www.intego.com Open in urlscan Pro
2606:4700::6812:d77 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Submission: On September 25 via api (September 25th 2020, 3:29:13 pm UTC) from US

Summary HTTP 140 Redirects Links 38 Behaviour Indicators

Summary

This website contacted 43 IPs in 9 countries across 34 domains to perform 140 HTTP transactions. The main IP is 2606:4700::6812:d77, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.intego.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 28th 2020. Valid for: a year.

This is the only time www.intego.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
50	2606:4700::68... 2606:4700::6812:d77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2001:4de0:ac1... 2001:4de0:ac19::1:b:1b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:802::200a	15169 (GOOGLE) (GOOGLE)
6	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
1	2a02:26f0:6c0... 2a02:26f0:6c00::210:ba20	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
3	192.0.77.2 192.0.77.2	2635 (AUTOMATTIC) (AUTOMATTIC)
5	2a00:1450:400... 2a00:1450:4001:803::200e	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:802::200e	15169 (GOOGLE) (GOOGLE)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
5	23.210.248.44 23.210.248.44	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:809::2008	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	96.126.99.139 96.126.99.139	63949 (LINODE-AP...) (LINODE-AP Linode)
2	2a00:1450:400... 2a00:1450:4001:81b::2003	15169 (GOOGLE) (GOOGLE)
2 3	2a03:2880:f02... 2a03:2880:f02d:e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	151.101.36.84 151.101.36.84	54113 (FASTLY) (FASTLY)
2	199.232.196.134 199.232.196.134	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:81e::200e	15169 (GOOGLE) (GOOGLE)
1	23.210.250.213 23.210.250.213	16625 (AKAMAI-AS) (AKAMAI-AS)
3	192.0.77.48 192.0.77.48	2635 (AUTOMATTIC) (AUTOMATTIC)
1	172.217.16.162 172.217.16.162	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:821::200e	15169 (GOOGLE) (GOOGLE)
2	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2620:116:800d... 2620:116:800d:21:8c6e:cf2c:8d6:9fb5	16509 (AMAZON-02) (AMAZON-02)
1	183.79.249.252 183.79.249.252	24572 (YAHOO-JP-...) (YAHOO-JP-AS-AP Yahoo Japan)
3	2606:4700::68... 2606:4700::6812:a913	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	151.101.64.134 151.101.64.134	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:821::200d	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:820::200e	15169 (GOOGLE) (GOOGLE)
1	2600:9000:206... 2600:9000:206e:5200:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0c::9c	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:819::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:818::2003	15169 (GOOGLE) (GOOGLE)
1	104.244.42.200 104.244.42.200	13414 (TWITTER) (TWITTER)
4	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	183.79.255.28 183.79.255.28	24572 (YAHOO-JP-...) (YAHOO-JP-AS-AP Yahoo Japan)
2	2a00:1288:f03... 2a00:1288:f03d:1fa::4000	10310 (YAHOO-1) (YAHOO-1)
1	212.82.100.181 212.82.100.181	34010 (YAHOO-IRD) (YAHOO-IRD)
140	43

50 2606:4700::6812:d77 (United States)

ASN13335 (CLOUDFLARENET, US)

www.intego.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4de0:ac19::1:b:1b (Netherlands)

ASN20446 (HIGHWINDS3, US)

netdna.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00::210:ba20 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

platform.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i2.wp.com

i2.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i1.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:803::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.youtube-nocookie.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:802::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.210.248.44 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-44.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 96.126.99.139 (Fremont, United States)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: nb-96-126-99-139.fremont.nodebalancer.linode.com

fireside.fm	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f02d:e:face:b00c:0:2 (Ireland) 2 redirects

ASN32934 (FACEBOOK, US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
web.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.36.84 (Amsterdam, Netherlands)

ASN54113 (FASTLY, US)

widgets.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 199.232.196.134 (United States)

ASN54113 (FASTLY, US)

macsecurityblog.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81e::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.210.250.213 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-250-213.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.0.77.48 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: s.w.org

s.w.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.16.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s11-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:8c6e:cf2c:8d6:9fb5 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 183.79.249.252 (Japan)

ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP)

s.yimg.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6812:a913 (United States)

ASN13335 (CLOUDFLARENET, US)

c.disquscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.64.134 (United States)

ASN54113 (FASTLY, US)

disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:820::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206e:5200:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:819::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:818::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.200 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f12d:83:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 183.79.255.28 (Japan)

ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP)

b91.yahoo.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1288:f03d:1fa::4000 (United Kingdom)

ASN10310 (YAHOO-1, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.82.100.181 (Switzerland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
50	intego.com www.intego.com	577 KB
7	facebook.com 2 redirects graph.facebook.com www.facebook.com web.facebook.com	2 KB
7	gstatic.com fonts.gstatic.com ssl.gstatic.com	27 KB
7	google.com apis.google.com accounts.google.com www.google.com	110 KB
7	twitter.com platform.twitter.com syndication.twitter.com	35 KB
5	wp.com i2.wp.com i0.wp.com i1.wp.com stats.wp.com pixel.wp.com	6 KB
4	disqus.com macsecurityblog.disqus.com disqus.com	32 KB
4	facebook.net connect.facebook.net	231 KB
4	addthis.com s7.addthis.com m.addthis.com	190 KB
4	youtube.com www.youtube.com	2 KB
4	linkedin.com platform.linkedin.com www.linkedin.com	57 KB
3	disquscdn.com c.disquscdn.com	223 KB
3	google-analytics.com www.google-analytics.com	20 KB
3	w.org s.w.org	1 KB
2	yimg.com s.yimg.com	7 KB
2	yahoo.co.jp b91.yahoo.co.jp	2 KB
2	google.de www.google.de	666 B
2	doubleclick.net googleads.g.doubleclick.net stats.g.doubleclick.net	2 KB
2	quantserve.com secure.quantserve.com pixel.quantserve.com	8 KB
2	bing.com bat.bing.com	8 KB
2	gravatar.com secure.gravatar.com	9 KB
2	bootstrapcdn.com netdna.bootstrapcdn.com	39 KB
1	yahoo.com sp.analytics.yahoo.com	857 B
1	quantcount.com rules.quantcount.com	1 KB
1	yimg.jp s.yimg.jp	3 KB
1	googleadservices.com www.googleadservices.com	12 KB
1	addthisedge.com v1.addthisedge.com	520 B
1	moatads.com z.moatads.com	1 KB
1	ytimg.com s.ytimg.com	34 KB
1	pinterest.com widgets.pinterest.com	364 B
1	youtube-nocookie.com www.youtube-nocookie.com
1	fireside.fm fireside.fm
1	googletagmanager.com www.googletagmanager.com	42 KB
1	googleapis.com fonts.googleapis.com	1 KB
140	34

	Domain	Requested by
50	www.intego.com	www.intego.com
6	platform.twitter.com	www.intego.com platform.twitter.com
5	ssl.gstatic.com	www.intego.com
4	www.facebook.com	www.intego.com connect.facebook.net
4	connect.facebook.net	www.intego.com connect.facebook.net
4	apis.google.com	www.intego.com apis.google.com
4	www.youtube.com	www.intego.com apis.google.com
3	c.disquscdn.com	macsecurityblog.disqus.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com www.intego.com
3	s.w.org	www.intego.com
3	www.linkedin.com	www.intego.com platform.linkedin.com
3	s7.addthis.com	www.intego.com s7.addthis.com
2	web.facebook.com	2 redirects
2	s.yimg.com	www.intego.com s.yimg.com
2	b91.yahoo.co.jp	www.intego.com
2	www.google.de	www.intego.com
2	www.google.com	www.intego.com
2	disqus.com	macsecurityblog.disqus.com
2	bat.bing.com	www.intego.com
2	macsecurityblog.disqus.com	www.intego.com
2	fonts.gstatic.com	fonts.googleapis.com
2	secure.gravatar.com	www.intego.com
2	netdna.bootstrapcdn.com	www.intego.com netdna.bootstrapcdn.com
1	sp.analytics.yahoo.com	s.yimg.com
1	pixel.quantserve.com	www.intego.com
1	syndication.twitter.com	www.intego.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	rules.quantcount.com	secure.quantserve.com
1	accounts.google.com	apis.google.com
1	s.yimg.jp	www.googletagmanager.com
1	secure.quantserve.com	www.intego.com
1	www.googleadservices.com	www.googletagmanager.com
1	pixel.wp.com	www.intego.com
1	m.addthis.com	s7.addthis.com
1	v1.addthisedge.com	s7.addthis.com
1	z.moatads.com	s7.addthis.com
1	s.ytimg.com	www.youtube.com
1	widgets.pinterest.com	www.intego.com
1	graph.facebook.com	www.intego.com
1	www.youtube-nocookie.com	www.intego.com
1	fireside.fm	www.intego.com
1	www.googletagmanager.com	www.intego.com
1	stats.wp.com	www.intego.com
1	i1.wp.com	www.intego.com
1	i0.wp.com	www.intego.com
1	i2.wp.com	www.intego.com
1	platform.linkedin.com	www.intego.com
1	fonts.googleapis.com	www.intego.com
140	49

This site contains links to these domains. Also see Links.

Domain
support.intego.com
www.facebook.com
twitter.com
www.linkedin.com
plus.google.com
pinterest.com
foto.wuestenigel.com
creativecommons.org
www.blockchain.com
en.wikipedia.org
www.sentinelone.com
eclecticlight.co
developer.apple.com
whois-history.whoisxmlapi.com
www.macrumors.com
blog.trendmicro.com
documents.trendmicro.com
podcasts.apple.com
podcast.intego.com
www.instagram.com
www.youtube.com
security.thejoshmeister.com
itunes.apple.com
facebook.com
youtube.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-28` - `2021-08-28`	a year	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2020-09-22` - `2021-10-12`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.twimg.com DigiCert SHA2 High Assurance Server CA	`2019-11-12` - `2020-11-18`	a year	crt.sh
platform.linkedin.com DigiCert SHA2 Secure Server CA	`2020-07-03` - `2022-07-08`	2 years	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
*.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.apis.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
odc-prod-01.oracle.com DigiCert Secure Site ECC CA-1	`2020-07-22` - `2021-10-13`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh
*.fireside.fm Sectigo RSA Domain Validation Secure Server CA	`2020-04-13` - `2022-07-16`	2 years	crt.sh
*.gstatic.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2020-05-01` - `2020-11-01`	6 months	crt.sh
*.pinterest.com DigiCert SHA2 High Assurance Server CA	`2020-07-16` - `2021-08-04`	a year	crt.sh
*.disqus.com DigiCert SHA2 Secure Server CA	`2020-04-20` - `2022-05-09`	2 years	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
*.w.org Sectigo RSA Domain Validation Secure Server CA	`2019-12-19` - `2021-12-18`	2 years	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
www.bing.com Microsoft IT TLS CA 2	`2019-04-30` - `2021-04-30`	2 years	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2019-10-04` - `2020-10-07`	a year	crt.sh
edge01.yahoo.co.jp Cybertrust Japan SureServer CA G4	`2020-07-28` - `2021-08-27`	a year	crt.sh
accounts.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
www.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
syndication.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
mscedge01.yahoo.co.jp Cybertrust Japan SureServer CA G4	`2020-08-04` - `2021-09-03`	a year	crt.sh
*.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-09-10` - `2020-10-28`	2 months	crt.sh
*.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-08-01` - `2021-01-28`	6 months	crt.sh

This page contains 16 frames:

Primary Page: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Frame ID: F48FEC335D728757AB2BF705FE390044
Requests: 130 HTTP requests in this frame

Frame: https://fireside.fm/player/v2/GegHgcrH+8gxBbG1E?theme=dark
Frame ID: 3BF18E0EA87E156BE0EA001330564A59
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube-nocookie.com/embed/nCVaZVfnkTY?&list=PLL1eIqHwwN-MY4WwZvjNYcqo02CbtoB7J&autohide=2&color=red&controls=1&disablekb=0&fs=1&iv_load_policy=1&modestbranding=0&rel=0&showinfo=0&theme=dark&vq=default&enablejsapi=1
Frame ID: 8324CC6E5D3CB358AB2908B3F95427EF
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/subscribe_embed?usegapi=1&channel=IntegoVideo&layout=default&count=default&theme=default&origin=https%3A%2F%2Fwww.intego.com&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.rMJI4WR09CY.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCPRb_B1g8z3qIwl7l27GWLe47nxIA%2Fm%3D__features__
Frame ID: F50B05DF1335B2E93304D4812A6520D6
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 2A4F22570C3B564D128955CD98CC9AE7
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: C84827D918064CCD8975C632C7BF30B6
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2d7d9a6d04538bf11c7b23641e75738c.html?origin=https%3A%2F%2Fwww.intego.com
Frame ID: 80B153B32FBE2F214F036B0047331066
Requests: 1 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.intego.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.rMJI4WR09CY.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCPRb_B1g8z3qIwl7l27GWLe47nxIA%2Fm%3D__features__
Frame ID: 4687AF21832A13CE4C552CD36E4A179F
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/follow_button.2d7d9a6d04538bf11c7b23641e75738c.en.html
Frame ID: 7891D2FAC70C94923E888264CD8B5CD1
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/embed/index.html?dnt=true&embedId=twitter-widget-1&frame=false&hideCard=false&hideThread=false&id=1282860187397746689&lang=en&origin=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&theme=light&widgetsVersion=219d021%3A1598982042171&width=500px
Frame ID: E6F76F0E8AE598E7731F68E876B047A8
Requests: 1 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=macsecurityblog&t_i=92058%20https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2F%3Fp%3D92058&t_u=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&t_e=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat&t_d=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog&t_t=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat&s_o=default
Frame ID: 3AA4E76B07ED9D515C457D3EF1D8CAC6
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/subscribe_embed?action_card=1&channelid=UCtFlc7zQcFj3C_62jVGfghA&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.rMJI4WR09CY.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCPRb_B1g8z3qIwl7l27GWLe47nxIA%2Fm%3D__features__
Frame ID: 9D356FDED4F83AAFC1714B87E4CED6BF
Requests: 1 HTTP requests in this frame

Frame: https://www.linkedin.com/pages-extensions/FollowCompany?id=28855&counter=none&xdOrigin=https%3A%2F%2Fwww.intego.com&xdChannel=c23d1f17-9938-4b66-ba8e-2e048d9a94d8&xd_origin_host=https%3A%2F%2Fwww.intego.com
Frame ID: 3D8A63EAD25DE83A5A04F8400F70A5BF
Requests: 1 HTTP requests in this frame

Frame: https://www.linkedin.com/pages-extensions/FollowCompany?id=28855&counter=none&xdOrigin=https%3A%2F%2Fwww.intego.com&xdChannel=c23d1f17-9938-4b66-ba8e-2e048d9a94d8&xd_origin_host=https%3A%2F%2Fwww.intego.com
Frame ID: B1A54C9A40D47B9FDD7D32CA1B2F6DDC
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/v2.8/plugins/like.php?action=like&app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfce89052680be4%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff3764754b80c04%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.facebook.com%2Fintego&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&_rdc=1&_rdr
Frame ID: B1A90D2A13FF8FBA399ED0EC0D021E9E
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/v2.8/plugins/like_box.php?app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2821566a6fd36%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff3764754b80c04%26relation%3Dparent.parent&color_scheme=light&container_width=290&header=true&href=https%3A%2F%2Fwww.facebook.com%2Fintego&locale=en_US&sdk=joey&show_border=true&show_faces=false&stream=true&_rdc=1&_rdr
Frame ID: F3511D7FF5C5948C8BCFF45CD13C829C
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

140
Requests

99 %
HTTPS

67 %
IPv6

34
Domains

49
Subdomains

43
IPs

9
Countries

1684 kB
Transfer

3729 kB
Size

21
Cookies

38 Outgoing links

These are links going to different origins than the main page.

