www.jamf.com Open in urlscan Pro
54.173.104.166 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://tinyurl.com/5n7f56a8
Effective URL:
https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Submission Tags: falconsandbox
Submission: On May 22 via api (May 22nd 2023, 8:30:32 pm UTC) from US — Scanned from DE

Summary HTTP 69 Redirects Links 19 Behaviour Indicators

Summary

This website contacted 13 IPs in 3 countries across 12 domains to perform 69 HTTP transactions. The main IP is 54.173.104.166, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.jamf.com. The Cisco Umbrella rank of the primary domain is 193873.
TLS certificate: Issued by Amazon RSA 2048 M01 on March 31st 2023. Valid for: a year.

This is the only time www.jamf.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:10:... 2606:4700:10::6814:8b41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
21	54.173.104.166 54.173.104.166	14618 (AMAZON-AES) (AMAZON-AES)
6	143.204.176.111 143.204.176.111	16509 (AMAZON-02) (AMAZON-02)
22	18.66.15.110 18.66.15.110	16509 (AMAZON-02) (AMAZON-02)
7	18.244.110.166 18.244.110.166	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:218... 2600:9000:2181:5400:1b:ef38:3680:21	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:812::200e	15169 (GOOGLE) (GOOGLE)
2	104.102.38.132 104.102.38.132	16625 (AKAMAI-AS) (AKAMAI-AS)
1	192.28.147.68 192.28.147.68	15224 (OMNITURE) (OMNITURE)
1	2606:4700:440... 2606:4700:4400::ac40:9062	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:400c:c09::9c	15169 (GOOGLE) (GOOGLE)
2	54.218.150.145 54.218.150.145	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:827::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
69	13

1 2606:4700:10::6814:8b41 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

tinyurl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 54.173.104.166 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-173-104-166.compute-1.amazonaws.com

www.jamf.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 143.204.176.111 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-176-111.lhr50.r.cloudfront.net

resources.jamf.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 18.66.15.110 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-15-110.vie50.r.cloudfront.net

media.jamf.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 18.244.110.166 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-244-110-166.waw51.r.cloudfront.net

cdn.segment.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2181:5400:1b:ef38:3680:21 (United States)

ASN16509 (AMAZON-02, US)

d21y75miwcfqoq.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.102.38.132 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-102-38-132.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.147.68 (United States)

ASN15224 (OMNITURE, US)

704-vyp-527.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9062 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c09::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.218.150.145 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-218-150-145.us-west-2.compute.amazonaws.com

api.segment.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
49	jamf.com www.jamf.com — Cisco Umbrella Rank: 193873 resources.jamf.com — Cisco Umbrella Rank: 353530 media.jamf.com — Cisco Umbrella Rank: 274054	2 MB
7	segment.com cdn.segment.com — Cisco Umbrella Rank: 1462	64 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 30	22 KB
2	segment.io api.segment.io — Cisco Umbrella Rank: 1112	343 B
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3129	7 KB
1	google.de www.google.de — Cisco Umbrella Rank: 6080	408 B
1	google.com www.google.com — Cisco Umbrella Rank: 2	408 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 76	347 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 587	243 B
1	mktoresp.com 704-vyp-527.mktoresp.com — Cisco Umbrella Rank: 475437	318 B
1	cloudfront.net d21y75miwcfqoq.cloudfront.net	455 B
1	tinyurl.com 1 redirects tinyurl.com — Cisco Umbrella Rank: 15887	572 B
69	12

	Domain	Requested by
22	media.jamf.com	www.jamf.com
21	www.jamf.com	www.jamf.com
7	cdn.segment.com	www.jamf.com cdn.segment.com
6	resources.jamf.com	www.jamf.com
3	www.google-analytics.com	cdn.segment.com www.google-analytics.com
2	api.segment.io	cdn.segment.com
2	munchkin.marketo.net	cdn.segment.com munchkin.marketo.net
1	www.google.de
1	www.google.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	geolocation.onetrust.com	www.jamf.com
1	704-vyp-527.mktoresp.com	munchkin.marketo.net
1	d21y75miwcfqoq.cloudfront.net	www.jamf.com
1	tinyurl.com	1 redirects
69	14

This site contains links to these domains. Also see Links.

