21a04819ec07724402f6af7060631a333c5e20ccb158
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
6469
cf-ray
547c21944d8a59e2-VIE
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id
B0B151A6D24A785A
x-amz-id-2
pQu4+vKroFBiBaZC7oSsHzUdJh2215t8rj2Vx95BhjLE8u7uq/vmakRWvRWEyRrYvdt2R5DUTBc=
last-modified
Thu, 19 Dec 2019 18:27:27 GMT
server
cloudflare
etag
W/"a761b05c0dadf2305dc9e17065366b93"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
zPs_jkvojv.Ei5zNb1snVPBi5wiJrG0L
vary
Accept-Encoding
cache-control
public, max-age=31536000
content-type
application/javascript
expires
Fri, 18 Dec 2020 20:29:52 GMT
vendors~main.51281d83.chunk.js
cdn-client.medium.com/lite/static/js/ 		757 KB
198 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c4ee0fb2923c088dffbcd2ecc5036d08089b254f7a1bdbd271533e1b10db402e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
866730
cf-ray
547c21944d8259e2-VIE
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id
6029A51B5F13471D
x-amz-id-2
pOijyW2pPGftFaTGMAhvLUSdYq/B8oUehLOXXal3F0laroG812KNOab1IxnWtxWcKTuvdzqjvDo=
last-modified
Mon, 09 Dec 2019 19:27:37 GMT
server
cloudflare
etag
W/"46d827589f1a5521a8d6ca2c32fff9ca"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
H9mhz4fNJiDvzVkjtyU_vG4VtGYkmtnA
vary
Accept-Encoding
cache-control
public, max-age=31536000
content-type
application/javascript
expires
Fri, 18 Dec 2020 20:29:52 GMT
main.06a3617a.chunk.js
cdn-client.medium.com/lite/static/js/ 		433 KB
99 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/main.06a3617a.chunk.js
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
57ed51afe6de1bc8862a42f65f0c9242c7dd33137ecae8e5f73b27c9c15d7f5a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
6469
cf-ray
547c21944d8659e2-VIE
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id
26F6C811D816782B
x-amz-id-2
dlH42g0/QV1vBoCr/N7vMrlp3wvAuhzTydSFnpNEyWB9ha6Sy7PHmjz/nxBNG1qlE28qIE37lbU=
last-modified
Thu, 19 Dec 2019 18:27:26 GMT
server
cloudflare
etag
W/"f2f22258b8a6215ac6f485a85511ec8f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
GCKfaQCgQDC7UY1LDrmoNNJ5DS12lZ0V
vary
Accept-Encoding
cache-control
public, max-age=31536000
content-type
application/javascript
expires
Fri, 18 Dec 2020 20:29:52 GMT
vendors~screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~scre~3e410f11.d2f0cb5c.chunk.js
cdn-client.medium.com/lite/static/js/ 		38 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/vendors~screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~scre~3e410f11.d2f0cb5c.chunk.js
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ec658154249e4a8085e4db08af846b60a435a18504352bb8f002d889e70ece2b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
1203437
cf-ray
547c21944d8159e2-VIE
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id
29F3D495C30F835E
x-amz-id-2
MvWcRT51ZvS5o6QdG0DhPHf3r/WRxyq7WGy+W7T/kThgEmeUqKQ66Yf1JrrPffgWAPWRpwtf324=
last-modified
Thu, 05 Dec 2019 21:58:46 GMT
server
cloudflare
etag
W/"8b9fec58d0bdfd692d5c65e3b37f33bf"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
sJq85UZn_PUcguJu9c1aJgvrnhAD7C9I
vary
Accept-Encoding
cache-control
public, max-age=31536000
content-type
application/javascript
expires
Fri, 18 Dec 2020 20:29:52 GMT
screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~4767c889.aad2443a.chunk.js
cdn-client.medium.com/lite/static/js/ 		20 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~4767c889.aad2443a.chunk.js
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5e9acbc5206d9386f001afda29b2065e55c4a2dd5f1fbe1cad56d24b558a64e3
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
6469
cf-ray
547c21944d8759e2-VIE
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id
DD714BCFB8042233
x-amz-id-2
fofGzPlQTF3H9zi7Ayq8G0yr4Q97cZ1voeSn8TCokROShPb7csM9bUMOj5gHOnHBZycf7JZd21M=
last-modified
Thu, 19 Dec 2019 18:27:30 GMT
server
cloudflare
etag
W/"6b4f624947864939fd2a296a7ad1b0fb"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
CHvu31pUXxeOrS0k6Y99rRQeCvMon6V9
vary
Accept-Encoding
cache-control
public, max-age=31536000
content-type
application/javascript
expires
Fri, 18 Dec 2020 20:29:52 GMT
screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~73c4bb05.fe059094.chunk.js
cdn-client.medium.com/lite/static/js/ 		118 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~73c4bb05.fe059094.chunk.js
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
83ee3c23e78be226d825acf73ec6ca79f4a65d9c7925122e9ccbd87e04d6330b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
6469
cf-ray
547c21944d8459e2-VIE
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id
18FFBCE45A5A4193
x-amz-id-2
1iZii56AVfK/eFO+VUWsgw+RQXw6AMsclsLf74RvWTuz9yiqxmibue0Il+L0DUwamQYIDQxJ6r0=
last-modified
Thu, 19 Dec 2019 18:27:30 GMT
server
cloudflare
etag
W/"8aec6b19d2a13457ef70e25ecffe4946"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
s1Qn2MCqh8X4sm__Yc8ujBZEOM7L.hm5
vary
Accept-Encoding
cache-control
public, max-age=31536000
content-type
application/javascript
expires
Fri, 18 Dec 2020 20:29:52 GMT
screen.post~screen.post.amp~screen.profile~screen.sequence.library~screen.sequence.post~screen.stori~aba94ffa.20e69cee.chunk.js
cdn-client.medium.com/lite/static/js/ 		51 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/screen.post~screen.post.amp~screen.profile~screen.sequence.library~screen.sequence.post~screen.stori~aba94ffa.20e69cee.chunk.js
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d532f3e29539a73b4c3fdd03c5f5b2ac493b4277a5fd38cc732acb4ff3fbde8e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
6469
cf-ray
547c21946dab59e2-VIE
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id
13C7D53C39D2CC09
x-amz-id-2
7Y/jXQwxynUAQ5OnZHYBzwihSGdkvOA4g8ixs7SH7plrm8ERN3kuxYwtwTj5UE32lElmaqijSAE=
last-modified
Thu, 19 Dec 2019 18:27:35 GMT
server
cloudflare
etag
W/"fefefc787ab8b71905077731454cf70c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
pwkqmJwGy_G9z94broXU7BiUkz2qNFR2
vary
Accept-Encoding
cache-control
public, max-age=31536000
content-type
application/javascript
expires
Fri, 18 Dec 2020 20:29:52 GMT
screen.post.302854e7.chunk.js
cdn-client.medium.com/lite/static/js/ 		259 KB
61 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/screen.post.302854e7.chunk.js
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f52e8e6e758abc5b140084ab9fbe9d5496dc72c3acb2fdaa31b445a17303004
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
6431
cf-ray
547c21947db759e2-VIE
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id
CC28D5F58A7E0B65
x-amz-id-2
HpFTQgFmX9veZGfTcL4FqRurupXsMWAxSsqHqoxv03rMBaWXuwAuLu2fQ1RyfsA4NwEJnNZ0rUg=
last-modified
Thu, 19 Dec 2019 18:27:32 GMT
server
cloudflare
etag
W/"e57f0e9f2df03ae62876e4297a3423b1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
Le.q8KfslzNldeDfan_S6f.EHb8RowTp
vary
Accept-Encoding
cache-control
public, max-age=31536000
content-type
application/javascript
expires
Fri, 18 Dec 2020 20:29:52 GMT
truncated
/ 		156 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4c0cc04185396c9a83cfda3644c23327d7d8ff9247157c438575b83713894173