URL: https://support.intego.com/home
Title: Knowledge Base

Search URL Search Domain Scan URL

URL: https://support.intego.com/hc/requests/new
Title: Contact Support

Search URL Search Domain Scan URL

URL: https://support.intego.com/access/unauthenticated?return_to=http%3A%2F%2Fsupport.intego.com%2Frequests
Title: Check Your Requests

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Title: Shares

Search URL Search Domain Scan URL

URL: https://twitter.com/share?url=https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Title: Tweets

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Title: Shares

Search URL Search Domain Scan URL

URL: https://plus.google.com/share?url=https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Title: Shares

Search URL Search Domain Scan URL

URL: https://pinterest.com/pin/create/button/?url=https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Title: Pins

Search URL Search Domain Scan URL

URL: https://foto.wuestenigel.com/cryptocurrencies-on-a-computer-parts/
Title: Marco Vech

Search URL Search Domain Scan URL

URL: https://creativecommons.org/licenses/by/2.0/
Title: CC BY 2.0

Search URL Search Domain Scan URL

URL: https://www.blockchain.com/btc/address/13V56Qzz1ARMZYV3snBaKtSWxeYoLx2gUg
Title: Bitcoin

Search URL Search Domain Scan URL

URL: https://www.blockchain.com/eth/address/0xDf1108ba2D50b4a4e648DeC1053c8F2e3b97DCdF
Title: Ethereum/Tether

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Firesheep
Title: Firesheep

Search URL Search Domain Scan URL

URL: https://www.sentinelone.com/blog/mojaves-security-hardening-user-protections-bypassed/
Title: Phil Stokes’ research

Search URL Search Domain Scan URL

URL: https://eclecticlight.co/2018/11/12/who-put-that-in-my-full-disk-access-list-ssh-and-mojaves-privacy-protection/
Title: detailed by Howard Oakley

Search URL Search Domain Scan URL

URL: https://eclecticlight.co/2020/08/20/the-vulnerability-in-remote-login-ssh-persists/
Title: follow-up article

Search URL Search Domain Scan URL

URL: https://developer.apple.com/security-bounty/
Title: Apple’s own Security Bounty

Search URL Search Domain Scan URL

URL: https://whois-history.whoisxmlapi.com/lookup-report/JPRqQZVJRM
Title: WHOIS history for adobestats[.]com as of Aug 24

Search URL Search Domain Scan URL

URL: https://whois-history.whoisxmlapi.com/lookup-report/QNRPpm3xRA
Title: WHOIS history for flixprice[.]com as of Aug 24

Search URL Search Domain Scan URL

URL: https://whois-history.whoisxmlapi.com/lookup-report/1pRKqgG45w
Title: WHOIS history for titiez[.]com as of Aug 24

Search URL Search Domain Scan URL

URL: https://www.macrumors.com/2020/08/24/xcode-malware-infiltrate-app-store/
Title: speculate

Search URL Search Domain Scan URL

URL: https://twitter.com/IntegoSecurity/status/1125910524519018497
Title: far too late

Search URL Search Domain Scan URL

URL: https://blog.trendmicro.com/trendlabs-security-intelligence/xcsset-mac-malware-infects-xcode-projects-performs-uxss-attack-on-safari-other-browsers-leverages-zero-day-exploits/
Title: this blog post

Search URL Search Domain Scan URL

URL: https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf
Title: this technical brief PDF

Search URL Search Domain Scan URL

URL: https://podcasts.apple.com/us/podcast/intego-mac-podcast/id1293834627

Search URL Search Domain Scan URL

URL: https://podcast.intego.com/149
Title: episode 149

Search URL Search Domain Scan URL

URL: https://podcast.intego.com/
Title: Intego Mac Podcast

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Intego
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.instagram.com/intego_security/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://twitter.com/IntegoSecurity
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/IntegoVideo?sub_confirmation=1
Title: YouTube

Search URL Search Domain Scan URL

URL: https://twitter.com/theJoshMeister
Title: @theJoshMeister

Search URL Search Domain Scan URL

URL: https://security.thejoshmeister.com/
Title: security.thejoshmeister.com

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/us/podcast/intego-mac-podcast/id1293834627

Search URL Search Domain Scan URL

URL: http://facebook.com/Intego
Title: Facebook

Search URL Search Domain Scan URL

URL: http://twitter.com/integosecurity
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/intego
Title: LinkedIn

Search URL Search Domain Scan URL

URL: http://youtube.com/user/IntegoVideo
Title: YouTube

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 142

https://web.facebook.com/v2.8/plugins/like.php?action=like&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfce89052680be4%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff3764754b80c04%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.facebook.com%2Fintego&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small HTTP 302
https://www.facebook.com/v2.8/plugins/like.php?action=like&app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfce89052680be4%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff3764754b80c04%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.facebook.com%2Fintego&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&_rdc=1&_rdr

Request Chain 143

https://web.facebook.com/v2.8/plugins/like_box.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2821566a6fd36%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff3764754b80c04%26relation%3Dparent.parent&color_scheme=light&container_width=290&header=true&href=https%3A%2F%2Fwww.facebook.com%2Fintego&locale=en_US&sdk=joey&show_border=true&show_faces=false&stream=true HTTP 302
https://www.facebook.com/v2.8/plugins/like_box.php?app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2821566a6fd36%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff3764754b80c04%26relation%3Dparent.parent&color_scheme=light&container_width=290&header=true&href=https%3A%2F%2Fwww.facebook.com%2Fintego&locale=en_US&sdk=joey&show_border=true&show_faces=false&stream=true&_rdc=1&_rdr

140 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/ 92 KB
25 KB 49ms
18ms Document
text/html 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 49b34be224fe432a99c8609e9f61bf4f07144fc9b6b90325b7cc304b1271547f

Request headers

:method: GET
:authority: www.intego.com
:scheme: https
:path: /mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Fri, 25 Sep 2020 15:28:53 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d2026a81d6a076ba5c5343bcc913235c81601047733; expires=Sun, 25-Oct-20 15:28:53 GMT; path=/; domain=.intego.com; HttpOnly; SameSite=Lax
vary: Accept-Encoding
cache-control: max-age=86400
expires: Fri, 25 Sep 2020 16:30:06 GMT
age: 1366
x-varnish-cache: HIT
cf-cache-status: HIT
cf-request-id: 05677abe7500001f5548325200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5d85c710bd5b1f55-FRA
content-encoding: gzip

GET
H2 200 style.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/ 135 B
291 B 29ms
22ms Stylesheet
text/css 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9eeea020cc6ec6c8b66b20c48a9b69a5f14b8097bdb91c5420998eb842bcbae0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1327
cf-polished: origSize=512
status: 200
cf-request-id: 05677abe9500001f5548328200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-200"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c710edca1f55-FRA
cf-bgj: minify

GET
H2 200 font-awesome.css
netdna.bootstrapcdn.com/font-awesome/3.1.1/css/ 23 KB
5 KB 33ms
9ms Stylesheet
text/css 2001:4de0:ac19::1:b:1b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://netdna.bootstrapcdn.com/font-awesome/3.1.1/css/font-awesome.css

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

a2d30057d0a8007fb75fb8a6e4f82f59d3858d29ea176db9c73f665209e86123

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Dec 2018 18:35:19 GMT
status: 200
etag: "1544639719"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 4713

GET
H2 200 css
fonts.googleapis.com/ 16 KB
1 KB 21ms
14ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:200,400,700,200italic,400italic,700italic

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8f2cf36a9df3e0af8f1b226a1440c9a6fd4cda5c4b4548150236c8d1a1b094e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 25 Sep 2020 15:28:53 GMT
server: ESF
date: Fri, 25 Sep 2020 15:28:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 25 Sep 2020 15:28:53 GMT

GET
H2 200 widget.css
www.intego.com/mac-security-blog/wp-content/plugins/yet-another-related-posts-plugin/style/ 606 B
464 B 29ms
23ms Stylesheet
text/css 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/plugins/yet-another-related-posts-plugin/style/widget.css?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 765af1bf46f65a6bb9108eea31286465e8a28f1c649030afff11b51b45cb25d4

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 2585
cf-polished: origSize=771
status: 200
cf-request-id: 05677abe9600001f5548329200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-303"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c710fdd51f55-FRA
cf-bgj: minify

GET
H2 200 style.min.css
www.intego.com/mac-security-blog/wp-includes/css/dist/block-library/ 52 KB
8 KB 30ms
24ms Stylesheet
text/css 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-includes/css/dist/block-library/style.min.css?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 2585
status: 200
content-length: 7643
cf-request-id: 05677abe9600001f554832a200000001
last-modified: Tue, 05 May 2020 06:38:24 GMT
server: cloudflare
etag: W/"5eb109e0-d159"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c710fdd71f55-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 light_style.css
www.intego.com/mac-security-blog/wp-content/plugins/jquery-collapse-o-matic/ 884 B
501 B 31ms
25ms Stylesheet
text/css 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/plugins/jquery-collapse-o-matic/light_style.css?ver=1.6
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d077683ec63c7d44f473554e688628da6cfdf84c0f223b6be00f2476600433a5

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1327
cf-polished: origSize=1043
status: 200
cf-request-id: 05677abe9600001f554832b200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-413"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c710fdd81f55-FRA
cf-bgj: minify

GET
H2 200 bootstrap.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 99 KB
16 KB 35ms
29ms Stylesheet
text/css 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/bootstrap.css?ver=1.0
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3fb4cab423b2441335fc682b79687d8eb806aceb384c937c9b28534580593fd4

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1327
cf-polished: origSize=121622
status: 200
cf-request-id: 05677abe9600001f554832c200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-1db16"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c710fdd91f55-FRA
cf-bgj: minify

GET
H2 200 bootstrap-responsive.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 16 KB
4 KB 39ms
33ms Stylesheet
text/css 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/bootstrap-responsive.css?ver=1.0
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c082b0b5901359803e620e04dee50986beef023bdc7413d1e47d571bc73a7500

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1327
cf-polished: origSize=21797
status: 200
cf-request-id: 05677abe9600001f554832d200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-5525"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c710fe051f55-FRA
cf-bgj: minify

GET
H2 200 layout-responsive.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 2 KB
785 B 33ms
28ms Stylesheet
text/css 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout-responsive.css?ver=1.0
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f2b93287eebae3a6ac1f7efadd39373abd95e1ee24620ef4f156b0fe1a496be4

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1327
cf-polished: origSize=2755
status: 200
cf-request-id: 05677abe9600001f554832e200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-ac3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c710fe0a1f55-FRA
cf-bgj: minify

GET
H2 200 jetpack.css
www.intego.com/mac-security-blog/wp-content/plugins/jetpack/css/ 73 KB
13 KB 37ms
32ms Stylesheet
text/css 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/plugins/jetpack/css/jetpack.css?ver=8.6.1
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a9cab6b997431283ce8f789f1efd7d1b74f27e79c9f545a623ee1387ce7409ac

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 2585
cf-polished: origSize=74986
status: 200
cf-request-id: 05677abe9600001f554832f200000001
last-modified: Mon, 06 Jul 2020 16:18:19 GMT
server: cloudflare
etag: W/"5f034ecb-124ea"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c710fe0b1f55-FRA
cf-bgj: minify

GET
H2 200 advanced-recent-posts-widget.css
www.intego.com/mac-security-blog/wp-content/plugins/advanced-recent-posts-widget/css/ 582 B
391 B 32ms
27ms Stylesheet
text/css 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/plugins/advanced-recent-posts-widget/css/advanced-recent-posts-widget.css?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f538d5803d00836b5f946264abb64976a6416ab4cc16f8f83455a025a08ad014

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 2585
cf-polished: origSize=744
status: 200
cf-request-id: 05677abe9600001f5548330200000001
last-modified: Mon, 06 Jul 2020 16:18:19 GMT
server: cloudflare
etag: W/"5f034ecb-2e8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c710fe0d1f55-FRA
cf-bgj: minify

GET
H2 200 jquery.adrotate.clicktracker.js Show response
www.intego.com/mac-security-blog/wp-content/plugins/adrotate/library/ 199 B
280 B 36ms
31ms Script
application/javascript 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/plugins/adrotate/library/jquery.adrotate.clicktracker.js
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1ec59a067ba6ca9573c5443f4162b16b1b3349c34669eb4e7f4be7a20bdc85e5

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 2585
cf-polished: origSize=373
status: 200
cf-request-id: 05677abe9600001f5548331200000001
last-modified: Mon, 06 Jul 2020 16:18:19 GMT
server: cloudflare
etag: W/"5f034ecb-175"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c710fe0e1f55-FRA
cf-bgj: minify

GET
H2 200 jquery.js Show response
www.intego.com/mac-security-blog/wp-includes/js/jquery/ 95 KB
33 KB 41ms
37ms Script
application/javascript 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8c7ee0238fa5cd80a02ef9870a7fff498ef52097181cb73edb9219dc022fd919

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1327
cf-polished: origSize=96873
status: 200
cf-request-id: 05677abe9600001f5548332200000001
last-modified: Fri, 17 May 2019 04:25:54 GMT
server: cloudflare
etag: W/"5cde37d2-17a69"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c710fe0f1f55-FRA
cf-bgj: minify

GET
H2 200 jquery-migrate.min.js Show response
www.intego.com/mac-security-blog/wp-includes/js/jquery/ 10 KB
4 KB 40ms
36ms Script
application/javascript 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 2585
status: 200
content-length: 4014
cf-request-id: 05677abe9600001f5548333200000001
last-modified: Fri, 20 May 2016 06:11:28 GMT
server: cloudflare
etag: W/"573eaa90-2748"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c710fe101f55-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 bootstrap.min.js Show response
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/ 25 KB
7 KB 37ms
34ms Script
application/javascript 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/bootstrap.min.js?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7587369160233b751c90ccc2043b7fdfd7eb1f0d9aa610371b43f4b3419fa83f

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 2585
status: 200
content-length: 6816
cf-request-id: 05677abe9600001f5548334200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-648f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c710fe111f55-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 html5shiv.js Show response
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/ 2 KB
1 KB 42ms
39ms Script
application/javascript 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/html5shiv.js?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b859cc611126401cdc38d803ac7c5967ee5da1a626e00318700ea88df55da1b9

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 2585
cf-polished: origSize=2376
status: 200
cf-request-id: 05677abe9600001f5548335200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-948"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c710fe121f55-FRA
cf-bgj: minify

GET
H2 200 modernizr-1.6.min.js Show response
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/ 9 KB
4 KB 36ms
33ms Script
application/javascript 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/modernizr-1.6.min.js?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0140ed5069f22e4aa8bb1a1fc615c39fc55d7d64e94be541615f1c5a30ae479b

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 2585
status: 200
content-length: 3717
cf-request-id: 05677abe9600001f5548336200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-255b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c710fe131f55-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 scripts.js Show response
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/ 10 KB
3 KB 35ms
32ms Script
application/javascript 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/scripts.js?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7456721b1c3d2c1c24d4ed813a2795d0907dc1c0b2748e566e8dabf3d1126dcb

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 2585
cf-polished: origSize=17410
status: 200
cf-request-id: 05677abe9600001f5548337200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-4402"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c710fe151f55-FRA
cf-bgj: minify

GET
H2 200 tracking.js Show response
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/ 3 KB
1007 B 36ms
33ms Script
application/javascript 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/js/tracking.js
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f5eb3447e5e14f6907295baf22ba454cf3a88b4cd41abd61e6286e975d3608a0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 247
cf-polished: origSize=4190
status: 200
cf-request-id: 05677abe9600001f5548338200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-105e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c710fe161f55-FRA
cf-bgj: minify

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 95 KB
29 KB 37ms
6ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/4194) /
Resource Hash: a761b426004caba495cdac2c93ce7dd306c47bc4d7bdc63c4840c3d8182396a9

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 15:28:54 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 501
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Content-Length: 28881
x-tw-cdn: VZ
Last-Modified: Tue, 01 Sep 2020 20:40:54 GMT
Server: ECS (fcn/4194)
Etag: "a58136137a93f33c1d165df7d4d973f8+gzip"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800

GET
H/1.1 200
OK in.js Show response
platform.linkedin.com/ 181 KB
55 KB 22ms
7ms Script
text/javascript 2a02:26f0:6c00::210:ba20
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.linkedin.com/in.js
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00::210:ba20 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: Play /
Resource Hash: 9397e430232fd1a326c8e8ca1473007c96f8c84a0fa2820c4ca16d4e311d1fde

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-LI-UUID: /CUx3KUOOBaQcgeLdisAAA==
Date: Fri, 25 Sep 2020 15:28:53 GMT
Content-Encoding: gzip
X-CDN-CLIENT-IP-VERSION: IPV6
Server: Play
X-Li-Pop: prod-eda6
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Cache-Control: public, max-age=3600
Connection: keep-alive
X-LI-Proto: http/1.1
Content-Length: 55598
X-CDN: AKAM
X-Li-Fabric: prod-lva1
Expires: Fri, 25 Sep 2020 15:56:13 GMT

GET
H2 200 btn_search.png
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/ 1 KB
1 KB 600ms
594ms Image
image/webp 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/btn_search.png
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85c1eb2c2a173feceba14abe8344fe9c7cb12aa1353f083f28a62f1a366763b9