Domain
partnerpath.jamf.com
www.jamf.info
securelist.com
www.proofpoint.com
objective-see.org
taomm.org
www.facebook.com
twitter.com
www.linkedin.com
store.jamf.com
marketplace.jamf.com
developer.jamf.com
www.zecops.com
ir.jamf.com
www.youtube.com
www.instagram.com

Subject Issuer	Validity	Valid
*.jamf.com Amazon RSA 2048 M01	`2023-03-31` - `2024-04-27`	a year	crt.sh
*.segment.com Amazon RSA 2048 M01	`2023-02-24` - `2024-01-12`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2022-12-08` - `2023-12-07`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-02-06` - `2024-02-05`	a year	crt.sh
*.mktoresp.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-05` - `2023-11-05`	a year	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2022-12-13` - `2023-12-13`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
*.segment.io Amazon RSA 2048 M01	`2023-02-10` - `2024-02-10`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Frame ID: 8F73BF83E4BBAA931A646E50D2586DC0
Requests: 69 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

'RustBucket' malware targets macOS JamfJamfJamf

Page URL History Show full URLs

https://tinyurl.com/5n7f56a8 HTTP 301
https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/ Page URL

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Segment (Analytics) Expand

Overall confidence: 100%
Detected patterns

cdn\.segment\.com/analytics\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

69
Requests

100 %
HTTPS

50 %
IPv6

12
Domains

14
Subdomains

13
IPs

3
Countries

2220 kB
Transfer

4637 kB
Size

11
Cookies

19 Outgoing links

These are links going to different origins than the main page.

URL: https://partnerpath.jamf.com/
Title: Training

Search URL Search Domain Scan URL

URL: https://www.jamf.info/
Title: Resources

Search URL Search Domain Scan URL

URL: https://securelist.com/bluenoroff-methods-bypass-motw/108383/
Title: Kaspersky blog

Search URL Search Domain Scan URL

URL: https://www.proofpoint.com/us/blog/threat-insight/ta444-apt-startup-aimed-at-your-funds
Title: writeup done by Proofpoint

Search URL Search Domain Scan URL

URL: https://objective-see.org/
Title: Patrick Wardle

Search URL Search Domain Scan URL

URL: https://taomm.org/
Title: The Art of Mac Malware

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware
Title: Share on Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware
Title: Share on Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/sharing/share-offsite/?url=https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware
Title: Share on LinkedIn

Search URL Search Domain Scan URL

URL: https://store.jamf.com/
Title: Store

Search URL Search Domain Scan URL

URL: https://marketplace.jamf.com/
Title: Marketplace

Search URL Search Domain Scan URL

URL: https://developer.jamf.com/
Title: Developers

Search URL Search Domain Scan URL

URL: https://www.zecops.com/
Title: ZecOps

Search URL Search Domain Scan URL

URL: https://ir.jamf.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://twitter.com/jamfsoftware
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/jamf-software/
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/JAMFMedia
Title: YouTube

Search URL Search Domain Scan URL

URL: https://www.instagram.com/jamfsoftware/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.facebook.com/jamfsoftware/
Title: Facebook

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://tinyurl.com/5n7f56a8 HTTP 301
https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

69 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Redirect Chain

https://tinyurl.com/5n7f56a8
https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/