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		10 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1ed6a034a5055a869c7c25765ee1f2844a27a54e83e8a857d77b3f1cd83dd3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin
https://blog.confiant.com

Response headers

Content-Type
font/opentype
fell-400-normal.woff
glyph.medium.com/font/78ce731/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://glyph.medium.com/font/78ce731/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/fell-400-normal.woff
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f57137897a4e676f0d2199b79def1a95b253a1a938dff9d8ba10519f3beb2b08
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin
https://blog.confiant.com

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
status
200
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
86400
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
application/font-woff
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
access-control-allow-credentials
true
cf-ray
547c21946bdccbb8-VIE
access-control-allow-headers
Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires
Fri, 18 Dec 2020 20:29:52 GMT
marat-sans-300-italic.woff
glyph.medium.com/font/24e0824/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 		10 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://glyph.medium.com/font/24e0824/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/marat-sans-300-italic.woff
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
84a548a3f01f6d92045be9ae44e89520ed11505928139d831749385a36aee74c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin
https://blog.confiant.com

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
726318
status
200
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
86400
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
application/font-woff
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
access-control-allow-credentials
true
cf-ray
547c21946bdecbb8-VIE
access-control-allow-headers
Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires
Fri, 18 Dec 2020 20:29:52 GMT
truncated
/ 		10 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a3d669b687929b3aa777fdd2c400c2b8c6b794978536a64d7e1f71edcf8037e8

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Origin
https://blog.confiant.com

Response headers

Content-Type
font/opentype
charter-400-italic.woff
glyph.medium.com/font/81d2bf1/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 		10 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://glyph.medium.com/font/81d2bf1/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/charter-400-italic.woff
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f0b9a9e4ea994c106a4fc595828ca1332b2cd0435d5d159d26d1773344d97367
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin
https://blog.confiant.com

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
status
200
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
86400
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
application/font-woff
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
access-control-allow-credentials
true
cf-ray
547c21946bdfcbb8-VIE
access-control-allow-headers
Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires
Fri, 18 Dec 2020 20:29:52 GMT
marat-sans-400-normal.woff
glyph.medium.com/font/d8659c9/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://glyph.medium.com/font/d8659c9/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/marat-sans-400-normal.woff
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
12fe85ec038af8c41ba830412520589dbd125d417913c10a57838ac92ab96192
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin
https://blog.confiant.com

Response headers

date
Thu, 19 Dec 2019 20:29:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
status
200
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
86400
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
application/font-woff
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
access-control-allow-credentials
true
cf-ray
547c21946be2cbb8-VIE
access-control-allow-headers
Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires
Fri, 18 Dec 2020 20:29:52 GMT
charter-400-italic.woff
glyph.medium.com/font/81d2bf1/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://glyph.medium.com/font/81d2bf1/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/charter-400-italic.woff
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
59153ae1634105ecee1e6fb6acca980991d194fc49b651e2576aac4e5817223b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin
https://blog.confiant.com

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
status
200
strict-transport-security
max-age=15552000; includeSubDomains; preload
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
86400
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
application/font-woff
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
access-control-allow-credentials
true
cf-ray
547c21946be0cbb8-VIE
access-control-allow-headers
Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires
Fri, 18 Dec 2020 20:29:53 GMT
client-ready
blog.confiant.com/_/lite/performance/ 		2 B
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://blog.confiant.com/_/lite/performance/client-ready
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.06a3617a.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.1.173.203 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-1-173-203.compute-1.amazonaws.com
Software
nginx /
Resource Hash
Security Headers
Name Value
X-Frame-Options allow-from medium.com

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Origin
https://blog.confiant.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
sepia-upstream
production
server
nginx
x-frame-options
allow-from medium.com
etag
W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
vary
Accept-Encoding
content-type
text/plain; charset=utf-8
status
200
cache-control
no-cache, no-store, max-age=0, must-revalidate
x-envoy-upstream-service-time
1
medium-fulfilled-by
lite/master-20191219-181913-44bd600411
content-length
2
vendors~tracing.0154598a.chunk.js
cdn-client.medium.com/lite/static/js/ 		62 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/vendors~tracing.0154598a.chunk.js
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.0b999d52.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
037593f8fd10db1df005e17412f8d42274315767d03f74230a52f1871f03b7c4
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
157936
cf-ray
547c21968fd759e2-VIE
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id
4259B6AA64B64BD8
x-amz-id-2
KfkLj7XKGw/gm88B42YisAUjxDNXTnArE0yo5hod8Ngh2EdjrhU/TbgmPu+NMg1Xj/rnIJO4+CI=
last-modified
Wed, 04 Dec 2019 00:24:14 GMT
server
cloudflare
etag
W/"afcbddc62374f70c228505b2f1591bc7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
IMxz6jNiD0LVohM5OAWO2A9nZPB2dGMP
vary
Accept-Encoding
cache-control
public, max-age=31536000
content-type
application/javascript
expires
Fri, 18 Dec 2020 20:29:53 GMT
tracing.075b133f.chunk.js
cdn-client.medium.com/lite/static/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn-client.medium.com/lite/static/js/tracing.075b133f.chunk.js
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.0b999d52.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7791 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
57416757e1bde9b95d0c6afb6f7c4a3353119a5793d69076b74df7d0dfee8127
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
1203437
cf-ray
547c21968fd859e2-VIE
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id
0BE0408195AFACA0
x-amz-id-2
c7gRio+3FPFCOrLOry2KRKS4PSucVqz1CZ8l8J2nnM5GpPcquqjiawaQwgc/jQ7LhdpAGjtX0H0=
last-modified
Thu, 05 Dec 2019 21:58:45 GMT
server
cloudflare
etag
W/"aaaeeaf00e1dcd42155129dcb4d66d23"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-version-id
4G.1P9JcOjuvfCbapU..TfY1z_AG_4qx
vary
Accept-Encoding
cache-control
public, max-age=31536000
content-type
application/javascript
expires
Fri, 18 Dec 2020 20:29:53 GMT
graphql
blog.confiant.com/_/ 		94 B
360 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://blog.confiant.com/_/graphql
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.1.173.203 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-1-173-203.compute-1.amazonaws.com
Software
nginx /
Resource Hash
aa69dc4477c79193dd777df054d4d0fbd856d6f27eaafd67eabefabbc18e224a