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
cf-cache-status: REVALIDATED
cf-polished: origFmt=png, origSize=2462
status: 200
content-disposition: inline; filename="btn_search.webp"
content-length: 1104
cf-request-id: 05677abf2a00001f554834c200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: "5f034ecc-99e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c711dfe81f55-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 5ad29f4111ce14911abaa98cbbcdea42
secure.gravatar.com/avatar/ 1 KB
1 KB 30ms
6ms Image
image/png 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/5ad29f4111ce14911abaa98cbbcdea42?s=18&d=mm&r=g
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 270deaa4889841d35cc851365432365bf62d81c1159ad4a1099def85ce6f8bed

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 1
date: Fri, 25 Sep 2020 15:28:54 GMT
last-modified: Wed, 21 Nov 2018 15:20:13 GMT
server: nginx
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="5ad29f4111ce14911abaa98cbbcdea42.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/5ad29f4111ce14911abaa98cbbcdea42?s=18&d=mm&r=g>; rel="canonical"
content-length: 1051
expires: Fri, 25 Sep 2020 15:33:54 GMT

GET
H2 200 Xcodeproj-infected-with-XCSSET-Mac-malware-logo-600x300-1.png
www.intego.com/mac-security-blog/wp-content/uploads/2020/08/ 57 KB
57 KB 24ms
18ms Image
image/webp 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/uploads/2020/08/Xcodeproj-infected-with-XCSSET-Mac-malware-logo-600x300-1.png
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 07b8f01ebba4076c5166ae55f61991d7e7e5fbfaf47caccad4e0878349105b0a

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
cf-cache-status: HIT
age: 609
cf-polished: origFmt=png, origSize=68232
status: 200
content-disposition: inline; filename="Xcodeproj-infected-with-XCSSET-Mac-malware-logo-600x300-1.webp"
content-length: 57898
cf-request-id: 05677abf2a00001f554834d200000001
last-modified: Fri, 21 Aug 2020 21:39:06 GMT
server: cloudflare
etag: "5f403efa-10a88"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c711dfe91f55-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 Xcode-icon-Big-Sur-512-300x300.jpg
www.intego.com/mac-security-blog/wp-content/uploads/2020/08/ 13 KB
13 KB 20ms
14ms Image
image/webp 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/uploads/2020/08/Xcode-icon-Big-Sur-512-300x300.jpg
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 66db6471e94c968b938e977f160c15f9cc9d9941e66823bdf043a7e932d92240

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
cf-cache-status: HIT
age: 608
cf-polished: qual=85, origFmt=jpeg, origSize=17647
status: 200
content-disposition: inline; filename="Xcode-icon-Big-Sur-512-300x300.webp"
content-length: 12804
cf-request-id: 05677abf2a00001f554834e200000001
last-modified: Mon, 24 Aug 2020 15:00:00 GMT
server: cloudflare
etag: "5f43d5f0-44ef"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c711dfeb1f55-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 Bitcoin-Ripple-Ethereum-cryptocurrencies-on-computer-parts-by-Marco-Vech-modified-325x220-1.jpg
www.intego.com/mac-security-blog/wp-content/uploads/2020/02/ 28 KB
28 KB 18ms
13ms Image
image/webp 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/uploads/2020/02/Bitcoin-Ripple-Ethereum-cryptocurrencies-on-computer-parts-by-Marco-Vech-modified-325x220-1.jpg
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dd181d190b0d09b0d51c5ab338983be4d084fbec3af3dbe6e739e9f55014c5b6

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
cf-cache-status: HIT
age: 608
cf-polished: qual=85, origFmt=jpeg, origSize=41624
status: 200
content-disposition: inline; filename="Bitcoin-Ripple-Ethereum-cryptocurrencies-on-computer-parts-by-Marco-Vech-modified-325x220-1.webp"
content-length: 28614
cf-request-id: 05677abf2a00001f554834f200000001
last-modified: Fri, 14 Feb 2020 23:03:27 GMT
server: cloudflare
etag: "5e47273f-a298"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c711dfed1f55-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 cookies-300x171.png
www.intego.com/mac-security-blog/wp-content/uploads/2020/08/ 51 KB
51 KB 21ms
16ms Image
image/webp 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/uploads/2020/08/cookies-300x171.png
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bcccab88ad368e380f7906289dd171606c96f78f44f4322c93395093b8844706

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
cf-cache-status: HIT
age: 608
cf-polished: origFmt=png, origSize=75087
status: 200
content-disposition: inline; filename="cookies-300x171.webp"
content-length: 52194
cf-request-id: 05677abf2a00001f5548350200000001
last-modified: Mon, 24 Aug 2020 18:56:04 GMT
server: cloudflare
etag: "5f440d44-1254f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c711dfee1f55-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 safari-150x150.png
www.intego.com/mac-security-blog/wp-content/uploads/2019/06/ 18 KB
18 KB 25ms
20ms Image
image/webp 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/uploads/2019/06/safari-150x150.png
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: caf986b7c4bc7761acf6300a4b62ef45653cc42031d64dbfcd44f9be4c4fc26e

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
cf-cache-status: HIT
age: 608
cf-polished: origFmt=png, origSize=26593
status: 200
content-disposition: inline; filename="safari-150x150.webp"
content-length: 18458
cf-request-id: 05677abf2a00001f5548351200000001
last-modified: Fri, 28 Jun 2019 13:36:47 GMT
server: cloudflare
etag: "5d1617ef-67e1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c711dff01f55-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 GitHub_Logo-300x123.png
www.intego.com/mac-security-blog/wp-content/uploads/2020/08/ 2 KB
3 KB 33ms
28ms Image
image/webp 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/uploads/2020/08/GitHub_Logo-300x123.png
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b3047860308e9ff0cf48f12a46bb529b8c4cb14287d14736e4b0257e6609a2c7

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
cf-cache-status: HIT
age: 608
cf-polished: origFmt=png, origSize=6055
status: 200
content-disposition: inline; filename="GitHub_Logo-300x123.webp"
content-length: 2502
cf-request-id: 05677abf2a00001f5548352200000001
last-modified: Mon, 24 Aug 2020 19:14:29 GMT
server: cloudflare
etag: "5f441195-17a7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c711dff11f55-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 big-sur-600.jpeg
www.intego.com/mac-security-blog/wp-content/uploads/2020/08/ 31 KB
31 KB 25ms
20ms Image
image/webp 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/uploads/2020/08/big-sur-600.jpeg
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 74bb956c78140b9e3228afbcc5c520080df82ea13e945766657928838ec56515

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
cf-cache-status: HIT
age: 608
cf-polished: qual=85, origFmt=jpeg, origSize=94608
status: 200
content-disposition: inline; filename="big-sur-600.webp"
content-length: 31966
cf-request-id: 05677abf2a00001f5548353200000001
last-modified: Mon, 17 Aug 2020 09:34:39 GMT
server: cloudflare
etag: "5f3a4f2f-17190"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c711dff41f55-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 X9-Mac-Antivirus-Launch-300x150.png
www.intego.com/mac-security-blog/wp-content/uploads/2016/06/ 27 KB
28 KB 28ms
23ms Image
image/webp 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/uploads/2016/06/X9-Mac-Antivirus-Launch-300x150.png
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 25aa0b7b8ad904efa464dc2b11da0975d77ef2ba0eb747b06b72c738b95e581d

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
cf-cache-status: HIT
age: 608
cf-polished: origFmt=png, origSize=47876
status: 200
content-disposition: inline; filename="X9-Mac-Antivirus-Launch-300x150.webp"
content-length: 27938
cf-request-id: 05677abf2a00001f5548354200000001
last-modified: Mon, 20 Jun 2016 03:34:07 GMT
server: cloudflare
etag: "5767642f-bb04"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c711dff51f55-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 ios9-podcasts-app-tile-50x50.png
www.intego.com/mac-security-blog/wp-content/uploads/2017/10/ 2 KB
2 KB 26ms
22ms Image
image/webp 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/uploads/2017/10/ios9-podcasts-app-tile-50x50.png
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4813a9ef082680ede099e57bad023ef37cb204fe87ec0de1de1534cc7b1b4103

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
cf-cache-status: HIT
age: 1708
cf-polished: origFmt=png, origSize=3407
status: 200
content-disposition: inline; filename="ios9-podcasts-app-tile-50x50.webp"
content-length: 2176
cf-request-id: 05677abf2a00001f5548355200000001
last-modified: Tue, 31 Oct 2017 12:56:46 GMT
server: cloudflare
etag: "59f8730e-d4f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c711dff61f55-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 5ad29f4111ce14911abaa98cbbcdea42
secure.gravatar.com/avatar/ 8 KB
8 KB 29ms
7ms Image
image/png 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/5ad29f4111ce14911abaa98cbbcdea42?s=60&d=mm&r=g
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 33f30681793311916b1626535ca2990a9efcbf10f26d2c2a6565edfb6979c4ec

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 1
date: Fri, 25 Sep 2020 15:28:54 GMT
last-modified: Wed, 21 Nov 2018 15:20:13 GMT
server: nginx
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="5ad29f4111ce14911abaa98cbbcdea42.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/5ad29f4111ce14911abaa98cbbcdea42?s=60&d=mm&r=g>; rel="canonical"
content-length: 8249
expires: Fri, 25 Sep 2020 15:33:54 GMT

GET
H2 200 privacy-hero-400.jpeg
i2.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2020/09/ 1 KB
1 KB 37ms
7ms Image
image/jpeg 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2020/09/privacy-hero-400.jpeg?resize=40%2C40&ssl=1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

79e23a92dfcac7cfec15c82dfcbd83d3db7cb9222a8a1a60963d0bec57977163

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 5
date: Fri, 25 Sep 2020 15:28:54 GMT
x-content-type-options: nosniff
x-bytes-saved: 76
last-modified: Thu, 24 Sep 2020 15:27:34 GMT
server: nginx
etag: "183d327cfe0bbfca"
vary: Accept
content-type: image/jpeg
status: 200
cache-control: public, max-age=63115200
link: <https://www.intego.com/mac-security-blog/wp-content/uploads/2020/09/privacy-hero-400.jpeg>; rel="canonical"
content-length: 1148
expires: Sun, 25 Sep 2022 03:27:34 GMT

GET
H2 200 Intego-Mac-Podcast-New-Episode-Featured.png
i0.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2018/07/ 478 B
786 B 40ms
9ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2018/07/Intego-Mac-Podcast-New-Episode-Featured.png?resize=40%2C40&ssl=1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

8e647ae3b97c4adb3970662d2945d1be4cf09e75712de88eb2b3adf793d16bcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 8
date: Fri, 25 Sep 2020 15:28:54 GMT
x-content-type-options: nosniff
x-bytes-saved: 1060
last-modified: Fri, 26 Jun 2020 18:35:39 GMT
server: nginx
etag: "48790abe968542f8"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <https://www.intego.com/mac-security-blog/wp-content/uploads/2018/07/Intego-Mac-Podcast-New-Episode-Featured.png>; rel="canonical"
content-length: 478
expires: Mon, 27 Jun 2022 06:35:39 GMT

GET
H2 200 ios-software-update-available-icon-400x260.png
i1.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2019/01/ 582 B
875 B 46ms
7ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/www.intego.com/mac-security-blog/wp-content/uploads/2019/01/ios-software-update-available-icon-400x260.png?resize=40%2C40&ssl=1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

a4d96a2b0a51347fa935513d95b0f49d7f6fcebb5357fd7129974758bb5b5680

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 6
date: Fri, 25 Sep 2020 15:28:54 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Sep 2020 05:02:19 GMT
server: nginx
etag: "c7cecc8dfda40704"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <https://www.intego.com/mac-security-blog/wp-content/uploads/2019/01/ios-software-update-available-icon-400x260.png>; rel="canonical"
content-length: 582
expires: Sun, 18 Sep 2022 17:02:19 GMT

GET
H2 200 Intego-Podcast-iTunes.png
www.intego.com/mac-security-blog/wp-content/uploads/2017/10/ 11 KB
11 KB 27ms
23ms Image
image/webp 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/uploads/2017/10/Intego-Podcast-iTunes.png
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 658e8b2fc6e603ce4afb0f39cd09d2ff743c9fcbeaaea5dc58097184d34da56d

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
cf-cache-status: HIT
age: 2878
cf-polished: origFmt=png, origSize=16774
status: 200
content-disposition: inline; filename="Intego-Podcast-iTunes.webp"
content-length: 11048
cf-request-id: 05677abf2a00001f5548356200000001
last-modified: Wed, 25 Oct 2017 16:25:31 GMT
server: cloudflare
etag: "59f0bafb-4186"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c711dff81f55-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 related.css
www.intego.com/mac-security-blog/wp-content/plugins/yet-another-related-posts-plugin/style/ 495 B
400 B 11ms
11ms Stylesheet
text/css 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/plugins/yet-another-related-posts-plugin/style/related.css?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aeed123aaf3d21619c5676888e47328a2f0f9994ea86268b5ad0072825bc29fb

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 2585
cf-polished: origSize=647
status: 200
cf-request-id: 05677abed600001f5548343200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-287"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c7115ec61f55-FRA
cf-bgj: minify

GET
H2 200 comment-reply.min.js Show response
www.intego.com/mac-security-blog/wp-includes/js/ 2 KB
1 KB 26ms
25ms Script
application/javascript 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-includes/js/comment-reply.min.js?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a37ca4608218cccdfb8b6d4edbdfbf375d0e1368b46397e3b7049e0cbf5bc1f6

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 2586
status: 200
content-length: 1159
cf-request-id: 05677abee000001f5548344200000001
last-modified: Mon, 06 Apr 2020 12:02:02 GMT
server: cloudflare
etag: W/"5e8b1a3a-974"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c7116eee1f55-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 comment_count.js Show response
www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/ 708 B
667 B 15ms
15ms Script
application/javascript 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.17
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b385fd0614f2927f0e7fdc03ccdb2428e3a93de0c7fe467149b34213cc32c0f6

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1328
cf-polished: origSize=889
status: 200
cf-request-id: 05677abf2100001f5548348200000001
last-modified: Mon, 06 Jul 2020 16:18:19 GMT
server: cloudflare
etag: W/"5f034ecb-379"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c711cfbd1f55-FRA
cf-bgj: minify

GET
H2 200 comment_embed.js Show response
www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/ 828 B
499 B 18ms
11ms Script
application/javascript 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.17
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e7f5a831ead8920451598097754bb1d4fbf16fff1fd90794b950724867345794

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1328
cf-polished: origSize=1150
status: 200
cf-request-id: 05677abf2900001f5548349200000001
last-modified: Mon, 06 Jul 2020 16:18:19 GMT
server: cloudflare
etag: W/"5f034ecb-47e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c711dfdf1f55-FRA
cf-bgj: minify

GET
H2 200 collapse.js Show response
www.intego.com/mac-security-blog/wp-content/plugins/jquery-collapse-o-matic/js/ 14 KB
3 KB 19ms
12ms Script
application/javascript 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/plugins/jquery-collapse-o-matic/js/collapse.js?ver=1.6.19
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 01fdf346f2f8d129c118d71f735fb3a76656059b38000829b908a1a118a5492f

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 3073
cf-polished: origSize=20438
status: 200
cf-request-id: 05677abf2900001f554834a200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-4fd6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c711dfe21f55-FRA
cf-bgj: minify

GET
H2 200 wp-embed.min.js Show response
www.intego.com/mac-security-blog/wp-includes/js/ 1 KB
945 B 25ms
18ms Script
application/javascript 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-includes/js/wp-embed.min.js?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 2586
status: 200
content-length: 769
cf-request-id: 05677abf2900001f554834b200000001
last-modified: Mon, 06 Apr 2020 12:02:02 GMT
server: cloudflare
etag: W/"5e8b1a3a-59a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c711dfe31f55-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 iframe_api Show response
www.youtube.com/ 859 B
1 KB 57ms
24ms Script
application/javascript 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api?ver=5.4.2

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

bb419846a6c750ceac7e697b479216945b7597dea49905e30d1fc040a3194099

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:28:54 GMT
x-content-type-options: nosniff
server: YouTube Frontend Proxy
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
status: 200
cache-control: no-cache
content-type: application/javascript
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Tue, 27 Apr 1971 19:44:06 GMT

GET
H2 200 platform.js Show response
apis.google.com/js/ 49 KB
20 KB 58ms
25ms Script
application/javascript 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/platform.js?ver=5.4.2

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

53e8ea14545d74e203b97733f765238f89b895230a8afb415874c7c445c75c58

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-yuATV6mcqX2qj0LG4Auiqw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
status: 200
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
etag: "5191cc5ccb442b017d7277cd60712230"
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
content-security-policy: script-src 'report-sample' 'nonce-yuATV6mcqX2qj0LG4Auiqw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin: *
expires: Fri, 25 Sep 2020 15:28:54 GMT