233 KB
53 KB

420ms
195ms

Document
text/html

54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

59617daaf38fc01aa17e1d1cc02e3f2a4c2bbaaf650d17348b7869d036ca1148

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-length: 52326
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
content-type: text/html; charset=UTF-8
date: Mon, 22 May 2023 20:30:25 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
last-modified: Mon, 22 May 2023 18:15:51 GMT
link: <https://hello.myfonts.net>; rel=dns-prefetch, <https://resources.jamf.com>; rel=dns-prefetch; preconnect, </css/main.css?v=20230518060642>; rel=preload; as=style, </js/jamf-critical.min.js?v=20230518060642>; rel=preload; as=script, <https://resources.jamf.com/type/proxima-nova-regular.woff2>; rel=preload; as=font; crossorigin; type="font/woff2", <https://resources.jamf.com/type/proxima-nova-bold.woff2>; rel=preload; as=font; crossorigin; type="font/woff2", <https://resources.jamf.com/type/jcon_6372353d58f40790101470a75b02ecf2.woff>; rel=preload; as=font; crossorigin; type="font/woff"
permissions-policy: interest-cohort=()
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
server: Apache/2.4.29 (Ubuntu)
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=0, public, s-max-age=900, stale-if-error: 86400
cf-cache-status: DYNAMIC
cf-ray: 7cb7d11a9f682bd1-FRA
content-type: text/html; charset=UTF-8
date: Mon, 22 May 2023 20:30:24 GMT
location: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
referrer-policy: unsafe-url
server: cloudflare
x-content-type-options: nosniff
x-tinyurl-redirect: eyJpdiI6InRZaVVkdUNTZnpNUDVvc0RsS3F4K2c9PSIsInZhbHVlIjoiRDF5RitIN2RYUG1JeEZDTW5YUFhBbU1LTDlTOGdrb0Z0aGhTU3BQSTU1ajBqYVBXZlJHdWlDK1Y2ditDZ0tEM0J1UnVZeXd1dlZZYXF6ZTY5WHlNc2c9PSIsIm1hYyI6Ijc0YjMyYWJjMzliNWM0MDY2ZDM0NDViNmU5MTMwYTU1YmJkMDBiNTM0NTU5Y2VjN2Y0MWJmNTc4NmNmMzFlY2UiLCJ0YWciOiIifQ==
x-xss-protection: 1; mode=block

GET
H2 200 main.css
www.jamf.com/css/ 514 KB
75 KB 207ms
205ms Stylesheet
text/css 54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/css/main.css?v=20230518060642

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

993ff53700dc37c5876024b174c233eaf629e7f0e581cdd1430dbc98b19e446c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
last-modified: Thu, 18 May 2023 11:10:07 GMT
server: Apache/2.4.29 (Ubuntu)
content-encoding: gzip
etag: "8079b-5fbf5d8d5c1c0-gzip"
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
content-type: text/css
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
accept-ranges: bytes

GET
H2 200 jamf-critical.min.js Show response
www.jamf.com/js/ 55 KB
18 KB 106ms
104ms Script
application/javascript 54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/js/jamf-critical.min.js?v=20230518060642

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

204f8619417a0727f80bfab85bdd0d8e08a8821b771ec410eaaeab81e95b3f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
last-modified: Thu, 18 May 2023 11:10:21 GMT
server: Apache/2.4.29 (Ubuntu)
content-encoding: gzip
etag: "dba3-5fbf5d9ab6140-gzip"
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
content-type: application/javascript
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
accept-ranges: bytes
content-length: 17813

GET
H2 200 proxima-nova-regular.woff2
resources.jamf.com/type/ 33 KB
34 KB 107ms
23ms Font
binary/octet-stream 143.204.176.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.jamf.com/type/proxima-nova-regular.woff2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.176.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-176-111.lhr50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c51d95a70da69fdaf1d0b36d4fd9de081aa4df8c0c46740ee0323866682b302c

Request headers

Referer: https://www.jamf.com/
Origin: https://www.jamf.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 18 May 2023 10:19:51 GMT
x-amz-version-id: zU_pXaYtRWKAw2hO4T2Kw0OksaO51aQ2
via: 1.1 bfb6f7dc0d2f5ec95537e251cdcf5524.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-C1
age: 382235
x-cache: Hit from cloudfront
content-length: 34165
last-modified: Wed, 13 Sep 2017 14:58:22 GMT
server: AmazonS3
etag: "df53d94ae188ffd9000420c38ddf895e"
vary: Origin
access-control-allow-methods: GET, HEAD
content-type: binary/octet-stream
access-control-allow-origin: https://www.jamf.com
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
x-amz-cf-id: tN31KIaokGSykEGbrVC0TF23hhl0Xb91ZnjPCb7LjKSUSfyAw0McAg==