Request headers

apollographql-client-name
lite
Medium-Frontend-Route
post
Origin
https://blog.confiant.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Graphql-Operation
InteractivePostBodyQuery
content-type
application/json
accept
*/*
Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Medium-Frontend-App
lite/master-20191219-181913-44bd600411
apollographql-client-version
master-20191219-181913-44bd600411

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
sepia-upstream
production
server
nginx
etag
W/"5e-X+OHarZfrDSYtnYSjHI4lOhegfg"
status
200
content-type
application/json; charset=utf-8
access-control-allow-origin
*
medium-fulfilled-by
rito/master-20191219-181814-e6a5307b5f, tutu/medium-39600
x-envoy-upstream-service-time
127
content-length
94
x-request-received-at
1576787393311
p.js
d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/ 		41 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/p.js
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.06a3617a.chunk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.84.87.217 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-99-84-87-217.muc50.r.cloudfront.net
Software
nginx /
Resource Hash
58711bafae315df048e1bc0c36ae1dfd017810b34fd9b4b021f774694397baad

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 17 Dec 2019 18:19:07 GMT
Content-Encoding
gzip
Age
7659
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Pragma
public
Last-Modified
Mon, 07 Oct 2019 18:17:48 GMT
Server
nginx
ETag
W/"5d9b814c-a469"
Content-Type
application/x-javascript
Via
1.1 e96f95ae91ddaf74bf5c3845501fcac8.cloudfront.net (CloudFront)
Cache-Control
max-age=86400, public
X-Amz-Cf-Pop
MUC50-C1
X-Amz-Cf-Id
r3Ab7xvDB9x6DLmLbL_ijvfR0MoDqAAtQyPME_2g__iKC64IcrP4JA==
Expires
Wed, 18 Dec 2019 18:19:07 GMT
1*lwwdz5iU5bY2ZzaF5qP-Hw.png
miro.medium.com/max/87/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/87/1*lwwdz5iU5bY2ZzaF5qP-Hw.png
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
d6aecc3e017162f65188ea2b29fb05b279905deee5ab8d4ce3615a32bfe2c6ea
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3197-fb89d63
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
2717
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a1b7ecbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*6g6sWeOzruzLd-7jotXC9A.png
miro.medium.com/fit/c/48/48/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/fit/c/48/48/1*6g6sWeOzruzLd-7jotXC9A.png
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
fc48993b1bbff13e6bb10c2e7d4f6a63ab4ee30c68b5683919e089dee8bc443e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3209-f49543a
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
5241
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a1b82cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*DimzYIT6p9LkmCFDLkF5og.png
miro.medium.com/max/30/ 		681 B
919 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/30/1*DimzYIT6p9LkmCFDLkF5og.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
4555c717a664a27e6149c9f4edbcc9e817d42072ab52fb3426e49235307cf2c5
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3210-6a9380d
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
681
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a1b86cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*gP7rtgm8QWyiUo8EH17FiQ.png
miro.medium.com/max/10/ 		625 B
694 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/10/1*gP7rtgm8QWyiUo8EH17FiQ.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
b77a4d428a3abbfa4b862edcb935a5a1edf866b6db2821009b991ac8ae23af64
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
625
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a1b88cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*Dl66dQtk32zFj7aRs_GYkA.png
miro.medium.com/max/30/ 		353 B
422 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/30/1*Dl66dQtk32zFj7aRs_GYkA.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
e93e55a53ea3ac35bb8ddc105fbc2939f910da69019ad2ff6f8b9018d2b2e646
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3217-8161a0a
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
353
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a1b8bcbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*PhQSFsDbA0RUDIEr8aQd1Q.png
miro.medium.com/max/30/ 		266 B
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/30/1*PhQSFsDbA0RUDIEr8aQd1Q.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
f6f236a3b2f8ef537cdd31284d033264a8d261e1fe97e87396b983a10ccb97ae
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3217-8161a0a
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
266
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a1b8dcbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*bG9--Ph8E_VYKL-r7pkY_Q.png
miro.medium.com/max/30/ 		416 B
506 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/30/1*bG9--Ph8E_VYKL-r7pkY_Q.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
b22f2b314339525d063f654db592a2ecceb1bc900cc588644c63a86d6412df67
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3217-8161a0a
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
416
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a1b8fcbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*n4BD9czicUuF4HFnmPCKTg.png
miro.medium.com/max/30/ 		483 B
552 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/30/1*n4BD9czicUuF4HFnmPCKTg.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
3c02b670cc5a97931f69f00f25d0736eb6647af1fda7b76080b8d00b60d075b8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3217-8161a0a
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
483
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a1b91cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*i35j9Y1brBOKXYAodMnadA.png
miro.medium.com/max/30/ 		515 B
584 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/30/1*i35j9Y1brBOKXYAodMnadA.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
c5b41e508b6a4e48e69e9eb4716d90e320d7c23871c2f8e20dcb5c9ee9d104cb
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3217-8161a0a
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
515
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a1b92cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*SLDOgLQ7aMeoXCX5W-la9w.png
miro.medium.com/max/30/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/30/1*SLDOgLQ7aMeoXCX5W-la9w.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
a61ce0f90844beb8d38888f316f5207d5e7b566382bdba020bb15a91bc74ef3d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
1269
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a1b93cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*kXdFy8KnilomuXeAOzuKsA.png
miro.medium.com/max/30/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/30/1*kXdFy8KnilomuXeAOzuKsA.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
43a92e2f0d753edb93512bb35312105fcd14b9c94b1d59282418d22d0922284d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
1764
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a1b95cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*GmJPVaKouDTfp9LkSLpc3g.png
miro.medium.com/max/8/ 		522 B
590 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/8/1*GmJPVaKouDTfp9LkSLpc3g.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
b049fc79fa3ea346f8769c9141a12e93378a13bacf4e88ebddf017cbc6d4015e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
522
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a2bbecbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*9WYiPh_UmjvGxAxuONSoSw.png
miro.medium.com/max/30/ 		668 B
737 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/30/1*9WYiPh_UmjvGxAxuONSoSw.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
637bdcad989e36d2bf5db1e715bb34b9708b9c37ac9138eb6acaa026e28ed379