GET
H2 200 e-202039.js Show response
stats.wp.com/ 9 KB
3 KB 28ms
7ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202039.js
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: gzip
server: nginx
etag: W/"5c6340e3-350a"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
expires: Sun, 19 Sep 2021 22:23:43 GMT

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 353 KB
114 KB 82ms
28ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
server: nginx/1.15.8
etag: "5ed917ff-5834c"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
status: 200
cache-control: public, max-age=600
date: Fri, 25 Sep 2020 15:28:54 GMT
x-host: s7.addthis.com
content-length: 116323

GET
H2 200 reset.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 773 B
549 B 26ms
13ms Stylesheet
text/css 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/reset.css
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82f1278f66b192a223e306d884f8db595ef3b6d829cc1544807b9bf40019403e

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1327
cf-polished: origSize=1184
status: 200
cf-request-id: 05677abec100001f554833d200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-4a0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c7113e741f55-FRA
cf-bgj: minify

GET
H2 200 layout.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 24 KB
6 KB 36ms
23ms Stylesheet
text/css 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 451b07379c15f95edc328f4b3b71d3d3b67cda7fe5b85251b39f866d0189f943

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1327
cf-polished: origSize=30630
status: 200
cf-request-id: 05677abec200001f554833e200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-77a6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c7113e751f55-FRA
cf-bgj: minify

GET
H2 200 wrapper.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 96 KB
23 KB 29ms
16ms Stylesheet
text/css 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/wrapper.css
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cd42913991b63df247c37543d4b233d0579e3765af6e88565d36b8ddf91693bc

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 2998
cf-polished: origSize=109585
status: 200
cf-request-id: 05677abec200001f554833f200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-1ac11"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c7113e761f55-FRA
cf-bgj: minify

GET
H2 200 referrer-overrides.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 125 B
229 B 24ms
11ms Stylesheet
text/css 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/referrer-overrides.css
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aaffceab986a8d791cfef18d2d1e28fe2dcaf40a8bdfaf4fd393b1a91c6f072b

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1327
cf-polished: origSize=141
status: 200
cf-request-id: 05677abec200001f5548340200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-8d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c7113e771f55-FRA
cf-bgj: minify

GET
H2 200 print.css
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/ 2 KB
450 B 32ms
19ms Stylesheet
text/css 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/print.css
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 884a2330198f498e36d9e77bb5c7f4971b3d70c4411cf306a3afca8bb50bb94d

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1327
cf-polished: origSize=3073
status: 200
cf-request-id: 05677abec200001f5548341200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: W/"5f034ecc-c01"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-ray: 5d85c7113e781f55-FRA
cf-bgj: minify

GET
H2 200 wp-emoji-release.min.js Show response
www.intego.com/mac-security-blog/wp-includes/js/ 14 KB
5 KB 30ms
26ms Script
application/javascript 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-includes/js/wp-emoji-release.min.js?ver=5.4.2
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 2585
status: 200
content-length: 4653
cf-request-id: 05677abf2a00001f5548357200000001
last-modified: Mon, 06 Apr 2020 12:02:02 GMT
server: cloudflare
etag: W/"5e8b1a3a-364d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c711dff91f55-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 150 KB
42 KB 27ms
25ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-9WJ8

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b7250591ec46b002df773646ece219ff2b0c5f202ad75ba5f56c4934b2a88d98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42514
x-xss-protection: 0
expires: Fri, 25 Sep 2020 15:28:54 GMT

GET
H2 200 logo.svg
www.intego.com/sites/all/themes/intego_3/dist/images/_include-raw/ 2 KB
1 KB 18ms
15ms Image
image/svg+xml 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/sites/all/themes/intego_3/dist/images/_include-raw/logo.svg

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/wrapper.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5539ebc747e005bcd0bcdf9e946d3469107a18d1996595c39a2445a886468674

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/wrapper.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2999
status: 200
cf-request-id: 05677abf2a00001f5548358200000001
last-modified: Thu, 24 Sep 2020 15:06:19 GMT
server: cloudflare
etag: W/"dea433-7af-5b0108ad910c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=1209600
cf-ray: 5d85c711dffb1f55-FRA
expires: Thu, 08 Oct 2020 15:19:13 GMT

GET
H2 200 blog_header_bg.gif
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/ 3 KB
3 KB 22ms
19ms Image
image/webp 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/blog_header_bg.gif
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: af0c90c79167796746d77eb0f20a739e66fa7fcd774680c7ba25cce5292d5ba5

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
cf-cache-status: HIT
age: 2999
cf-polished: origFmt=gif, origSize=5992
status: 200
content-disposition: inline; filename="blog_header_bg.webp"
content-length: 3064
cf-request-id: 05677abf2a00001f5548359200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: "5f034ecc-1768"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c711dffe1f55-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 21ms
7ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c038085bd64c19c9f10dbf5d50967e4336ad5db48ff87111cb181e9a05cbaab0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: 1tsg6ofcCcKcwxuLKM18SA==
status: 200
cross-origin-resource-policy: cross-origin
expires: Fri, 25 Sep 2020 15:38:08 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1778
etag: "16c8e21ad71aa777023cb101b393a96a"
x-fb-debug: t+HoSnKrRkF9tHpst1axpUCxIPvWg+CZP3xpDptYbKgV7xfma4lMUfzr5+e3wXRdQTHsz0TIkNHQ9Y45xO2U0g==
x-fb-trip-id: 1460883810
x-fb-content-md5: 5806e0fba4e794faf6e40a3d79f115b0
date: Fri, 25 Sep 2020 15:28:54 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

GET
H2 200 share_divider.png
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/ 166 B
347 B 579ms
579ms Image
image/webp 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/share_divider.png
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ffa8b5c0d78def1b71617c0ae00e01b295bc29e2e227ba0dc84469a9ba39259c

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
cf-cache-status: REVALIDATED
cf-polished: origFmt=png, origSize=1219
status: 200
content-disposition: inline; filename="share_divider.webp"
content-length: 166
cf-request-id: 05677abf4a00001f554835a200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: "5f034ecc-4c3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c71218701f55-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 DagnyWebPro.woff
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/ 39 KB
39 KB 16ms
14ms Font
font/woff 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/DagnyWebPro.woff
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 364c1179390530ea06c6636e2f314aa1091d460c4c6e369c6689a0fe31672054

Request headers

Origin: https://www.intego.com
Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
cf-cache-status: HIT
age: 675
status: 200
content-length: 40116
cf-request-id: 05677abf4d00001f554835b200000001
last-modified: Thu, 24 Sep 2020 17:55:33 GMT
server: cloudflare
etag: "5f6cdd95-9cb4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
cache-control: max-age=86400
accept-ranges: bytes
cf-ray: 5d85c712188a1f55-FRA
expires: Sat, 26 Sep 2020 15:15:36 GMT

GET
H2 200 fontawesome-webfont.woff
netdna.bootstrapcdn.com/font-awesome/3.1.1/font/ 34 KB
34 KB 27ms
9ms Font
font/woff 2001:4de0:ac19::1:b:1b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://netdna.bootstrapcdn.com/font-awesome/3.1.1/font/fontawesome-webfont.woff?v=3.1.0

Requested by

Host: netdna.bootstrapcdn.com
URL: https://netdna.bootstrapcdn.com/font-awesome/3.1.1/css/font-awesome.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

4e58b78b5844a988d67532b4683a6e8b3235b3d56d319727e65f460805bbdec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.intego.com
Referer: https://netdna.bootstrapcdn.com/font-awesome/3.1.1/css/font-awesome.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Dec 2018 18:35:43 GMT
status: 200
etag: "1544639743"
vary: Accept-Encoding
x-cache: HIT
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 34418

GET
H2 200 DagnyWebPro-Bold.woff
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/ 40 KB
40 KB 26ms
24ms Font
font/woff 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/DagnyWebPro-Bold.woff
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 142bb04454d6124c28f12d43249615ae8903c9742ea86c024ef0602f4dd1446e

Request headers

Origin: https://www.intego.com
Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
cf-cache-status: HIT
age: 675
status: 200
content-length: 40940
cf-request-id: 05677abf4d00001f554835c200000001
last-modified: Thu, 24 Sep 2020 17:55:33 GMT
server: cloudflare
etag: "5f6cdd95-9fec"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
cache-control: max-age=86400
accept-ranges: bytes
cf-ray: 5d85c712188d1f55-FRA
expires: Sat, 26 Sep 2020 15:15:00 GMT

GET
H2 200 DagnyWebPro-BoldItalic.woff
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/ 40 KB
40 KB 715ms
713ms Font
font/woff 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/DagnyWebPro-BoldItalic.woff
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e48d539ca17fdd4a1ea4d56c769df1b9469535132e9cc45d187e8cf4560ab57d

Request headers

Origin: https://www.intego.com
Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
cf-cache-status: EXPIRED
status: 200
content-length: 41232
cf-request-id: 05677abf4d00001f554835d200000001
last-modified: Thu, 24 Sep 2020 17:55:33 GMT
server: cloudflare
etag: "5f6cdd95-a110"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
cache-control: max-age=86400
accept-ranges: bytes
cf-ray: 5d85c71218911f55-FRA
expires: Sat, 26 Sep 2020 15:08:46 GMT

GET
H2 200 DagnyWebPro-Thin.woff
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/ 38 KB
38 KB 18ms
17ms Font
font/woff 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/webfonts/DagnyWebPro-Thin.woff
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 593b81ecc28e013924cc0bd0b78a6a990c0e01ffbf31ef576d5f6086829ab9a0

Request headers

Origin: https://www.intego.com
Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
cf-cache-status: HIT
age: 675
status: 200
content-length: 38836
cf-request-id: 05677abf4d00001f554835e200000001
last-modified: Thu, 24 Sep 2020 17:55:33 GMT
server: cloudflare
etag: "5f6cdd95-97b4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
cache-control: max-age=86400
accept-ranges: bytes
cf-ray: 5d85c71218931f55-FRA
expires: Sat, 26 Sep 2020 15:10:49 GMT

GET
H/1.1 200
OK GegHgcrH+8gxBbG1E
fireside.fm/player/v2/ Frame 3BF1 0
0 655ms
163ms Document
text/html 96.126.99.139
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://fireside.fm/player/v2/GegHgcrH+8gxBbG1E?theme=dark

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

96.126.99.139 Fremont, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

nb-96-126-99-139.fremont.nodebalancer.linode.com

Software

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: fireside.fm
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

Content-Type: text/html; charset=utf-8
Status: 200 OK
Surrogate-Control: max-age=2592000
Cache-Control: public, no-cache
Referrer-Policy: strict-origin-when-cross-origin
X-Permitted-Cross-Domain-Policies: none
X-XSS-Protection: 1; mode=block
X-Request-Id: 486c6705-7255-4291-a93d-9e2206b44de3
X-Download-Options: noopen
ETag: W/"fe4f2bd9504a6bf4d65566e4a6bd2c2f"
X-Runtime: 0.018293
X-Content-Type-Options: nosniff nosniff
Date: Fri, 25 Sep 2020 15:18:47 GMT
X-Backend-Server: web01.fireside.fm
Content-Encoding: gzip
X-Url: /player/v2/GegHgcrH+8gxBbG1E?theme=dark
X-Host: fireside.fm
X-Server: cache01.fireside.fm
Vary: Accept-Encoding
Age: 607
Accept-Ranges: bytes
Content-Length: 6662
Connection: close

GET
H2 200 nCVaZVfnkTY
www.youtube-nocookie.com/embed/ Frame 8324 0
0 106ms
103ms Document
text/html 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube-nocookie.com/embed/nCVaZVfnkTY?&list=PLL1eIqHwwN-MY4WwZvjNYcqo02CbtoB7J&autohide=2&color=red&controls=1&disablekb=0&fs=1&iv_load_policy=1&modestbranding=0&rel=0&showinfo=0&theme=dark&vq=default&enablejsapi=1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube-nocookie.com
:scheme: https
:path: /embed/nCVaZVfnkTY?&list=PLL1eIqHwwN-MY4WwZvjNYcqo02CbtoB7J&autohide=2&color=red&controls=1&disablekb=0&fs=1&iv_load_policy=1&modestbranding=0&rel=0&showinfo=0&theme=dark&vq=default&enablejsapi=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

status: 200
content-length: 10720
x-content-type-options: nosniff
expires: Tue, 27 Apr 1971 19:44:06 GMT
content-encoding: br
cache-control: no-cache
content-type: text/html; charset=utf-8
strict-transport-security: max-age=31536000
date: Fri, 25 Sep 2020 15:28:54 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 sidebar_divider.jpg
www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/ 154 B
375 B 16ms
15ms Image
image/webp 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/images/sidebar_divider.jpg
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 25b786ec50525130cddd67183bc696608e1fc88651fe5d1d953667e9f4643c4d

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
cf-cache-status: HIT
age: 2999
cf-polished: qual=85, origFmt=jpeg, origSize=1779
status: 200
content-disposition: inline; filename="sidebar_divider.webp"
content-length: 154
cf-request-id: 05677abfdd00001f5548367200000001
last-modified: Mon, 06 Jul 2020 16:18:20 GMT
server: cloudflare
etag: "5f034ecc-6f3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5d85c712fa991f55-FRA
cf-bgj: imgq:85,h2pri

GET
DATA 200
OK truncated
/ 529 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8ecf7fe958f132008eb2eaeda1a079451a62372838a6c18d9e1353f64e48172a

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 558 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 93b94b74b73c37bcb3e6d8cada57b5ce45d7bd3fe5e3b2b6194a702d1353e1a0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 978 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 62d2cc93ab8f52afb7379b9fabdc6f383f7700367cda04191ad1a8158c449c23

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 746 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 114773206c8b1ef17f1865f1fd0acb5ee36aa4f666718144698063fd295a0f65

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 124d5d7d1a1e13e129ad8ffbba218f6fd857f706d9af89d05d2686a0627ce127

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 13 KB
13 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:81b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:200,400,700,200italic,400italic,700italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

487f2e9da2ff0740755a5ef01dc15a2888b89537795895203a831b13b199d8bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.intego.com
Referer: https://fonts.googleapis.com/css?family=Source+Sans+Pro:200,400,700,200italic,400italic,700italic
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 18:27:27 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:11 GMT
server: sffe
age: 248487
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12976
x-xss-protection: 0
expires: Wed, 22 Sep 2021 18:27:27 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 13 KB
13 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:81b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:200,400,700,200italic,400italic,700italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ecf76895be1cf9e8b3edb254030e9c9c1d8f3c2efc1f9dc7e04ceff29eccae9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.intego.com
Referer: https://fonts.googleapis.com/css?family=Source+Sans+Pro:200,400,700,200italic,400italic,700italic
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 18:24:39 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:14 GMT
server: sffe
age: 248655
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13324
x-xss-protection: 0
expires: Wed, 22 Sep 2021 18:24:39 GMT

GET
H2 400 / Show response
graph.facebook.com/ 202 B
584 B 42ms
28ms XHR
application/json 2a03:2880:f02d:e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?id=https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

97c98ef860853178938e7fae214a3f6cbc485d16452c45ea3e13190094714931

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
www-authenticate: OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
status: 400
x-fb-rev: 1002724411
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 151
pragma: no-cache
x-fb-debug: jphba6knKscZN7a5KpBhEsiRMeOJpWOSZeurhIOJ9qPb08QW8pAfvuB4G7NszfjbQ+N2gfLhYY+4VrHhFqm0NA==
x-fb-trace-id: BOE3gmP6A9X
date: Fri, 25 Sep 2020 15:28:54 GMT
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-fb-request-id: A_N_a1nhtxrHvWEGnkU6qKa
cache-control: no-store
facebook-api-version: v3.1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 404 share
www.linkedin.com/countserv/count/ 0
0 166ms
150ms Script
text/html 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.linkedin.com/countserv/count/share?url=https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/&callback=jQuery11240935994275182636_1601047734029&_=1601047734030
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 count.json Show response
widgets.pinterest.com/v1/urls/ 153 B
364 B 150ms
117ms Script
application/javascript 151.101.36.84
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://widgets.pinterest.com/v1/urls/count.json?source=6&url=https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/&callback=jQuery11240935994275182636_1601047734031&_=1601047734032

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.36.84 Amsterdam, Netherlands, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

b276d76730453e9410755998a27c1bee3ecdb7086fe81a5d1ab4f06872e7415c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 0
status: 200
vary: accept-encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: must-revalidate, max-age=887
x-envoy-upstream-service-time: 1
accept-ranges: none
x-pinterest-rid: 0791772895456992
expires: Fri, 25 Sep 2020 15:43:54 GMT