GET
H2 200 proxima-nova-bold.woff2
resources.jamf.com/type/ 33 KB
34 KB 107ms
23ms Font
binary/octet-stream 143.204.176.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.jamf.com/type/proxima-nova-bold.woff2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.176.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-176-111.lhr50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 532336cd1e9ff5bd041c34b85d09503bf2182f9f73b1c6763220d5e621eefd7d

Request headers

Referer: https://www.jamf.com/
Origin: https://www.jamf.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 18 May 2023 10:19:51 GMT
x-amz-version-id: FCWEvl9yzclfk7mwlcDg2sUTOdXBK8fz
via: 1.1 bfb6f7dc0d2f5ec95537e251cdcf5524.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-C1
age: 382235
x-cache: Hit from cloudfront
content-length: 34256
last-modified: Wed, 13 Sep 2017 14:58:22 GMT
server: AmazonS3
etag: "417be9e72bae5f37eddfbc4bd938564f"
vary: Origin
access-control-allow-methods: GET, HEAD
content-type: binary/octet-stream
access-control-allow-origin: https://www.jamf.com
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
x-amz-cf-id: 4lIJ8HKoigFzTYG3HgVAIzahcThWLlw7mMmdWZiV1N78TyJV4LxZJQ==

GET
H2 200 jcon_6372353d58f40790101470a75b02ecf2.woff
resources.jamf.com/type/ 29 KB
30 KB 108ms
24ms Font
font/woff 143.204.176.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.jamf.com/type/jcon_6372353d58f40790101470a75b02ecf2.woff
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.176.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-176-111.lhr50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 67671093eef8d6a896a1bae9de4068642bbe8e3935cbf24c53dc310eed0aec0e

Request headers

Referer: https://www.jamf.com/
Origin: https://www.jamf.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 11 May 2023 06:11:39 GMT
x-amz-version-id: 4RZXApkHDW6rY4e6mFT1znfuUQwtGJ2C
via: 1.1 bfb6f7dc0d2f5ec95537e251cdcf5524.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-C1
age: 1001926
x-cache: Hit from cloudfront
content-length: 29836
last-modified: Tue, 02 Mar 2021 19:02:56 GMT
server: AmazonS3
etag: "f0ade86f102e931e7436583cfd79de64"
vary: Origin
access-control-allow-methods: GET, HEAD
content-type: font/woff
access-control-allow-origin: https://www.jamf.com
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
x-amz-cf-id: XHEs_8iKrVNwDtQ3WKA2zQ5beKWQ-Tjo2a_jOTVqzjIhAnqKpdij8Q==

GET
H2 200 main.css
www.jamf.com/styles/ 281 KB
32 KB 206ms
204ms Stylesheet
text/css 54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/styles/main.css?v=20230518060642

Requested by

Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

8ec451a959767e32e172802746f68ef9b36a6fbbb4c5e33d58b3ce653f67d266

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
last-modified: Thu, 18 May 2023 11:09:49 GMT
server: Apache/2.4.29 (Ubuntu)
content-encoding: gzip
etag: "462d4-5fbf5d7c31940-gzip"
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
content-type: text/css
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
accept-ranges: bytes
content-length: 32163

GET
H2 200 typography-override.css
www.jamf.com/css/ 212 KB
15 KB 108ms
106ms Stylesheet
text/css 54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/css/typography-override.css?v=20230518060642

Requested by

Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

cea5674acfab00e21cc23be53647ee74e14fb8d23df9d4fe86a9d47eb160383f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
last-modified: Thu, 18 May 2023 11:10:08 GMT
server: Apache/2.4.29 (Ubuntu)
content-encoding: gzip
etag: "350a4-5fbf5d8e50400-gzip"
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
content-type: text/css
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
accept-ranges: bytes
content-length: 14171