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
668
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a2bc3cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*MM-qW9p2Fw__W5H-dgs81Q.png
miro.medium.com/max/30/ 		538 B
607 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/30/1*MM-qW9p2Fw__W5H-dgs81Q.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
e3794cfe5c6b86db8114b9805d410ad175a15ffaf6bea6c661dc1098ca4ec7c0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
538
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a2bc7cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*11YX4ABQuE2JbB6eLFQk7A.png
miro.medium.com/max/24/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/24/1*11YX4ABQuE2JbB6eLFQk7A.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
4bb75222a4e4731e04d95494b847804a3bb74ca92683408bedbcb2e616052091
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
1429
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a2bcacbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*UMRivsxI4oLQe-bupG85sA.png
miro.medium.com/max/26/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/26/1*UMRivsxI4oLQe-bupG85sA.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
ed525965a17816e2e81b8f99d7a98c459453243bf742b5c7c0febb54325c6199
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
1337
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a2bcccbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*qKCJR5QY1fJa5_DssYMENA.png
miro.medium.com/max/30/ 		943 B
1012 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/30/1*qKCJR5QY1fJa5_DssYMENA.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
70c322185fc5bedaa6a2f8f54bffd2175e10c68023318cb6169ab9cc4d1e1d91
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3209-f49543a
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
943
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a2bcecbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*DNZPR8c8P4f0eLkNx1Nctg.png
miro.medium.com/max/30/ 		975 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/30/1*DNZPR8c8P4f0eLkNx1Nctg.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
41fd9c184a669aefe1aed3346bfac629186b599eca3a5ac8adf84c737454abb2
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
975
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a2bcfcbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*QaNwxoa0CijIvugF4f9JAg.png
miro.medium.com/max/30/ 		595 B
667 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/30/1*QaNwxoa0CijIvugF4f9JAg.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
297d5bf7975304a0efc416c04f6af0632f8d7a724acfb86b01bd54cf2fcd6031
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3217-8161a0a
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
595
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a2bd1cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*ZzOZ1ZVhb9EQArJgDFFL-Q.png
miro.medium.com/max/30/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/30/1*ZzOZ1ZVhb9EQArJgDFFL-Q.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
1e88f3460c8355cd2022f0676a0fb490d59e13f8aae28debfeabf634b4819f78
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
1028
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a2bd3cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*WUiwHhWqXMzObrMMBKRObg.png
miro.medium.com/max/30/ 		787 B
856 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/30/1*WUiwHhWqXMzObrMMBKRObg.png?q=20
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
f5b8b9b71bea5f306ee2fa986707434251e3819c49a943b140e411f117630948
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
787
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a2bd6cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*6g6sWeOzruzLd-7jotXC9A.png
miro.medium.com/fit/c/80/80/ 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/fit/c/80/80/1*6g6sWeOzruzLd-7jotXC9A.png
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
5c184d9155e9fa62111bdee27d27bb0b316f24b966089342d0e49b5134166432
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3196-7da812a
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
12849
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a2bd8cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
1*Gzx_yxzR1l1GX0h8J75gfQ.png
miro.medium.com/fit/c/80/80/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/fit/c/80/80/1*Gzx_yxzR1l1GX0h8J75gfQ.png
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
7de86495b2cc2bb8cb0114b62861ee7775a0ce3aa22177bf11adf33135933fde
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3197-fb89d63
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
3769
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a2bddcbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
branch-latest.min.js
cdn.branch.io/ 		72 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.branch.io/branch-latest.min.js
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=67d7f3cd0cad
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.84.92.78 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-99-84-92-78.muc50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
200b68bbdf9c2da0d476171ed46ffab16cac6ee742582310438d511c7cd7d315

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id
u0SrVcR4IiRlieei1odV0xSiikdlv4ff
Content-Encoding
gzip
Last-Modified
Wed, 11 Dec 2019 00:16:44 GMT
Server
AmazonS3
Age
149
ETag
"941dbbc68e8388cbb67f0663975777a3"
X-Cache
Hit from cloudfront
Content-Type
text/javascript
Via
1.1 c60fec1b7e3a36f4232723195f10e64c.cloudfront.net (CloudFront)
Cache-Control
max-age=300
Date
Thu, 19 Dec 2019 20:27:24 GMT
X-Amz-Cf-Pop
MUC50-C1
Connection
keep-alive
Content-Length
21893
X-Amz-Cf-Id
UHW_zijkweKeeV_2tIq27UU9oSu5e8LBvIhx4RPapncei6Xo2Ey-iQ==
1*DimzYIT6p9LkmCFDLkF5og.png
miro.medium.com/max/1164/ 		155 KB
155 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://miro.medium.com/max/1164/1*DimzYIT6p9LkmCFDLkF5og.png
Requested by
Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7891 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Geomyidae artificij
Resource Hash
b618471e00f3bb871fc991004a50253db79e33262a32bdf365d0491a9bfbe243
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 19 Dec 2019 20:29:53 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
x-powered-by
Geomyidae artificij
x-obvious-info
16.3, 3216-39bf470
status
200
alt-svc
h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length
158813
pragma
public
server
cloudflare
etag
"16.3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
image/png
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
547c219a4c55cbb8-VIE
expires
Sat, 18 Jan 2020 20:29:53 GMT
/
srv-2019-12-19-20.pixel.parsely.com/start/ 		77 B
380 B 		Script
General
Check archive.org
Download Go to
Full URL
https://srv-2019-12-19-20.pixel.parsely.com/start/?rand=1576787393740&plid=36456534&idsite=medium.com&url=https%3A%2F%2Fblog.confiant.com%2Fconfiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%22viewerStatus%22%3A%22visitor%22%7D&sid=1&surl=https%3A%2F%2Fblog.confiant.com%2Fconfiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202&sref=&sts=1576787393731&slts=0&title=Confiant+%26+Malwarebytes+Uncover+Steganography+Based+Ad+Payload+That+Drops+Shlayer+Trojan+On+Mac+Users&date=Thu+Dec+19+2019+21%3A29%3A53+GMT%2B0100+(Central+European+Standard+Time)&action=pageview&js=1&pvid=16841050&callback=parselyStartCallback
Requested by
Host: d1z2jf7jlzjs58.cloudfront.net
URL: https://d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/p.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.231.83.215 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-231-83-215.compute-1.amazonaws.com
Software
nginx /
Resource Hash
0de9271e78d23b8fb9c37f71bf3ca774969cd422b0ec6619935885fc6cb10d49