GET
H/1.1 200
OK count.js Show response
macsecurityblog.disqus.com/ 1 KB
1 KB 34ms
9ms Script
application/javascript 199.232.196.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://macsecurityblog.disqus.com/count.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.17

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.196.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 15:28:54 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Age: 1014295
P3P: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 871
X-XSS-Protection: 1; mode=block
Last-Modified: Mon, 24 Aug 2020 22:36:24 GMT
Server: nginx
ETag: "5f4440e8-367"
Strict-Transport-Security: max-age=300; includeSubdomains
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=300
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect

GET
H/1.1 200
OK embed.js Show response
macsecurityblog.disqus.com/ 71 KB
23 KB 43ms
8ms Script
application/javascript 199.232.196.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://macsecurityblog.disqus.com/embed.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.17

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.196.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

553bc017c2f271f2d74ccc48497c9a1fbc54d3bb0d6fc206efce608ea8a8e4e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 15:28:54 GMT
Content-Encoding: gzip
Server: openresty
Age: 88
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Cache-Control: private, max-age=60
X-Service: router
Strict-Transport-Security: max-age=300; includeSubdomains
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 23081

GET
H2 200 www-widgetapi.js Show response
s.ytimg.com/yts/jsbin/www-widgetapi-vfllbqYNH/ 94 KB
34 KB 28ms
6ms Script
text/javascript 2a00:1450:4001:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s.ytimg.com/yts/jsbin/www-widgetapi-vfllbqYNH/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api?ver=5.4.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c91a37f448e0d90f9079566ec4114aac6a37bb32ff0fc1c28d47c6b31646d87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 21:01:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 66457
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34491
x-xss-protection: 0
last-modified: Thu, 24 Sep 2020 19:01:52 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=691200
accept-ranges: bytes
timing-allow-origin: https://www.youtube.com
expires: Fri, 02 Oct 2020 21:01:17 GMT

GET
H3-Q050 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.rMJI4WR09CY.O/m=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCPRb_B1g8z3qIwl7l27GWLe47nxIA/ 113 KB
40 KB 34ms
20ms Script
text/javascript 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.rMJI4WR09CY.O/m=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCPRb_B1g8z3qIwl7l27GWLe47nxIA/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/platform.js?ver=5.4.2

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e098e7520dbccfe6cdaa96ce30b3245894b060fdc2d31145e870c81432cff684

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 23 Sep 2020 19:46:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 08 Sep 2020 19:28:50 GMT
server: sffe
age: 157336
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41075
x-xss-protection: 0
expires: Thu, 23 Sep 2021 19:46:38 GMT

GET
H3-Q050 200 cb=gapi.loaded_1 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.rMJI4WR09CY.O/m=auth/exm=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCPRb_B1g8z3qIwl7l27GWLe47nxIA/ 119 KB
41 KB 26ms
14ms Script
text/javascript 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.rMJI4WR09CY.O/m=auth/exm=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCPRb_B1g8z3qIwl7l27GWLe47nxIA/cb=gapi.loaded_1

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/platform.js?ver=5.4.2

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89cb81b15741129a01edcb8665b1f6172e270197a1335e9f0db3558e6c338a60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 23 Sep 2020 19:46:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 08 Sep 2020 19:28:50 GMT
server: sffe
age: 157336
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41260
x-xss-protection: 0
expires: Thu, 23 Sep 2021 19:46:38 GMT

GET
H3-Q050 200 subscribe_embed
www.youtube.com/ Frame F50B 0
0 80ms
66ms Document
text/html 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/subscribe_embed?usegapi=1&channel=IntegoVideo&layout=default&count=default&theme=default&origin=https%3A%2F%2Fwww.intego.com&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.rMJI4WR09CY.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCPRb_B1g8z3qIwl7l27GWLe47nxIA%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/platform.js?ver=5.4.2

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /subscribe_embed?usegapi=1&channel=IntegoVideo&layout=default&count=default&theme=default&origin=https%3A%2F%2Fwww.intego.com&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.rMJI4WR09CY.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCPRb_B1g8z3qIwl7l27GWLe47nxIA%2Fm%3D__features__
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: VISITOR_INFO1_LIVE=YqGqTd8tIJE; YSC=vu3jy2D4zwg
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache
x-content-type-options: nosniff
expires: Tue, 27 Apr 1971 19:44:06 GMT
content-encoding: br
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
content-length: 1632
strict-transport-security: max-age=31536000
date: Fri, 25 Sep 2020 15:28:54 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: GPS=1; path=/; domain=.youtube.com; expires=Fri, 25-Sep-2020 15:58:54 GMT
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 91ms
37ms Script
application/x-javascript 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: FBAF69B7861DE212
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=62606
accept-ranges: bytes
content-length: 948
x-amz-id-2: mINJDBnKUfP83RzDJ6hQaYSGPvMPOM770jd+gXVSD8LFScfPdVPaVzI4W2IwmrtEKhDna93Nv9A=

GET
H2 200 overlay-virus-dude.png
www.intego.com/sites/all/themes/ubertheme/images/bundles/ 6 KB
7 KB 582ms
580ms Image
image/webp 2606:4700::6812:d77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.intego.com/sites/all/themes/ubertheme/images/bundles/overlay-virus-dude.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:d77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

033cde881de209390d39c3f291aa9cc39c412c29fd794af7277830b34da8785a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/wp-content/themes/starkers-html5-master/css/layout.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-varnish-cache: HIT
date: Fri, 25 Sep 2020 15:28:54 GMT
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
cf-polished: origFmt=png, origSize=11045
status: 200
content-disposition: inline; filename="overlay-virus-dude.webp"
content-length: 6504
cf-request-id: 05677ac06a00001f554836f200000001
last-modified: Thu, 24 Sep 2020 15:06:21 GMT
server: cloudflare
etag: "e58d48-2b25-5b0108af79540"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
expires: Sat, 24 Oct 2020 15:19:13 GMT
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 5d85c713dca11f55-FRA
cf-bgj: imgq:85,h2pri

GET
H3-Q050 200 iframe_api Show response
www.youtube.com/ 859 B
899 B 29ms
28ms Script
application/javascript 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

bb419846a6c750ceac7e697b479216945b7597dea49905e30d1fc040a3194099

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:28:54 GMT
x-content-type-options: nosniff
server: YouTube Frontend Proxy
content-type: application/javascript
status: 200
cache-control: no-cache
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Tue, 27 Apr 1971 19:44:06 GMT

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/ra-569401e58e179871/ 771 B
520 B 268ms
266ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/ra-569401e58e179871/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 301bec0edd5575e96ea21fd09c50c5964ee72d565a65fd7d8db6020d64c05cd3

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: gzip
etag: 749965747--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
cache-control: public, max-age=60, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 344

GET
H2 200 300lo.json Show response
m.addthis.com/live/red_lojson/ 90 B
250 B 161ms
158ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://m.addthis.com/live/red_lojson/300lo.json?si=5f6e0cb61da26e9b&bkl=0&bl=0&pdt=61&sid=5f6e0cb61da26e9b&pub=ra-569401e58e179871&rev=v8.28.7-wp&ln=en&pc=men&cb=0&ab=-&dp=www.intego.com&fp=mac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=0&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&colc=1601047734386&jsl=1&skipb=1&callback=addthis.cbs.jsonp__456398942999332260
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: c5a0115d79473f700ee7bc30ee32c82dadf75f0fb2d8313f2d6d77e38bb9edca

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Fri, 25 Sep 2020 15:28:54 GMT
cache-control: max-age=0, no-cache, no-store, no-transform
content-disposition: attachment; filename=1.txt
content-length: 90
content-type: application/javascript;charset=utf-8

GET sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 2A4F 0
0

GET
H2 200 sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame C848 0
0 49ms
48ms Document
text/html 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:method: GET
:authority: s7.addthis.com
:scheme: https
:path: /static/sh.f48a1a04fe8dbf021b4cda1d.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

status: 200
server: nginx/1.15.8
content-type: text/html
last-modified: Mon, 09 Sep 2019 15:34:57 GMT
etag: W/"5d767121-1115f"
timing-allow-origin: *
cache-control: public, max-age=86313600
p3p: CP="NON ADM OUR DEV IND COM STA"
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
content-length: 25412
date: Fri, 25 Sep 2020 15:28:54 GMT
vary: Accept-Encoding
x-host: s7.addthis.com

GET
H2 200 1f641.svg
s.w.org/images/core/emoji/12.0.0-1/svg/ 512 B
514 B 48ms
7ms Image
image/svg+xml 192.0.77.48
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/12.0.0-1/svg/1f641.svg

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

87bcc22d43cfa00bd1cf5e3a35aad79150b4ce804899db3ea93efe57eeb6dbf7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 1
date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 08 Apr 2019 05:13:21 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1f643.svg
s.w.org/images/core/emoji/12.0.0-1/svg/ 538 B
368 B 48ms
7ms Image
image/svg+xml 192.0.77.48
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/12.0.0-1/svg/1f643.svg

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

61043862bfca6af330c3434cbf67360d72e2b11192f86b69321fe68f216c70f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 1
date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 06 Nov 2019 15:22:34 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1f514.svg
s.w.org/images/core/emoji/12.0.0-1/svg/ 314 B
353 B 48ms
8ms Image
image/svg+xml 192.0.77.48
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/12.0.0-1/svg/1f514.svg

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

5f70fb8150f0a1f184b40f86d012db040d229056b9b0d8c681f08987cb124e5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT fra 1
date: Fri, 25 Sep 2020 15:28:54 GMT
x-content-type-options: nosniff
last-modified: Mon, 08 Apr 2019 05:13:21 GMT
server: nginx
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 314
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 201 KB
61 KB 42ms
7ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=4dbdfce6c3edf8c2d6f5568db1643bc3&ua=modern_es6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

a374e4a800bf1c52c2f548b954aca207cd7424b16fd3ab37493e57de0351ee08

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Origin: https://www.intego.com
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: sIm3kX8taen9Tp7TYie8Gg==
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 62354
etag: "a9f8328cc12f976a5af4422b7b25e24d"
x-fb-debug: hHY3pt/JTj4p7Hz+YRlIqGyqXwfYnZ+b3HTihsDx87B8MTrUwv1mkiMHJykBgvtVco3z/BMDZVtMtXT56yGK3w==
x-fb-trip-id: 1460883810
x-fb-content-md5: 46aea296a97517c482e7249960e77173
x-frame-options: DENY
date: Fri, 25 Sep 2020 15:28:54 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
expires: Sat, 25 Sep 2021 14:24:40 GMT

GET
H/1.1 200
OK widget_iframe.2d7d9a6d04538bf11c7b23641e75738c.html
platform.twitter.com/widgets/ Frame 80B1 0
0 8ms
7ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2d7d9a6d04538bf11c7b23641e75738c.html?origin=https%3A%2F%2Fwww.intego.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/4187) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 840521
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Fri, 25 Sep 2020 15:28:54 GMT
Etag: "9fa476ae827f556d5b037fe43632370d+gzip"
Last-Modified: Tue, 01 Sep 2020 17:58:17 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/4187)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 5825

GET
H2 200 g.gif
pixel.wp.com/ 50 B
92 B 17ms
8ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A8.6.1&blog=72832157&post=92058&tz=-7&srv=www.intego.com&host=www.intego.com&ref=&fcp=220&rand=0.8759761253550642
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Fri, 25 Sep 2020 15:28:54 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 29 KB
12 KB 56ms
17ms Script
text/javascript 172.217.16.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-9WJ8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

6c9459a6400a8cf7ef815379f9316dc26aeec43bcc48da1d1bd58d99a6109f7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 11311
x-xss-protection: 0
server: cafe
etag: 12833363978352728442
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 25 Sep 2020 15:28:54 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 13ms
5ms Script
text/javascript 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-9WJ8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 794
date: Fri, 25 Sep 2020 15:15:40 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Fri, 25 Sep 2020 17:15:40 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 26 KB
8 KB 55ms
28ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 5c622f5433cbb6ea1df5c0dd8671e55ef7d1464366074730473c453de50a579b

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:28:53 GMT
content-encoding: gzip
last-modified: Thu, 16 Jul 2020 20:00:00 GMT
x-msedge-ref: Ref A: A5370AD43BD74D8C8051304B4DA9B822 Ref B: FRAEDGE1416 Ref C: 2020-09-25T15:28:54Z
status: 200
etag: "0e0bdafab5bd61:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 8022

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 135 KB
34 KB 13ms
9ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

097afea517679d2e0b986d77cb3fe7808026882b52ca074a050e03e7a4a6996b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 34302
x-xss-protection: 0
pragma: public
x-fb-debug: X/TSRvk4UNqKMN+7ZJ3R5Nvj63XNuC+O67gYdUHsq27zB+pvp+9RViFUVZmjed6E+o98bLzniLx4q435ONoFPQ==
x-fb-trip-id: 1460883810
x-frame-options: DENY
date: Fri, 25 Sep 2020 15:28:54 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 aquant.js Show response
secure.quantserve.com/ 22 KB
8 KB 35ms
7ms Script
application/javascript 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/aquant.js?a=p-NVNd7-g373ynZ
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 403bfa21e733c139da9d7d87c48fa0ebbed91514fbbadf34cbc455294a004389

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: gzip
etag: "M/QWkfLVS4vR+GrkCudkBg=="
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Fri, 02 Oct 2020 15:28:54 GMT

GET
H2 200 conversion.js Show response
s.yimg.jp/images/listing/tool/cv/ 6 KB
3 KB 1246ms
254ms Script
application/javascript 183.79.249.252
YAHOO-JP-AS-AP Ya...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.yimg.jp/images/listing/tool/cv/conversion.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-9WJ8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 183.79.249.252 , Japan, ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP),
Reverse DNS
Software: ATS /
Resource Hash: 593718d567cc4d6767d63be77ac6505dedee76cc656526945c90f9e1869cbc53

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Fri, 25 Sep 2020 15:27:38 GMT
content-encoding: gzip
last-modified: Sun, 19 Jul 2020 22:59:48 GMT
server: ATS
age: 77
vary: Accept-Encoding
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
status: 200
cache-control: public, max-age=600
accept-ranges: bytes
content-type: application/javascript
content-length: 2041
via: http/1.1 edge2344.img.umd.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge2367.img.umd.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge2380.img.umd.yahoo.co.jp (ApacheTrafficServer [cRs f ])
expires: Fri, 25 Sep 2020 15:37:38 GMT

GET
H/1.1 200
OK button.e24f3bcdec527b80b9c80e88b62047c3.js Show response
platform.twitter.com/js/ 7 KB
3 KB 7ms
7ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.e24f3bcdec527b80b9c80e88b62047c3.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/4194) /
Resource Hash: da3e524928bcca821af2551eb6f9e9ae2449ceb48642cce4f2dae23383098537

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 15:28:54 GMT
Content-Encoding: gzip
Last-Modified: Tue, 01 Sep 2020 17:58:08 GMT
Server: ECS (fcn/4194)
Age: 840520
Etag: "2288bbd5e30b6dba457d3d615de9e136+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 2295

GET
H/1.1 200
OK horizon_tweet.890a062bcacdb49527deac08bf9879da.js Show response
platform.twitter.com/js/ 6 KB
3 KB 18ms
7ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/horizon_tweet.890a062bcacdb49527deac08bf9879da.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/40F9) /
Resource Hash: 23b775e4e3b5b93742dad8a1bbfacb2ffc3271a15dbfc6d3ded21d713f2c3489

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 15:28:54 GMT
Content-Encoding: gzip
Last-Modified: Tue, 01 Sep 2020 17:58:08 GMT
Server: ECS (fcn/40F9)
Age: 840521
Etag: "8069bf9882ddc98f8144708faf345f30+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 2197

GET
H2 200 FollowCompany.js Show response
www.linkedin.com/pages-extensions/ 1 KB
2 KB 161ms
161ms Script
application/javascript 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.linkedin.com/pages-extensions/FollowCompany.js?version=0.1.149

Requested by

Host: platform.linkedin.com
URL: https://platform.linkedin.com/in.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

275fb4a7bdeab3c59caff1c0ea88bf1adc9f4cfc377a9bec7b28517d13e2fd37

Security Headers

Name	Value
Content-Security-Policy	default-src ; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://.linkedin.com dms.licdn.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: ; font-src data: ; child-src blob: ; style-src 'unsafe-inline' 'self' static-src.linkedin.com .licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com .ads.linkedin.com .licdn.com www.google-analytics.com platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; report-uri https://www.linkedin.com/platform-telemetry/csp?f=nf
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; child-src blob: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com www.google-analytics.com platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; report-uri https://www.linkedin.com/platform-telemetry/csp?f=nf
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'none'; connect-src 'self' www.linkedin.com www.google-analytics.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://linkedin.sc.omtrdc.net/b/ss/ static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; script-src 'sha256-THuVhwbXPeTR0HszASqMOnIyxqEgvGyBwSPBKBF/iMc=' 'sha256-PyCXNcEkzRWqbiNr087fizmiBBrq9O6GGD8eV3P09Ik=' 'sha256-2SQ55Erm3CPCb+k03EpNxU9bdV3XL9TnVTriDs7INZ4=' 'sha256-S/KSPe186K/1B0JEjbIXcCdpB97krdzX05S+dHnQjUs=' platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'self' 'unsafe-inline' static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; media-src dms.licdn.com; child-src blob: *; frame-src 'self' lnkd.demdex.net linkedin.cdn.qualaroo.com; manifest-src 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=g
status: 200
vary: Accept-Encoding
content-length: 487
x-li-uuid: mLbalG4QOBZAUs3kVisAAA==
pragma: no-cache
last-modified: Fri, 01 Feb 1980 00:00:00 GMT
x-li-pop: afd-prod-eda6
x-msedge-ref: Ref A: 40C140192B634E50B7FBFEFB925D34D7 Ref B: FRAEDGE0815 Ref C: 2020-09-25T15:28:54Z
date: Fri, 25 Sep 2020 15:28:53 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
content-type: application/javascript; charset=utf-8
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
etag: "ce6775888bcf61cf400dfa93a41e084bf5560553"
accept-ranges: bytes
x-li-proto: http/2
x-li-fabric: prod-ltx1
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 lounge.6525595c7a9874fa10bd041275e40f17.css
c.disquscdn.com/next/embed/styles/ 0
22 KB 49ms
32ms Other
text/css 2606:4700::6812:a913
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.6525595c7a9874fa10bd041275e40f17.css

Requested by

Host: macsecurityblog.disqus.com
URL: https://macsecurityblog.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a913 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5693249
status: 200
strict-transport-security: max-age=300; includeSubdomains
content-length: 22092
x-xss-protection: 1; mode=block
timing-allow-origin: *
last-modified: Mon, 20 Jul 2020 23:36:39 GMT
server: cloudflare
etag: "5f162a87-564c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
cf-request-id: 05677ac15c0000d6c9a788a200000001
accept-ranges: bytes
cf-ray: 5d85c7156a75d6c9-FRA
expires: Wed, 21 Jul 2021 18:01:24 GMT

GET
H2 200 common.bundle.e07f4f02bedd02259fb3f3e092970560.js
c.disquscdn.com/next/embed/ 0
88 KB 55ms
38ms Other
application/javascript 2606:4700::6812:a913
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.e07f4f02bedd02259fb3f3e092970560.js

Requested by

Host: macsecurityblog.disqus.com
URL: https://macsecurityblog.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a913 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2286516
status: 200
strict-transport-security: max-age=300; includeSubdomains
content-length: 89940
x-xss-protection: 1; mode=block
timing-allow-origin: *
last-modified: Sun, 30 Aug 2020 04:13:44 GMT
server: cloudflare
etag: "5f4b2778-15f54"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
cf-request-id: 05677ac15d0000d6c9a788b200000001
accept-ranges: bytes
cf-ray: 5d85c7156a76d6c9-FRA
expires: Mon, 30 Aug 2021 04:20:17 GMT

GET
H2 200 lounge.bundle.fce6c302b518ce1fcbc2efc174b77740.js
c.disquscdn.com/next/embed/ 0
113 KB 50ms
32ms Other
application/javascript 2606:4700::6812:a913
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.fce6c302b518ce1fcbc2efc174b77740.js

Requested by

Host: macsecurityblog.disqus.com
URL: https://macsecurityblog.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:a913 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 234825
status: 200
strict-transport-security: max-age=300; includeSubdomains
content-length: 115595
x-xss-protection: 1; mode=block
timing-allow-origin: *
last-modified: Tue, 22 Sep 2020 19:35:14 GMT
server: cloudflare
etag: "5f6a51f2-1c38b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public, immutable, no-transform
cf-request-id: 05677ac15d0000d6c9a788c200000001
accept-ranges: bytes
cf-ray: 5d85c7156a77d6c9-FRA
expires: Wed, 22 Sep 2021 22:15:04 GMT

GET
H/1.1 200
OK config.js
disqus.com/next/ 0
8 KB 27ms
8ms Other
application/javascript 151.101.64.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: macsecurityblog.disqus.com
URL: https://macsecurityblog.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.64.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 15:28:54 GMT
X-Content-Type-Options: nosniff
Content-Type: application/javascript; charset=UTF-8
Server: nginx
Age: 53
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 7253
X-XSS-Protection: 1; mode=block

GET
H2 200 postmessageRelay
accounts.google.com/o/oauth2/ Frame 4687 0
0 64ms
39ms Document
text/html 2a00:1450:4001:821::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.intego.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.rMJI4WR09CY.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCPRb_B1g8z3qIwl7l27GWLe47nxIA%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.rMJI4WR09CY.O/m=auth/exm=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCPRb_B1g8z3qIwl7l27GWLe47nxIA/cb=gapi.loaded_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-SGD9zuMT6I/qiZiZg5Dkmg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Xss-Protection	0

Request headers

:method: GET
:authority: accounts.google.com
:scheme: https
:path: /o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.intego.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.rMJI4WR09CY.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCPRb_B1g8z3qIwl7l27GWLe47nxIA%2Fm%3D__features__
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: NID=204=sBnYeTs8zi-0A30VQ3MTzA211Yy7LhCR5MEjJL6OGECHuk0TblbbN0ak_da7xZ80eu2qUi5QoinaUqB-YFhihCMaMupM-aD6Pte3p2L3-sesThIyqHJepkA_3eBskZFUDPq0XCM8MXTa0TQ44oChYAPzbibR2KCjUMBXCY6HGYA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 25 Sep 2020 15:28:54 GMT
content-security-policy: script-src 'report-sample' 'nonce-SGD9zuMT6I/qiZiZg5Dkmg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
content-encoding: gzip
server: ESF
x-xss-protection: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 ec.js Show response
www.google-analytics.com/plugins/ua/ 3 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ec.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 14:55:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 1989
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1306
x-xss-protection: 0
expires: Fri, 25 Sep 2020 15:55:45 GMT

GET
H2 200 1722534091368523 Show response
connect.facebook.net/signals/config/ 524 KB
133 KB 95ms
94ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1722534091368523?v=2.9.24&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3eab02e002142b491bfeaaea2ee12490872bc5429dfb0889914660c783194563

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: chbhMxIBqGCc9dr/18UUiZMOIeQMwDkArRb4GzcISza4V3BhyMfbY5R5ioSsymIcSrPcXg4Ki1Lcy03rK0HxlA==
x-fb-trip-id: 1460883810
x-frame-options: DENY
date: Fri, 25 Sep 2020 15:28:54 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 rules-p-NVNd7-g373ynZ.js Show response
rules.quantcount.com/ 728 B
1 KB 74ms
21ms Script
application/x-javascript 2600:9000:206e:5200:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-NVNd7-g373ynZ.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/aquant.js?a=p-NVNd7-g373ynZ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:5200:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c73d6c78c4bb48a6815c7ddd5bc944b047754369d4043ccb6ab2fde88f42add4

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:01:27 GMT
via: 1.1 9c157874a076ffdde5f5a44c4371f3a1.cloudfront.net (CloudFront)
last-modified: Mon, 10 Apr 2017 23:48:01 GMT
server: AmazonS3
age: 1648
etag: "51657b8ebdb4c9107bbbc84946bfb9b5"
x-cache: Hit from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
content-length: 728
x-amz-cf-id: jufqNIigKV593wnyJqsiAvhCuNQQeNJmnaUlpaYNys7vpM8kdZRCYQ==

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1060047950/ 2 KB
2 KB 38ms
18ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1060047950/?random=1601047734766&cv=9&fst=1601047734766&num=1&label=6cqzCOKomwIQzpi8-QM&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&tiba=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1053b55a87f15cde8d4a66809aa85e4acb9df38e50d85f8d7b03354eb0fb0013

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 15:28:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1123
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
147 B 29ms
28ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=4033358&Ver=2&mid=3e4ddb11-7e8c-bd40-bfa7-a52242426fb2&sid=941dc30f03ac334293408f927581b96b&vid=a2f54f9461891a4ef42fdc2673592b64&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Mac%20malware%20exposed%3A%20XCSSET,%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog&p=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&r=&lt=548&evt=pageLoad&msclkid=N&sv=1&rn=934639
Requested by: Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Fri, 25 Sep 2020 15:28:53 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: B4C5316A230646EFA123E90A34451415 Ref B: FRAEDGE1416 Ref C: 2020-09-25T15:28:54Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 layers.33f5b85045a5f2308467.js Show response
s7.addthis.com/static/ 263 KB
76 KB 23ms
23ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.33f5b85045a5f2308467.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

137e41c449677deb7c8da3afde63fc781b095bb028f78b789be44192e8e3f4be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
server: nginx/1.15.8
etag: W/"5ed917ff-41b9f"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86313600
date: Fri, 25 Sep 2020 15:28:54 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77540

GET
H/1.1 200
OK follow_button.2d7d9a6d04538bf11c7b23641e75738c.en.html
platform.twitter.com/widgets/ Frame 7891 0
0 7ms
6ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/follow_button.2d7d9a6d04538bf11c7b23641e75738c.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/4194) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 840510
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Fri, 25 Sep 2020 15:28:54 GMT
Etag: "ddc15fa67e38644c860f8d9dba000a69+gzip"
Last-Modified: Tue, 01 Sep 2020 17:58:09 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/4194)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 13677

GET
H/1.1 200
OK index.html
platform.twitter.com/embed/ Frame E6F7 0
0 7ms
7ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/index.html?dnt=true&embedId=twitter-widget-1&frame=false&hideCard=false&hideThread=false&id=1282860187397746689&lang=en&origin=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&theme=light&widgetsVersion=219d021%3A1598982042171&width=500px
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/40FC) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 220
Cache-Control: public, max-age=1800
Content-Type: text/html; charset=utf-8
Date: Fri, 25 Sep 2020 15:28:54 GMT
Etag: "462a23b15781d788fb9d65f4cb1fe44d"
Last-Modified: Wed, 09 Sep 2020 20:24:51 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/40FC)
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 577

GET
H3-Q050 200 cb=gapi.loaded_2 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.rMJI4WR09CY.O/m=gapi_iframes_style_bubble/exm=auth,ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCPRb_B1g8z3qIwl7l27GWLe47nxIA/ 27 KB
9 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.rMJI4WR09CY.O/m=gapi_iframes_style_bubble/exm=auth,ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCPRb_B1g8z3qIwl7l27GWLe47nxIA/cb=gapi.loaded_2

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/platform.js?ver=5.4.2

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca5398fb76a3d11f43a00312ca1f4a0b11cc37d1925d82bcc80c906ffc956ff2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 23 Sep 2020 19:46:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 08 Sep 2020 19:28:50 GMT
server: sffe
age: 157332
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9254
x-xss-protection: 0
expires: Thu, 23 Sep 2021 19:46:42 GMT

GET
H/1.1 200
OK /
disqus.com/embed/comments/ Frame 3AA4 0
0 158ms
156ms Document
text/html 151.101.64.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/embed/comments/?base=default&f=macsecurityblog&t_i=92058%20https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2F%3Fp%3D92058&t_u=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&t_e=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat&t_d=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog&t_t=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat&s_o=default

Requested by

Host: macsecurityblog.disqus.com
URL: https://macsecurityblog.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.64.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: disqus.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

Connection: keep-alive
Content-Length: 2729
Server: nginx
Content-Type: text/html; charset=utf-8
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Last-Modified: Mon, 24 Aug 2020 21:03:33 GMT
ETag: W/"lounge:view:8177074350.c6b2bb256626c47047c035c0e8ec5d6f.2"
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control: stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Encoding: gzip
Date: Fri, 25 Sep 2020 15:28:54 GMT
Age: 0
Vary: Accept-Encoding
Strict-Transport-Security: max-age=300; includeSubdomains

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
88 B 16ms
13ms XHR
text/plain 2a00:1450:400c:c0c::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-1724183-7&cid=1253278347.1601047735&jid=822035850&gjid=1623473486&_gid=844463921.1601047735&_u=aGBAgAALCAAAAE~&z=1482621712

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Fri, 25 Sep 2020 15:28:54 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://www.intego.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
62 B 9ms
7ms Image
image/gif 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&a=1917638164&t=pageview&_s=1&dl=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&ul=en-us&de=UTF-8&dt=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAgAALC~&jid=822035850&gjid=1623473486&cid=1253278347.1601047735&tid=UA-1724183-7&_gid=844463921.1601047735&gtm=2wg9g19WJ8&cg3=&cd3=!!!!&z=1155531310

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 00:29:32 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 53962
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 subscribe_embed
www.youtube.com/ Frame 9D35 0
0 68ms
68ms Document
text/html 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/subscribe_embed?action_card=1&channelid=UCtFlc7zQcFj3C_62jVGfghA&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.rMJI4WR09CY.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCPRb_B1g8z3qIwl7l27GWLe47nxIA%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.rMJI4WR09CY.O/m=ytsubscribe/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCPRb_B1g8z3qIwl7l27GWLe47nxIA/cb=gapi.loaded_0

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /subscribe_embed?action_card=1&channelid=UCtFlc7zQcFj3C_62jVGfghA&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.rMJI4WR09CY.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCPRb_B1g8z3qIwl7l27GWLe47nxIA%2Fm%3D__features__
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: VISITOR_INFO1_LIVE=YqGqTd8tIJE; YSC=vu3jy2D4zwg
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

status: 200
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
strict-transport-security: max-age=31536000
content-encoding: br
content-type: text/html; charset=utf-8
x-content-type-options: nosniff
content-length: 326
cache-control: no-cache
expires: Tue, 27 Apr 1971 19:44:06 GMT
date: Fri, 25 Sep 2020 15:28:54 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: GPS=1; path=/; domain=.youtube.com; expires=Fri, 25-Sep-2020 15:58:54 GMT
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 border_3.gif
ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/ 43 B
65 B 69ms
55ms Image
image/gif 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/border_3.gif

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c8de81a1acb5f3788959ecc04eaa6526d5bdb29991157cecbef71042268c0374

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 09:06:25 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
age: 368549
content-type: image/gif
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
expires: Tue, 21 Sep 2021 09:06:25 GMT

GET
H3-Q050 200 spacer.gif
ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/ 43 B
397 B 27ms
13ms Image
image/gif 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/spacer.gif

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ed1b73c6b4690cde9b521865b58e031293209bc0b2ba2b5716ecf4bf9885ee4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 09:06:25 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
age: 368549
content-type: image/gif
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
expires: Tue, 21 Sep 2021 09:06:25 GMT

GET FollowCompany
www.linkedin.com/pages-extensions/ Frame 3D8A 0
0

GET
H2 200 FollowCompany
www.linkedin.com/pages-extensions/ Frame B1A5 0
0 221ms
211ms Document
text/html 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.linkedin.com/pages-extensions/FollowCompany?id=28855&counter=none&xdOrigin=https%3A%2F%2Fwww.intego.com&xdChannel=c23d1f17-9938-4b66-ba8e-2e048d9a94d8&xd_origin_host=https%3A%2F%2Fwww.intego.com