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Dec 2019 20:29:54 GMT
Server
nginx
Connection
keep-alive
Content-Type
application/json
Content-Length
77
P3P
CP="CUR ADM OUR NOR STA NID"
_r
app.link/ 		90 B
725 B 		Script
General
Check archive.org
Download Go to
Full URL
https://app.link/_r?sdk=web2.52.3&branch_key=key_live_ofxXr2qTrrU9NqURK8ZwEhknBxiI6KBm&callback=branch_callback__0
Requested by
Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20c3:ae00:19:9934:6a80:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
openresty/1.13.6.2 / Express
Resource Hash
b2278c4dae764229ac943e92f45a8049ac701f6528803cab6a0632fbf0c5711b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Dec 2019 20:29:53 GMT
Via
1.1 fc6dca2df1221c0bec817610bc20e505.cloudfront.net (CloudFront)
X-Content-Type-Options
nosniff
Server
openresty/1.13.6.2
X-Amz-Cf-Pop
MUC50-C1
X-Powered-By
Express
X-Cache
Miss from cloudfront
Content-Type
text/javascript; charset=utf-8
Connection
keep-alive
Content-Length
90
ETag
W/"5a-of1kShj0SagDqLwW1jqz7SEEnPI"
X-Amz-Cf-Id
VPVi8jrc-OYVGFdRn1hD1YbljwSOzzd_iMKbqF8TZG3WsluG0h2VyA==
open
api2.branch.io/v1/ 		312 B
598 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api2.branch.io/v1/open
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:ec00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
openresty/1.13.6.2 /
Resource Hash
f3316553f428ab2f142cfcfdc0a3629d682958204c7c242e854d9559a43b939d

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Origin
https://blog.confiant.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Thu, 19 Dec 2019 20:29:54 GMT
via
1.1 c7f7b4cf7fd5efe64bac95586db3f62b.cloudfront.net (CloudFront)
server
openresty/1.13.6.2
x-amz-cf-pop
FRA2-C1
status
200
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
no-cache
content-length
312
x-amz-cf-id
uaozsaZWjH06rLEFs17IE0_LbbbFn0su8ePhrjpbHBn-4DIvh4TSKA==
log
errors.client.optimizely.com/ 		13 B
409 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://errors.client.optimizely.com/log
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.225.17.244 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-225-17-244.compute-1.amazonaws.com
Software
/
Resource Hash
16f1efa415bfdd7abcf8fdd76cc05ae6fa66ffdfdc730368ecea89ecfe5c3a12

Request headers

Access-Control-Request-Method
POST
Origin
https://blog.confiant.com
Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers
content-type

Response headers

Date
Thu, 19 Dec 2019 20:29:54 GMT
Allow
POST,OPTIONS
Access-Control-Allow-Methods
GET,POST,OPTIONS
Content-Type
text/plain
Access-Control-Allow-Origin
https://blog.confiant.com
Access-Control-Max-Age
1800
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
X-Requested-With,Content-Type,Accept,Origin
Content-Length
13
render
blog.confiant.com/_/lite/performance/ 		2 B
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://blog.confiant.com/_/lite/performance/render
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.06a3617a.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.1.173.203 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-1-173-203.compute-1.amazonaws.com
Software
nginx /
Resource Hash
Security Headers
Name Value
X-Frame-Options allow-from medium.com

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Origin
https://blog.confiant.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 19 Dec 2019 20:29:54 GMT
sepia-upstream
production
server
nginx
x-frame-options
allow-from medium.com
etag
W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
vary
Accept-Encoding
content-type
text/plain; charset=utf-8
status
200
cache-control
no-cache, no-store, max-age=0, must-revalidate
x-envoy-upstream-service-time
1
medium-fulfilled-by
lite/master-20191219-181913-44bd600411
content-length
2
pageview
api2.branch.io/v1/ 		28 B
361 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api2.branch.io/v1/pageview
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:ec00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
openresty/1.13.6.2 / Express
Resource Hash
a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Origin
https://blog.confiant.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Thu, 19 Dec 2019 20:29:54 GMT
via
1.1 c7f7b4cf7fd5efe64bac95586db3f62b.cloudfront.net (CloudFront)
server
openresty/1.13.6.2
x-amz-cf-pop
FRA2-C1
x-powered-by
Express
etag
W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status
200
x-cache
Miss from cloudfront
content-type
application/json; charset=utf-8
access-control-allow-origin
*
content-length
28
x-amz-cf-id
HA7pn7WvONQs_f0OimgI6QDcGnwCF-UxL0-y1vfzLvQapye9UHXfrA==
reports
collector-medium.lightstep.com/api/v0/ 		0
174 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://collector-medium.lightstep.com/api/v0/reports
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-164-26-255.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method
POST
Origin
https://blog.confiant.com
Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers
content-type,lightstep-access-token

Response headers

status
200
date
Thu, 19 Dec 2019 20:29:54 GMT
access-control-allow-credentials
true
access-control-allow-origin
*
access-control-allow-headers
LightStep-Access-Token, Content-Type
content-length
0
access-control-allow-methods
POST
pageview
api2.branch.io/v1/ 		28 B
362 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api2.branch.io/v1/pageview
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:20eb:ec00:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
openresty/1.13.6.2 / Express
Resource Hash
a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Origin
https://blog.confiant.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Thu, 19 Dec 2019 20:29:54 GMT
via
1.1 c7f7b4cf7fd5efe64bac95586db3f62b.cloudfront.net (CloudFront)
server
openresty/1.13.6.2
x-amz-cf-pop
FRA2-C1
x-powered-by
Express
etag
W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status
200
x-cache
Miss from cloudfront
content-type
application/json; charset=utf-8
access-control-allow-origin
*
content-length
28
x-amz-cf-id
UWaH-4g9RQXstxreFSvWNgLDOr1jv16XmMgfwTTknwpeWP-R78kyQQ==
log
errors.client.optimizely.com/ 		0
243 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://errors.client.optimizely.com/log
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.225.17.244 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-225-17-244.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Origin
https://blog.confiant.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/json