Requested by

Host: platform.linkedin.com
URL: https://platform.linkedin.com/in.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src ; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://.linkedin.com dms.licdn.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: ; font-src data: ; child-src blob: ; style-src 'unsafe-inline' 'self' static-src.linkedin.com .licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com .ads.linkedin.com .licdn.com www.google-analytics.com platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; report-uri https://www.linkedin.com/platform-telemetry/csp?f=nf
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.linkedin.com
:scheme: https
:path: /pages-extensions/FollowCompany?id=28855&counter=none&xdOrigin=https%3A%2F%2Fwww.intego.com&xdChannel=c23d1f17-9938-4b66-ba8e-2e048d9a94d8&xd_origin_host=https%3A%2F%2Fwww.intego.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: bcookie="v=2&dc5e78ed-25dc-4e3a-8f27-4922be23ed68"; bscookie="v=1&20200925152854d6cdae3a-e30b-404e-8d10-ba6c756c7308AQHoo994fVtOiJPNsb5hXm7mMpzjlAUk"; lissc=1; lidc="b=TGST06:g=1948:u=1:i=1601047734:t=1601134134:s=AQFP3M7WYHSgulTHTHTtlCzKI0EcoAZy"; lang=v=2&lang=en-us
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Response headers

status: 200
cache-control: no-cache, no-store
pragma: no-cache
content-length: 818
content-type: text/html
content-encoding: gzip
expires: Thu, 01 Jan 1970 00:00:00 GMT
vary: Accept-Encoding
set-cookie: JSESSIONID=ajax:9050358904435018677; SameSite=None; Path=/; Domain=.www.linkedin.com; Secure
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-xss-protection: 1; mode=block
content-security-policy-report-only: default-src 'none'; connect-src 'self' www.linkedin.com www.google-analytics.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://linkedin.sc.omtrdc.net/b/ss/ static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; script-src 'sha256-THuVhwbXPeTR0HszASqMOnIyxqEgvGyBwSPBKBF/iMc=' 'sha256-PyCXNcEkzRWqbiNr087fizmiBBrq9O6GGD8eV3P09Ik=' 'sha256-2SQ55Erm3CPCb+k03EpNxU9bdV3XL9TnVTriDs7INZ4=' 'sha256-S/KSPe186K/1B0JEjbIXcCdpB97krdzX05S+dHnQjUs=' platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'self' 'unsafe-inline' static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; media-src dms.licdn.com; child-src blob: *; frame-src 'self' lnkd.demdex.net linkedin.cdn.qualaroo.com; manifest-src 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=g
content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; child-src blob: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com www.google-analytics.com platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; report-uri https://www.linkedin.com/platform-telemetry/csp?f=nf
x-content-type-options: nosniff
strict-transport-security: max-age=2592000
x-li-fabric: prod-ltx1
x-li-pop: afd-prod-eda6
x-li-proto: http/2
x-li-uuid: mZWGq24QOBbw2QNuxSoAAA==
x-msedge-ref: Ref A: 787296D545314254834641302B838CFA Ref B: FRAEDGE0815 Ref C: 2020-09-25T15:28:54Z
date: Fri, 25 Sep 2020 15:28:54 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/1060047950/ 42 B
320 B 42ms
28ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1060047950/?random=1601047734766&cv=9&fst=1601046000000&num=1&label=6cqzCOKomwIQzpi8-QM&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&frm=0&url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&tiba=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog&async=1&fmt=3&is_vtc=1&random=13058389&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 15:28:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/1060047950/ 42 B
560 B 94ms
56ms Image
image/gif 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1060047950/?random=1601047734766&cv=9&fst=1601046000000&num=1&label=6cqzCOKomwIQzpi8-QM&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg9g1&sendb=1&frm=0&url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&tiba=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog&async=1&fmt=3&is_vtc=1&random=13058389&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 15:28:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
106 B 41ms
30ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-1724183-7&cid=1253278347.1601047735&jid=822035850&_u=aGBAgAALCAAAAE~&z=1065725454

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 15:28:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
106 B 92ms
57ms Image
image/gif 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-1724183-7&cid=1253278347.1601047735&jid=822035850&_u=aGBAgAALCAAAAE~&z=1065725454

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 15:28:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 bubbleSprite_3.png
ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/ 318 B
352 B 11ms
6ms Image
image/png 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/bubbleSprite_3.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

232334d177f358c07f8271994e6fc0c018abfce7c8910deb604de1440d741c45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 09:06:25 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
age: 368549
content-type: image/png
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 318
x-xss-protection: 0
expires: Tue, 21 Sep 2021 09:06:25 GMT

GET
H3-Q050 200 bubbleDropR_3.png
ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/ 116 B
141 B 12ms
6ms Image
image/png 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/bubbleDropR_3.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c7884164b248cb8d87de9edf64dc810e5753bb8ec0cd015800d7f39e08371c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 09:06:25 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
age: 368549
content-type: image/png
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 116
x-xss-protection: 0
expires: Tue, 21 Sep 2021 09:06:25 GMT

GET
H3-Q050 200 bubbleDropB_3.png
ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/ 117 B
142 B 13ms
7ms Image
image/png 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/s2/oz/images/stars/po/bubblev1/bubbleDropB_3.png

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

984601230d8cbfe18370425e8e897037cc1a7adf831a691a9ede573cf44479d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 09:06:25 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
age: 368549
content-type: image/png
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 117
x-xss-protection: 0
expires: Tue, 21 Sep 2021 09:06:25 GMT

GET
H2 200 jot
syndication.twitter.com/i/ 43 B
361 B 133ms
133ms Image
image/gif 104.244.42.200
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?dnt=1&l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Awithcount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1601047734975%2C%22dnt%22%3Atrue%2C%22client_version%22%3A%22219d021%3A1598982042171%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22follow%22%2C%22action%22%3A%22impression%22%7D%7D

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.200 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:28:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 116
pragma: no-cache
last-modified: Fri, 25 Sep 2020 15:28:55 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 36da420aff621eb3232f0aeac19fc7d1
x-transaction: 00ff908900eb7a6b
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 pixel;r=526740465;labels=_fp.event.Default;rf=0;a=p-NVNd7-g373ynZ;url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F;fpan=1;fpa=P0-117548743...
pixel.quantserve.com/ 35 B
371 B 12ms
10ms Image
image/gif 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=526740465;labels=_fp.event.Default;rf=0;a=p-NVNd7-g373ynZ;url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F;fpan=1;fpa=P0-1175487437-1601047734981;ns=0;ce=1;qjs=1;qv=4f9b77f5-20200917130726;cm=;gdpr=0;ref=;d=intego.com;je=0;sr=1600x1200x24;enc=n;dst=1;et=1601047734981;tzo=-120;ogl=locale.en_US%2Ctype.article%2Ctitle.Mac%20malware%20exposed%3A%20XCSSET%252C%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog%2Cdescription.Intego%20has%20been%20deeply%20investigating%20XCSSET%252C%20an%20intriguing%20new%20Mac%20malware%20speci%2Curl.https%3A%2F%2Fwww%252Eintego%252Ecom%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-%2Csite_name.The%20Mac%20Security%20Blog%2Cimage.https%3A%2F%2Fwww%252Eintego%252Ecom%2Fmac-security-blog%2Fwp-content%2Fuploads%2F2020%2F08%2FXcodeproj-in%2Cimage%3Awidth.400%2Cimage%3Aheight.260

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 15:28:54 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
status: 200
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
378 B 60ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1722534091368523&ev=PageView&dl=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&rl=&if=false&ts=1601047734996&sw=1600&sh=1200&v=2.9.24&r=stable&ec=0&o=30&fbp=fb.1.1601047734994.1982014367&it=1601047734755&coo=false&rqm=GET

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:28:55 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Fri, 25 Sep 2020 15:28:55 GMT

POST
H2 200 /
www.facebook.com/tr/ 0
82 B 7ms
7ms Other
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryjtAgNxTxLl1kCGDt

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Fri, 25 Sep 2020 15:28:55 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://www.intego.com
access-control-allow-credentials: true
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0

GET
H/1.1 200
OK /
b91.yahoo.co.jp/pagead/conversion/1000324116/ 42 B
909 B 1316ms
320ms Image
image/gif 183.79.255.28
YAHOO-JP-AS-AP Ya...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b91.yahoo.co.jp/pagead/conversion/1000324116/?random=1601047735817&cv=9&fst=1601047735817&num=1&fmt=3&value=0&label=2ZHECN3Sq2oQi-v4oAM&guid=ON&disvt=true&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&tiba=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog&hn=www.googleadservices.com&async=1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

183.79.255.28 , Japan, ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP),

Reverse DNS

Software

ATS /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 25 Sep 2020 15:28:56 GMT
Via: http/1.1 mscedge2102.img.umd.yahoo.co.jp (ApacheTrafficServer [c sSf ])
X-Content-Type-Options: nosniff
Server: ATS
Timing-Allow-Origin: *
Age: 2
P3P: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Cache-Control: no-cache, must-revalidate, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
X-XSS-Protection: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK /
b91.yahoo.co.jp/pagead/conversion/1000324116/ 42 B
909 B 1329ms
327ms Image
image/gif 183.79.255.28
YAHOO-JP-AS-AP Ya...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b91.yahoo.co.jp/pagead/conversion/1000324116/?random=1601047735822&cv=9&fst=1601047735822&num=1&fmt=3&value=1&label=yGd0CMDksGoQi-v4oAM&guid=ON&disvt=true&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&tiba=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog&hn=www.googleadservices.com&async=1

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

183.79.255.28 , Japan, ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP),

Reverse DNS

Software

ATS /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 25 Sep 2020 15:28:56 GMT
Via: http/1.1 mscedge2103.img.umd.yahoo.co.jp (ApacheTrafficServer [c sSf ])
X-Content-Type-Options: nosniff
Server: ATS
Timing-Allow-Origin: *
Age: 2
P3P: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Cache-Control: no-cache, must-revalidate, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
X-XSS-Protection: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 15 KB
6 KB 64ms
21ms Script
application/javascript 2a00:1288:f03d:1fa::4000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: www.intego.com
URL: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

63896532a7015ab5b7288359c02124980a5075e9267f0ba3fbfc7c3f5038b478

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Fri, 25 Sep 2020 15:06:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1337
x-amz-server-side-encryption: AES256
status: 200
vary: Origin, Accept-Encoding
content-length: 5581
x-amz-id-2: UNqT2Qo1OmDxE6XXz23yO4p9h5EBZaVIE0xaqZE21CL+jHfSo4jAbtOK70GYI5OxRGmCm/89D00=
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Sat, 30 Oct 2021 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Thu, 24 Sep 2020 23:08:16 GMT
server: ATS
etag: "49db10c8315384e8dad2e92a6841ed81-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: F836755832155CAD
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
x-amz-version-id: swANRqp_TdPZf97XDKuCKoVnrp7c.h.0
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 10013026.json Show response
s.yimg.com/wi/config/ 2 B
459 B 52ms
19ms XHR
application/json 2a00:1288:f03d:1fa::4000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10013026.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 15:16:12 GMT
x-content-type-options: nosniff
age: 764
status: 200
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id: BN7S4HCP4VFQ5W2T
x-amz-id-2: Z95WhmsUSPKwK1Ir+Kfz/0nBHkrAxChfdZLKmYDA3dVY+hq1CsdaHx5P30DMxLe3/qGxvat0KJw=
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
content-length: 2

GET
H/1.1 200
OK sp.pl Show response
sp.analytics.yahoo.com/ 0
857 B 629ms
72ms Script
application/x-javascript 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Fri%2C%2025%20Sep%202020%2015%3A28%3A55%20GMT&n=-2d&b=Mac%20malware%20exposed%3A%20XCSSET%2C%20an%20advanced%20new%20threat%20%7C%20The%20Mac%20Security%20Blog&.yp=10013026&f=https%3A%2F%2Fwww.intego.com%2Fmac-security-blog%2Fmac-malware-exposed-xcsset-an-advanced-new-threat%2F&enc=UTF-8&tagmgr=gtm

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 , Switzerland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 15:28:56 GMT
X-Content-Type-Options: nosniff
Age: 0
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Server: ATS
X-Frame-Options: DENY
Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security: max-age=31536000
Content-Type: application/x-javascript
Cache-Control: no-cache, private, must-revalidate
Accept-Ranges: bytes
Expires: Fri, 25 Sep 2020 15:28:56 GMT

GET
H2

200

like.php
www.facebook.com/v2.8/plugins/ Frame B1A9
Redirect Chain

https://web.facebook.com/v2.8/plugins/like.php?action=like&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfce89052680be4%26domain%3Dwww.inte...
https://www.facebook.com/v2.8/plugins/like.php?action=like&app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfce89052680be4%26domain%3Dwww.integ...

0
0

50ms
50ms

Document
text/html

2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v2.8/plugins/like.php?action=like&app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfce89052680be4%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff3764754b80c04%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.facebook.com%2Fintego&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&_rdc=1&_rdr

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=4dbdfce6c3edf8c2d6f5568db1643bc3&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /v2.8/plugins/like.php?action=like&app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfce89052680be4%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff3764754b80c04%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.facebook.com%2Fintego&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&_rdc=1&_rdr
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: fr=0U23nxOIVavIjQ0p0..Bfbgy3...1.0.Bfbgy3.
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: about:blank

Response headers

status: 200
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-xss-protection: 0
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
timing-allow-origin: *
strict-transport-security: max-age=15552000; preload
content-encoding: br
facebook-api-version: v3.1
x-content-type-options: nosniff
vary: Accept-Encoding
pragma: no-cache
content-type: text/html; charset="utf-8"
x-fb-debug: TFUN8CLnSL2NSWXhKgldTUKCzsoID3vUYBRrq7i8xLBDB83yxjVhzjBrC5kPKPT0PjdmPVwk1JKrceSyiOq8rQ==
date: Fri, 25 Sep 2020 15:28:57 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

Redirect headers

status: 302
location: https://www.facebook.com/v2.8/plugins/like.php?action=like&app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Dfce89052680be4%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff3764754b80c04%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fwww.facebook.com%2Fintego&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false&size=small&_rdc=1&_rdr
x-fb-zr-redirect: 02|1601134137|FzBFAiAYrrvexb0UyS114ltL-W09FrZ8qEHgYo_d88h1Vq9kxQIhAINoQPDhvSby8q6A5ZHPhYyd4aTKo5ZXRhlDwzJk4jln
strict-transport-security: max-age=15552000; preload
content-type: text/html; charset="utf-8"
x-fb-debug: tASAdR+T8wt+igPzvQg2CUY+KO+atZ7Z+IJaM+bss/RshB/qot0NlbpUGsHMTECVPMJ+uvi8/hv/h4tGuwUhMg==
content-length: 0
date: Fri, 25 Sep 2020 15:28:57 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H2

200

like_box.php
www.facebook.com/v2.8/plugins/ Frame F351
Redirect Chain

https://web.facebook.com/v2.8/plugins/like_box.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2821566a6fd36%26domain%3Dwww.intego.com%2...
https://www.facebook.com/v2.8/plugins/like_box.php?app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2821566a6fd36%26domain%3Dwww.intego.com%26...

0
0

369ms
369ms

Document
text/html

2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v2.8/plugins/like_box.php?app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2821566a6fd36%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff3764754b80c04%26relation%3Dparent.parent&color_scheme=light&container_width=290&header=true&href=https%3A%2F%2Fwww.facebook.com%2Fintego&locale=en_US&sdk=joey&show_border=true&show_faces=false&stream=true&_rdc=1&_rdr

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=4dbdfce6c3edf8c2d6f5568db1643bc3&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /v2.8/plugins/like_box.php?app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2821566a6fd36%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff3764754b80c04%26relation%3Dparent.parent&color_scheme=light&container_width=290&header=true&href=https%3A%2F%2Fwww.facebook.com%2Fintego&locale=en_US&sdk=joey&show_border=true&show_faces=false&stream=true&_rdc=1&_rdr
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.intego.com/mac-security-blog/mac-malware-exposed-xcsset-an-advanced-new-threat/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: fr=0U23nxOIVavIjQ0p0..Bfbgy3...1.0.Bfbgy3.
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: about:blank

Response headers

status: 200
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-xss-protection: 0
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/;
timing-allow-origin: *
strict-transport-security: max-age=15552000; preload
content-encoding: br
facebook-api-version: v3.1
x-content-type-options: nosniff
vary: Accept-Encoding
pragma: no-cache
content-type: text/html; charset="utf-8"
x-fb-debug: GhuSNAakjAH1c24Qh2QC/2JJrGxFUW0NG9zMV3Vkn7WbULdd4mz4/Ln4RnU4ewQFp9uGIqT79sxiBM3vPGX+hQ==
date: Fri, 25 Sep 2020 15:28:57 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

Redirect headers

status: 302
location: https://www.facebook.com/v2.8/plugins/like_box.php?app_id&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df2821566a6fd36%26domain%3Dwww.intego.com%26origin%3Dhttps%253A%252F%252Fwww.intego.com%252Ff3764754b80c04%26relation%3Dparent.parent&color_scheme=light&container_width=290&header=true&href=https%3A%2F%2Fwww.facebook.com%2Fintego&locale=en_US&sdk=joey&show_border=true&show_faces=false&stream=true&_rdc=1&_rdr
x-fb-zr-redirect: 02|1601134137|FzBGAiEA2fo6nmjxDEjmUZxJPEFEbJUjHHH-KLm-h4Laq9CGMSgCIQDRoq3fh7COrNGLjVDDONQVRsprKPYi-Ox9xT2w8zMzfg
strict-transport-security: max-age=15552000; preload
content-type: text/html; charset="utf-8"
x-fb-debug: hLEEPVOGtzAzsCGP+VV7m50Gn7DqKGk+GEX3/HvCj2/hLsFQJgFFwe+a8L3WcOuYzMG230ALGTKoSIdMQ5J06Q==
content-length: 0
date: Fri, 25 Sep 2020 15:28:57 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s7.addthis.com
URL: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Domain: www.linkedin.com
URL: https://www.linkedin.com/pages-extensions/FollowCompany?id=28855&counter=none&xdOrigin=https%3A%2F%2Fwww.intego.com&xdChannel=c23d1f17-9938-4b66-ba8e-2e048d9a94d8&xd_origin_host=https%3A%2F%2Fwww.intego.com