Response headers

Access-Control-Allow-Origin
https://blog.confiant.com
Access-Control-Expose-Headers
Access-Control-Allow-Credentials
true
Connection
keep-alive
Date
Thu, 19 Dec 2019 20:29:54 GMT
Content-Type
text/plain
reports
collector-medium.lightstep.com/api/v0/ 		113 B
311 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://collector-medium.lightstep.com/api/v0/reports
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-164-26-255.compute-1.amazonaws.com
Software
/
Resource Hash
56e08f643eb4397665c446970a1af1cf8bcaa16586e6866a2be1ba4ec3856c93

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Origin
https://blog.confiant.com
LightStep-Access-Token
ce5be895bef60919541332990ac9fef2
Content-Type
application/json

Response headers

date
Thu, 19 Dec 2019 20:29:54 GMT
status
200
access-control-allow-methods
POST
content-type
application/json
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
LightStep-Access-Token, Content-Type
content-length
113
reports
collector-medium.lightstep.com/api/v0/ 		0
174 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://collector-medium.lightstep.com/api/v0/reports
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-164-26-255.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method
POST
Origin
https://blog.confiant.com
Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers
content-type,lightstep-access-token

Response headers

status
200
date
Thu, 19 Dec 2019 20:29:55 GMT
access-control-allow-credentials
true
access-control-allow-origin
*
access-control-allow-headers
LightStep-Access-Token, Content-Type
content-length
0
access-control-allow-methods
POST
reports
collector-medium.lightstep.com/api/v0/ 		113 B
311 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://collector-medium.lightstep.com/api/v0/reports
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-164-26-255.compute-1.amazonaws.com
Software
/
Resource Hash
255b48d2ae10cff8038d5e93cf9b3b66191c0cafefe466bcd31cc06e34db4452

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Origin
https://blog.confiant.com
LightStep-Access-Token
ce5be895bef60919541332990ac9fef2
Content-Type
application/json

Response headers

date
Thu, 19 Dec 2019 20:29:55 GMT
status
200
access-control-allow-methods
POST
content-type
application/json
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
LightStep-Access-Token, Content-Type
content-length
113
reports
collector-medium.lightstep.com/api/v0/ 		0
174 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://collector-medium.lightstep.com/api/v0/reports
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-164-26-255.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method
POST
Origin
https://blog.confiant.com
Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers
content-type,lightstep-access-token

Response headers

status
200
date
Thu, 19 Dec 2019 20:29:55 GMT
access-control-allow-credentials
true
access-control-allow-origin
*
access-control-allow-headers
LightStep-Access-Token, Content-Type
content-length
0
access-control-allow-methods
POST
reports
collector-medium.lightstep.com/api/v0/ 		113 B
311 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://collector-medium.lightstep.com/api/v0/reports
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-164-26-255.compute-1.amazonaws.com
Software
/
Resource Hash
3a1f57360498481b5a61e334550c48228f31c1a4363051a806c11d1227ad3033

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Origin
https://blog.confiant.com
LightStep-Access-Token
ce5be895bef60919541332990ac9fef2
Content-Type
application/json

Response headers

date
Thu, 19 Dec 2019 20:29:55 GMT
status
200
access-control-allow-methods
POST
content-type
application/json
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
LightStep-Access-Token, Content-Type
content-length
113
reports
collector-medium.lightstep.com/api/v0/ 		0
174 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://collector-medium.lightstep.com/api/v0/reports
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-164-26-255.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method
POST
Origin
https://blog.confiant.com
Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers
content-type,lightstep-access-token

Response headers

status
200
date
Thu, 19 Dec 2019 20:29:56 GMT
access-control-allow-credentials
true
access-control-allow-origin
*
access-control-allow-headers
LightStep-Access-Token, Content-Type
content-length
0
access-control-allow-methods
POST
reports
collector-medium.lightstep.com/api/v0/ 		113 B
311 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://collector-medium.lightstep.com/api/v0/reports
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-164-26-255.compute-1.amazonaws.com
Software
/
Resource Hash
0d3688486d422fb6bae753381a44e2220fa011567fe6752b49e4fb2272ff370e

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Origin
https://blog.confiant.com
LightStep-Access-Token
ce5be895bef60919541332990ac9fef2
Content-Type
application/json

Response headers

date
Thu, 19 Dec 2019 20:29:56 GMT
status
200
access-control-allow-methods
POST
content-type
application/json
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
LightStep-Access-Token, Content-Type
content-length
113
batch
blog.confiant.com/_/ 		10 KB
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://blog.confiant.com/_/batch
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.06a3617a.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.1.173.203 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-1-173-203.compute-1.amazonaws.com
Software
nginx / Medium
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://blog.confiant.com https://*.blog.confiant.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
X-Content-Type-Options nosniff
X-Frame-Options
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Origin
https://blog.confiant.com
x-xsrf-token
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
content-type
application/json

Response headers

content-security-policy
default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://blog.confiant.com https://*.blog.confiant.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
x-content-type-options
nosniff
x-powered-by
Medium
x-obvious-info
39600-122947b,122947b47c3
status
409
content-length
10152
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge, Chrome=1
pragma
no-cache
x-obvious-tid
1576787398106:c0bb70b0e85
server
nginx
date
Thu, 19 Dec 2019 20:29:58 GMT
x-frame-options
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
link
<https://medium.com/humans.txt>; rel="humans"
expires
Thu, 09 Sep 1999 09:09:09 GMT
reports
collector-medium.lightstep.com/api/v0/ 		0
174 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://collector-medium.lightstep.com/api/v0/reports
Requested by
Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.51281d83.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-164-26-255.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method
POST
Origin
https://blog.confiant.com
Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers
content-type,lightstep-access-token

Response headers

status
200
date
Thu, 19 Dec 2019 20:29:59 GMT
access-control-allow-credentials
true
access-control-allow-origin
*
access-control-allow-headers
LightStep-Access-Token, Content-Type
content-length
0
access-control-allow-methods
POST
reports
collector-medium.lightstep.com/api/v0/ 		113 B
311 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://collector-medium.lightstep.com/api/v0/reports
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.164.26.255 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-164-26-255.compute-1.amazonaws.com
Software
/
Resource Hash
9cef72fadd8a7ee136a0ea7fd36d1c4ad9629a95199b6c348d112c139eeb5497

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Origin
https://blog.confiant.com
LightStep-Access-Token
ce5be895bef60919541332990ac9fef2
Content-Type
application/json

Response headers

date
Thu, 19 Dec 2019 20:29:59 GMT
status
200
access-control-allow-methods
POST
content-type
application/json
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
LightStep-Access-Token, Content-Type
content-length
113
/
srv-2019-12-19-20.pixel.parsely.com/event/ 		43 B
385 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://srv-2019-12-19-20.pixel.parsely.com/event/?rand=1576787404233&plid=36456534&idsite=medium.com&url=https%3A%2F%2Fblog.confiant.com%2Fconfiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%7D&sid=1&surl=https%3A%2F%2Fblog.confiant.com%2Fconfiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202&sref=&sts=1576787404233&slts=0&date=Thu+Dec+19+2019+21%3A30%3A04+GMT%2B0100+(Central+European+Standard+Time)&action=heartbeat&inc=5&tt=4900&pvid=16841050&u=pid%3D03ce5b1caf4d767930d9de8a3516b1e4
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.231.83.215 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-231-83-215.compute-1.amazonaws.com
Software
nginx /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 19 Dec 2019 20:30:04 GMT
Last-Modified
Mon, 28 Sep 1970 06:00:00 GMT
Server
nginx
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
P3P
CP="CUR ADM OUR NOR STA NID"

Verdicts & Comments Add Verdict or Comment

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| perfMetrics string| GoogleAnalyticsObject function| ga object| PARSELY object| google_tag_data object| gaplugins object| gaGlobal object| gaData undefined| _ string| __BUILD_ID__ string| __GRAPHQL_URI__ object| __PRELOADED_STATE__ object| __APOLLO_STATE__ object| webpackJsonp object| core object| __core-js_shared__ object| __SENTRY__ object| regeneratorRuntime function| main object| __APOLLO_CLIENT__ object| optimizelyDataObject object| branch function| parselyStartCallback

2 Cookies

Domain/Path Name / Value
.confiant.com/ Name: _parsely_visitor
Value: {%22id%22:%22pid=03ce5b1caf4d767930d9de8a3516b1e4%22%2C%22session_count%22:1%2C%22last_session_ts%22:1576787394166}
.confiant.com/ Name: _parsely_session
Value: {%22sid%22:1%2C%22surl%22:%22https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202%22%2C%22sref%22:%22%22%2C%22sts%22:1576787394166%2C%22slts%22:0}

2 Console Messages

Source Level URL
Text
console-api log URL: https://cdn-client.medium.com/lite/static/js/main.06a3617a.chunk.js(Line 1)
Message:
-+++++= .+++++= .+@@@@@+ #@@@@*: .@@@@@= *@@@@@ @+@@@@- =#@@@@@ @ +@@@@: :% @@@@@ @ *@@@@-%: @@@@@ @ *@@@@- @@@@@ -@- #@@+ :@@@@@: -#@@@#- ## =@@@@@@@= ....... .........
console-api log URL: https://cdn-client.medium.com/lite/static/js/main.06a3617a.chunk.js(Line 1)
Message:
We're hiring! https://medium.com/jobs-at-medium/work-at-medium-959d1a85284e