Verdicts & Comments Add Verdict or Comment

142 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

21 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.www.linkedin.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: ajax:9050358904435018677
.linkedin.com/	1970-01-19 21:29:43	Name: lissc Value: 1
.twitter.com/	1970-01-20 06:15:19	Name: guest_id Value: v1%3A160104773518264685
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: vu3jy2D4zwg
.twitter.com/	1970-01-20 06:15:19	Name: personalization_id Value: "v1_9SD/MLuKQJCvc4fLmfRTkg=="
.intego.com/	1970-01-19 12:44:07	Name: _dc_gtm_UA-1724183-7 Value: 1
.intego.com/	1970-01-19 22:08:36	Name: __qca Value: P0-1175487437-1601047734981
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.twitter.com/	1970-01-19 12:44:29	Name: ct0 Value: 72ea1c058b8efb70857b500e6cae2b2c
.intego.com/	1970-01-19 13:07:31	Name: _uetvid Value: a2f54f9461891a4ef42fdc2673592b64
.google.com/	1970-01-19 17:07:38	Name: NID Value: 204=sBnYeTs8zi-0A30VQ3MTzA211Yy7LhCR5MEjJL6OGECHuk0TblbbN0ak_da7xZ80eu2qUi5QoinaUqB-YFhihCMaMupM-aD6Pte3p2L3-sesThIyqHJepkA_3eBskZFUDPq0XCM8MXTa0TQ44oChYAPzbibR2KCjUMBXCY6HGYA
.intego.com/	1970-01-19 12:45:34	Name: _uetsid Value: 941dc30f03ac334293408f927581b96b
.intego.com/	1970-01-19 12:45:34	Name: _gid Value: GA1.2.844463921.1601047735
.linkedin.com/	1970-01-19 12:45:34	Name: lidc Value: "b=TGST06:g=1948:u=1:i=1601047734:t=1601134134:s=AQFP3M7WYHSgulTHTHTtlCzKI0EcoAZy"
.intego.com/	1970-01-20 06:15:19	Name: _ga Value: GA1.2.1253278347.1601047735
.linkedin.com/	1970-01-20 06:16:01	Name: bcookie Value: "v=2&dc5e78ed-25dc-4e3a-8f27-4922be23ed68"
.youtube.com/	1970-01-19 17:03:19	Name: VISITOR_INFO1_LIVE Value: YqGqTd8tIJE
.intego.com/	1970-01-19 14:53:43	Name: _fbp Value: fb.1.1601047734994.1982014367
.www.linkedin.com/	1970-01-20 06:16:01	Name: bscookie Value: "v=1&20200925152854d6cdae3a-e30b-404e-8d10-ba6c756c7308AQHoo994fVtOiJPNsb5hXm7mMpzjlAUk"
.intego.com/	1970-01-19 14:53:43	Name: _gcl_au Value: 1.1.1139670264.1601047735
.intego.com/	1970-01-19 13:27:19	Name: __cfduid Value: d2026a81d6a076ba5c5343bcc913235c81601047733

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.intego.com/mac-security-blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.google.com
apis.google.com
b91.yahoo.co.jp
bat.bing.com
c.disquscdn.com
connect.facebook.net
disqus.com
fireside.fm
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
graph.facebook.com
i0.wp.com
i1.wp.com
i2.wp.com
m.addthis.com
macsecurityblog.disqus.com
netdna.bootstrapcdn.com
pixel.quantserve.com
pixel.wp.com
platform.linkedin.com
platform.twitter.com
rules.quantcount.com
s.w.org
s.yimg.com
s.yimg.jp
s.ytimg.com
s7.addthis.com
secure.gravatar.com
secure.quantserve.com
sp.analytics.yahoo.com
ssl.gstatic.com
stats.g.doubleclick.net
stats.wp.com
syndication.twitter.com
v1.addthisedge.com
web.facebook.com
widgets.pinterest.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.intego.com
www.linkedin.com
www.youtube-nocookie.com
www.youtube.com
z.moatads.com
s7.addthis.com
www.linkedin.com
104.244.42.200
151.101.36.84
151.101.64.134
172.217.16.162
183.79.249.252
183.79.255.28
192.0.76.3
192.0.77.2
192.0.77.48
199.232.196.134
2001:4de0:ac19::1:b:1b
212.82.100.181
23.210.248.44
23.210.250.213
2600:9000:206e:5200:6:44e3:f8c0:93a1
2606:2800:234:59:254c:406:2366:268c
2606:4700::6812:a913
2606:4700::6812:d77
2620:116:800d:21:8c6e:cf2c:8d6:9fb5
2620:1ec:21::14
2620:1ec:c11::200
2a00:1288:f03d:1fa::4000
2a00:1450:4001:800::2003
2a00:1450:4001:802::2002
2a00:1450:4001:802::200a
2a00:1450:4001:802::200e
2a00:1450:4001:803::200e
2a00:1450:4001:809::2008
2a00:1450:4001:818::2003
2a00:1450:4001:819::2004
2a00:1450:4001:81b::2003
2a00:1450:4001:81e::200e
2a00:1450:4001:820::200e
2a00:1450:4001:821::200d
2a00:1450:4001:821::200e
2a00:1450:400c:c0c::9c
2a02:26f0:6c00::210:ba20
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f02d:e:face:b00c:0:2
2a03:2880:f12d:83:face:b00c:0:25de
2a04:fa87:fffe::c000:4902
96.126.99.139
0140ed5069f22e4aa8bb1a1fc615c39fc55d7d64e94be541615f1c5a30ae479b
01fdf346f2f8d129c118d71f735fb3a76656059b38000829b908a1a118a5492f
033cde881de209390d39c3f291aa9cc39c412c29fd794af7277830b34da8785a
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
07b8f01ebba4076c5166ae55f61991d7e7e5fbfaf47caccad4e0878349105b0a
097afea517679d2e0b986d77cb3fe7808026882b52ca074a050e03e7a4a6996b
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
1053b55a87f15cde8d4a66809aa85e4acb9df38e50d85f8d7b03354eb0fb0013
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
114773206c8b1ef17f1865f1fd0acb5ee36aa4f666718144698063fd295a0f65
124d5d7d1a1e13e129ad8ffbba218f6fd857f706d9af89d05d2686a0627ce127
137e41c449677deb7c8da3afde63fc781b095bb028f78b789be44192e8e3f4be
142bb04454d6124c28f12d43249615ae8903c9742ea86c024ef0602f4dd1446e
1ec59a067ba6ca9573c5443f4162b16b1b3349c34669eb4e7f4be7a20bdc85e5
232334d177f358c07f8271994e6fc0c018abfce7c8910deb604de1440d741c45
23b775e4e3b5b93742dad8a1bbfacb2ffc3271a15dbfc6d3ded21d713f2c3489
25aa0b7b8ad904efa464dc2b11da0975d77ef2ba0eb747b06b72c738b95e581d
25b786ec50525130cddd67183bc696608e1fc88651fe5d1d953667e9f4643c4d
270deaa4889841d35cc851365432365bf62d81c1159ad4a1099def85ce6f8bed
275fb4a7bdeab3c59caff1c0ea88bf1adc9f4cfc377a9bec7b28517d13e2fd37
301bec0edd5575e96ea21fd09c50c5964ee72d565a65fd7d8db6020d64c05cd3
33f30681793311916b1626535ca2990a9efcbf10f26d2c2a6565edfb6979c4ec
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
364c1179390530ea06c6636e2f314aa1091d460c4c6e369c6689a0fe31672054
3eab02e002142b491bfeaaea2ee12490872bc5429dfb0889914660c783194563
3fb4cab423b2441335fc682b79687d8eb806aceb384c937c9b28534580593fd4
403bfa21e733c139da9d7d87c48fa0ebbed91514fbbadf34cbc455294a004389
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
451b07379c15f95edc328f4b3b71d3d3b67cda7fe5b85251b39f866d0189f943
4813a9ef082680ede099e57bad023ef37cb204fe87ec0de1de1534cc7b1b4103
487f2e9da2ff0740755a5ef01dc15a2888b89537795895203a831b13b199d8bb
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
49b34be224fe432a99c8609e9f61bf4f07144fc9b6b90325b7cc304b1271547f
4e58b78b5844a988d67532b4683a6e8b3235b3d56d319727e65f460805bbdec4
53e8ea14545d74e203b97733f765238f89b895230a8afb415874c7c445c75c58
5539ebc747e005bcd0bcdf9e946d3469107a18d1996595c39a2445a886468674
553bc017c2f271f2d74ccc48497c9a1fbc54d3bb0d6fc206efce608ea8a8e4e1
593718d567cc4d6767d63be77ac6505dedee76cc656526945c90f9e1869cbc53
593b81ecc28e013924cc0bd0b78a6a990c0e01ffbf31ef576d5f6086829ab9a0
5c622f5433cbb6ea1df5c0dd8671e55ef7d1464366074730473c453de50a579b
5f70fb8150f0a1f184b40f86d012db040d229056b9b0d8c681f08987cb124e5f
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
61043862bfca6af330c3434cbf67360d72e2b11192f86b69321fe68f216c70f2
62d2cc93ab8f52afb7379b9fabdc6f383f7700367cda04191ad1a8158c449c23
63896532a7015ab5b7288359c02124980a5075e9267f0ba3fbfc7c3f5038b478
658e8b2fc6e603ce4afb0f39cd09d2ff743c9fcbeaaea5dc58097184d34da56d
66db6471e94c968b938e977f160c15f9cc9d9941e66823bdf043a7e932d92240
6c7884164b248cb8d87de9edf64dc810e5753bb8ec0cd015800d7f39e08371c1
6c9459a6400a8cf7ef815379f9316dc26aeec43bcc48da1d1bd58d99a6109f7b
6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0
7456721b1c3d2c1c24d4ed813a2795d0907dc1c0b2748e566e8dabf3d1126dcb
74bb956c78140b9e3228afbcc5c520080df82ea13e945766657928838ec56515
7587369160233b751c90ccc2043b7fdfd7eb1f0d9aa610371b43f4b3419fa83f
765af1bf46f65a6bb9108eea31286465e8a28f1c649030afff11b51b45cb25d4
79e23a92dfcac7cfec15c82dfcbd83d3db7cb9222a8a1a60963d0bec57977163
7c91a37f448e0d90f9079566ec4114aac6a37bb32ff0fc1c28d47c6b31646d87
82f1278f66b192a223e306d884f8db595ef3b6d829cc1544807b9bf40019403e
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
85c1eb2c2a173feceba14abe8344fe9c7cb12aa1353f083f28a62f1a366763b9
87bcc22d43cfa00bd1cf5e3a35aad79150b4ce804899db3ea93efe57eeb6dbf7
884a2330198f498e36d9e77bb5c7f4971b3d70c4411cf306a3afca8bb50bb94d
89cb81b15741129a01edcb8665b1f6172e270197a1335e9f0db3558e6c338a60
8c7ee0238fa5cd80a02ef9870a7fff498ef52097181cb73edb9219dc022fd919
8e647ae3b97c4adb3970662d2945d1be4cf09e75712de88eb2b3adf793d16bcf
8ecf7fe958f132008eb2eaeda1a079451a62372838a6c18d9e1353f64e48172a
8f2cf36a9df3e0af8f1b226a1440c9a6fd4cda5c4b4548150236c8d1a1b094e6
9397e430232fd1a326c8e8ca1473007c96f8c84a0fa2820c4ca16d4e311d1fde
93b94b74b73c37bcb3e6d8cada57b5ce45d7bd3fe5e3b2b6194a702d1353e1a0
96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea
97c98ef860853178938e7fae214a3f6cbc485d16452c45ea3e13190094714931
984601230d8cbfe18370425e8e897037cc1a7adf831a691a9ede573cf44479d4
9eeea020cc6ec6c8b66b20c48a9b69a5f14b8097bdb91c5420998eb842bcbae0
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a2d30057d0a8007fb75fb8a6e4f82f59d3858d29ea176db9c73f665209e86123
a374e4a800bf1c52c2f548b954aca207cd7424b16fd3ab37493e57de0351ee08
a37ca4608218cccdfb8b6d4edbdfbf375d0e1368b46397e3b7049e0cbf5bc1f6
a4d96a2b0a51347fa935513d95b0f49d7f6fcebb5357fd7129974758bb5b5680
a761b426004caba495cdac2c93ce7dd306c47bc4d7bdc63c4840c3d8182396a9
a9cab6b997431283ce8f789f1efd7d1b74f27e79c9f545a623ee1387ce7409ac
aaffceab986a8d791cfef18d2d1e28fe2dcaf40a8bdfaf4fd393b1a91c6f072b
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aeed123aaf3d21619c5676888e47328a2f0f9994ea86268b5ad0072825bc29fb
af0c90c79167796746d77eb0f20a739e66fa7fcd774680c7ba25cce5292d5ba5
b276d76730453e9410755998a27c1bee3ecdb7086fe81a5d1ab4f06872e7415c
b3047860308e9ff0cf48f12a46bb529b8c4cb14287d14736e4b0257e6609a2c7
b385fd0614f2927f0e7fdc03ccdb2428e3a93de0c7fe467149b34213cc32c0f6
b7250591ec46b002df773646ece219ff2b0c5f202ad75ba5f56c4934b2a88d98
b859cc611126401cdc38d803ac7c5967ee5da1a626e00318700ea88df55da1b9
bb419846a6c750ceac7e697b479216945b7597dea49905e30d1fc040a3194099
bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d
bcccab88ad368e380f7906289dd171606c96f78f44f4322c93395093b8844706
c038085bd64c19c9f10dbf5d50967e4336ad5db48ff87111cb181e9a05cbaab0
c082b0b5901359803e620e04dee50986beef023bdc7413d1e47d571bc73a7500
c5a0115d79473f700ee7bc30ee32c82dadf75f0fb2d8313f2d6d77e38bb9edca
c73d6c78c4bb48a6815c7ddd5bc944b047754369d4043ccb6ab2fde88f42add4
c8de81a1acb5f3788959ecc04eaa6526d5bdb29991157cecbef71042268c0374
ca5398fb76a3d11f43a00312ca1f4a0b11cc37d1925d82bcc80c906ffc956ff2
caf986b7c4bc7761acf6300a4b62ef45653cc42031d64dbfcd44f9be4c4fc26e
cd42913991b63df247c37543d4b233d0579e3765af6e88565d36b8ddf91693bc
d077683ec63c7d44f473554e688628da6cfdf84c0f223b6be00f2476600433a5
da3e524928bcca821af2551eb6f9e9ae2449ceb48642cce4f2dae23383098537
dd181d190b0d09b0d51c5ab338983be4d084fbec3af3dbe6e739e9f55014c5b6
e098e7520dbccfe6cdaa96ce30b3245894b060fdc2d31145e870c81432cff684
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e48d539ca17fdd4a1ea4d56c769df1b9469535132e9cc45d187e8cf4560ab57d
e7f5a831ead8920451598097754bb1d4fbf16fff1fd90794b950724867345794
eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746
ecf76895be1cf9e8b3edb254030e9c9c1d8f3c2efc1f9dc7e04ceff29eccae9c
ed1b73c6b4690cde9b521865b58e031293209bc0b2ba2b5716ecf4bf9885ee4b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2b93287eebae3a6ac1f7efadd39373abd95e1ee24620ef4f156b0fe1a496be4
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f538d5803d00836b5f946264abb64976a6416ab4cc16f8f83455a025a08ad014
f5eb3447e5e14f6907295baf22ba454cf3a88b4cd41abd61e6286e975d3608a0
ffa8b5c0d78def1b71617c0ae00e01b295bc29e2e227ba0dc84469a9ba39259c

www.intego.com Open in urlscan Pro 2606:4700::6812:d77 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

140 Requests

99 %HTTPS

67 %IPv6

34 Domains

49 Subdomains

43 IPs

9 Countries

1684 kBTransfer

3729 kBSize

21 Cookies

38 Outgoing links

Redirected requests

140 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.intego.com Open in urlscan Pro
2606:4700::6812:d77 Public Scan

Screenshot
Live screenshot

Full Image

140
Requests

99 %
HTTPS

67 %
IPv6

34
Domains

49
Subdomains

43
IPs

9
Countries

1684 kB
Transfer

3729 kB
Size

21
Cookies

140 HTTP transactions
5 data transactions