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options allow-from medium.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api2.branch.io
app.link
blog.confiant.com
cdn-client.medium.com
cdn.branch.io
cdn.optimizely.com
collector-medium.lightstep.com
d1z2jf7jlzjs58.cloudfront.net
errors.client.optimizely.com
glyph.medium.com
medium.com
miro.medium.com
srv-2019-12-19-20.pixel.parsely.com
www.google-analytics.com
2600:9000:20c3:ae00:19:9934:6a80:93a1
2600:9000:20eb:ec00:11:f728:3040:93a1
2606:4700::6810:7791
2606:4700::6810:7891
2606:4700::6810:7a7f
2a00:1450:4001:814::200e
2a02:26f0:6c00:18b::13b8
3.225.17.244
34.231.83.215
52.1.173.203
54.164.26.255
99.84.87.217
99.84.92.78
037593f8fd10db1df005e17412f8d42274315767d03f74230a52f1871f03b7c4
087a4c7aa118304c5ce85d5917d95a49b3c93204ef3500752dfde52595e4eac6
0abf9630cf1befba4ad08bd375233e593493d62bd23656312a6ad26848e8a6be
0d3688486d422fb6bae753381a44e2220fa011567fe6752b49e4fb2272ff370e
0de9271e78d23b8fb9c37f71bf3ca774969cd422b0ec6619935885fc6cb10d49
12fe85ec038af8c41ba830412520589dbd125d417913c10a57838ac92ab96192
1681185ea098e66b04f4949e27dbc364654fd466b263a774bda99062d4363919
16f1efa415bfdd7abcf8fdd76cc05ae6fa66ffdfdc730368ecea89ecfe5c3a12
1e88f3460c8355cd2022f0676a0fb490d59e13f8aae28debfeabf634b4819f78
200b68bbdf9c2da0d476171ed46ffab16cac6ee742582310438d511c7cd7d315
255b48d2ae10cff8038d5e93cf9b3b66191c0cafefe466bcd31cc06e34db4452
297d5bf7975304a0efc416c04f6af0632f8d7a724acfb86b01bd54cf2fcd6031
2f52e8e6e758abc5b140084ab9fbe9d5496dc72c3acb2fdaa31b445a17303004
32c7abf353761b934b27b73252f377f6dd0a86fd42e4f302c6699f53a73082f8
38a6e4fabb6b7e83461ce3e4b59835107222578f4f5660f9b5043f216530dc75
39218eb69121074a8f03387564b81dfd3da1a38149bcf53ea1a28994ae672d82
3a1f57360498481b5a61e334550c48228f31c1a4363051a806c11d1227ad3033
3c02b670cc5a97931f69f00f25d0736eb6647af1fda7b76080b8d00b60d075b8
41fd9c184a669aefe1aed3346bfac629186b599eca3a5ac8adf84c737454abb2
43a92e2f0d753edb93512bb35312105fcd14b9c94b1d59282418d22d0922284d
4555c717a664a27e6149c9f4edbcc9e817d42072ab52fb3426e49235307cf2c5
4836133ca03b8a2808e36cb7928c00e437f1e1e32743bd21bb542b880ff8e664
4bb75222a4e4731e04d95494b847804a3bb74ca92683408bedbcb2e616052091
4c0cc04185396c9a83cfda3644c23327d7d8ff9247157c438575b83713894173
4c782e275ef9df214917616e5a8e0df47a02ad38b7f83784b28d9ed3e5a5ef5e
4df16bc072fc10f555c53c887bfcf2432d37079faccce62ece2b7e6b6aebbff0
559d2d258b67b63c199765fedd6b8913e9244068a97622207e54974a522751ee
56e08f643eb4397665c446970a1af1cf8bcaa16586e6866a2be1ba4ec3856c93
57416757e1bde9b95d0c6afb6f7c4a3353119a5793d69076b74df7d0dfee8127
57ed51afe6de1bc8862a42f65f0c9242c7dd33137ecae8e5f73b27c9c15d7f5a
58711bafae315df048e1bc0c36ae1dfd017810b34fd9b4b021f774694397baad
59153ae1634105ecee1e6fb6acca980991d194fc49b651e2576aac4e5817223b
5c184d9155e9fa62111bdee27d27bb0b316f24b966089342d0e49b5134166432
5e9acbc5206d9386f001afda29b2065e55c4a2dd5f1fbe1cad56d24b558a64e3
637bdcad989e36d2bf5db1e715bb34b9708b9c37ac9138eb6acaa026e28ed379
70c322185fc5bedaa6a2f8f54bffd2175e10c68023318cb6169ab9cc4d1e1d91
7b291bac4cab78306a75e1a45638905656722c05eea8ddf56f41048bbd7588a9
7de86495b2cc2bb8cb0114b62861ee7775a0ce3aa22177bf11adf33135933fde
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83ee3c23e78be226d825acf73ec6ca79f4a65d9c7925122e9ccbd87e04d6330b
84a548a3f01f6d92045be9ae44e89520ed11505928139d831749385a36aee74c
945a78076e0be30d5e019d05d9d67551241e37359ab8610bc979dd8b415b7c40
99c5448d6c84fc71d6805e2485727db250113edcaea123a064f8c26ce95947d8
9cef72fadd8a7ee136a0ea7fd36d1c4ad9629a95199b6c348d112c139eeb5497
a3d669b687929b3aa777fdd2c400c2b8c6b794978536a64d7e1f71edcf8037e8
a61ce0f90844beb8d38888f316f5207d5e7b566382bdba020bb15a91bc74ef3d
a69cfd58e6996017a03f0b463e7b81301c8f97ea13408cbd3d9b200935b75b11
a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb
a8892ba8098136f3d521a845be7f8a67c9dbaf63d9c829509f7ff4e6e839e54f
a9bdc180d39df282f6121741037d2836920520ead3db9dc077a6b65d1c064845
aa69dc4477c79193dd777df054d4d0fbd856d6f27eaafd67eabefabbc18e224a
adfdec939b9d026bda403612d5e550267d36600f7a4bfe41983e2fe76c3515fc
b049fc79fa3ea346f8769c9141a12e93378a13bacf4e88ebddf017cbc6d4015e
b2278c4dae764229ac943e92f45a8049ac701f6528803cab6a0632fbf0c5711b
b22f2b314339525d063f654db592a2ecceb1bc900cc588644c63a86d6412df67
b2d2fca9f2cde26b3647695ec100310c974f36ea57219a3faadac8b0424cadb7
b618471e00f3bb871fc991004a50253db79e33262a32bdf365d0491a9bfbe243
b77a4d428a3abbfa4b862edcb935a5a1edf866b6db2821009b991ac8ae23af64
b8d6022fa7d7d3a7f3eb4846b5932cb1ee07bfc34c7b88f7afe0a85fc91ecd0d
bcacc03291e15ea96d4e21a04819ec07724402f6af7060631a333c5e20ccb158
c2095b78ac8bde0c5108f90dfb38de9132f193bbf29ae55eff39e07a5514c31c
c4ee0fb2923c088dffbcd2ecc5036d08089b254f7a1bdbd271533e1b10db402e
c5b41e508b6a4e48e69e9eb4716d90e320d7c23871c2f8e20dcb5c9ee9d104cb
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0802dae7dcd24caf6e0b7476de116171c46c668553fd8306dad94d14c9de092
d532f3e29539a73b4c3fdd03c5f5b2ac493b4277a5fd38cc732acb4ff3fbde8e
d6aecc3e017162f65188ea2b29fb05b279905deee5ab8d4ce3615a32bfe2c6ea
d7e8d3d612acb1528743542cff0ba8410fbb272c20b8b1dfdecba4e060aafcb4
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
e24a17b0cd3934971df6fd58467f1569037922c97182be753a132163887206fd
e3794cfe5c6b86db8114b9805d410ad175a15ffaf6bea6c661dc1098ca4ec7c0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e93e55a53ea3ac35bb8ddc105fbc2939f910da69019ad2ff6f8b9018d2b2e646
eb2a2642012ee83c5fe83f0ce3bac6f76c33921dfa548caf16a5b7957ffad85b
ec658154249e4a8085e4db08af846b60a435a18504352bb8f002d889e70ece2b
ed525965a17816e2e81b8f99d7a98c459453243bf742b5c7c0febb54325c6199
ef1ed6a034a5055a869c7c25765ee1f2844a27a54e83e8a857d77b3f1cd83dd3
f0b9a9e4ea994c106a4fc595828ca1332b2cd0435d5d159d26d1773344d97367
f25e38427a40e8d86aee0f6077a7dc2e8d2178a3e93d18b9e11abe025f2809cd
f3316553f428ab2f142cfcfdc0a3629d682958204c7c242e854d9559a43b939d
f57137897a4e676f0d2199b79def1a95b253a1a938dff9d8ba10519f3beb2b08
f5b8b9b71bea5f306ee2fa986707434251e3819c49a943b140e411f117630948
f62f6f59d4ed7de06bca8d2dd62e2f5d5cbde207cdb830734a6e54a0b3765176
f6f236a3b2f8ef537cdd31284d033264a8d261e1fe97e87396b983a10ccb97ae
fc48993b1bbff13e6bb10c2e7d4f6a63ab4ee30c68b5683919e089dee8bc443e
fd152c5b634c1c8625334417c3b88c7d477badf8fba098ad4fb2bb9a4f732a3f