GET
H2 200 jamf-button.js Show response
www.jamf.com/js/webcomponents/nebula/ 38 KB
10 KB 106ms
104ms Script
application/javascript 54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/js/webcomponents/nebula/jamf-button.js?v=20230518060642

Requested by

Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

790d04bc004242670fe4909931ff8433f69620bd4b87879a3c2f11d1f20a7b89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
last-modified: Thu, 18 May 2023 11:06:53 GMT
server: Apache/2.4.29 (Ubuntu)
content-encoding: gzip
etag: "98e4-5fbf5cd458d40-gzip"
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
content-type: application/javascript
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
accept-ranges: bytes
content-length: 9651

GET
H2 200 jamf-icon.js Show response
www.jamf.com/js/webcomponents/nebula/ 35 KB
10 KB 105ms
103ms Script
application/javascript 54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/js/webcomponents/nebula/jamf-icon.js?v=20230518060642

Requested by

Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

2024f8a682cdb8eb3579fdff57575d3421804950cfcadda88a093398fc8ea7f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
last-modified: Thu, 18 May 2023 11:06:53 GMT
server: Apache/2.4.29 (Ubuntu)
content-encoding: gzip
etag: "8b12-5fbf5cd458d40-gzip"
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
content-type: application/javascript
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
accept-ranges: bytes
content-length: 9321

GET
H2 200 jamf-script-editor.js Show response
www.jamf.com/js/webcomponents/nebula/ 62 KB
15 KB 180ms
178ms Script
application/javascript 54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/js/webcomponents/nebula/jamf-script-editor.js?v=20230518060642

Requested by

Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

52b2c9f777cc2e1e51f74fdebcbed2af52e26774f25a0a6d138991e6202062d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
last-modified: Thu, 18 May 2023 11:06:53 GMT
server: Apache/2.4.29 (Ubuntu)
content-encoding: gzip
etag: "f914-5fbf5cd458d40-gzip"
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
content-type: application/javascript
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
accept-ranges: bytes
content-length: 14896

GET
H2 200 webcomponents.js Show response
www.jamf.com/scripts/ 594 KB
168 KB 206ms
205ms Script
application/javascript 54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/scripts/webcomponents.js?v=20230518060642

Requested by

Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

79e3b0211c316c36227f21a0ef4a0cd5744295981d539a855c4556461b7fdcc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
last-modified: Thu, 18 May 2023 11:09:49 GMT
server: Apache/2.4.29 (Ubuntu)
content-encoding: gzip
etag: "94645-5fbf5d7c31940-gzip"
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
content-type: application/javascript
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
accept-ranges: bytes

GET
H2 200 jquery.min.js Show response
www.jamf.com/js/ 87 KB
31 KB 198ms
197ms Script
application/javascript 54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/js/jquery.min.js?v=20230518060642

Requested by

Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

cd2d359251224ba9e2d52ffa24ff57d11ffd8d67bad1670fac88e4cb03075d19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
last-modified: Thu, 18 May 2023 11:10:27 GMT
server: Apache/2.4.29 (Ubuntu)
content-encoding: gzip
etag: "15c75-5fbf5da06eec0-gzip"
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
content-type: application/javascript
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
accept-ranges: bytes
content-length: 30899

GET
H2 200 index.js Show response
www.jamf.com/js/webcomponents/jamf-account/ 102 KB
24 KB 104ms
104ms Script
application/javascript 54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/js/webcomponents/jamf-account/index.js?v=20230518060642

Requested by

Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

03527ef045daf323f21897cbab84c09ead0a49a0f1ae85bfabe46f4d8da91b86

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
last-modified: Thu, 18 May 2023 11:09:23 GMT
server: Apache/2.4.29 (Ubuntu)
content-encoding: gzip
etag: "1998c-5fbf5d6365ec0-gzip"
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
content-type: application/javascript
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
accept-ranges: bytes
content-length: 24050

GET
H2 200 custom.js Show response
www.jamf.com/scripts/ 47 KB
10 KB 103ms
103ms Script
application/javascript 54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/scripts/custom.js?v=20230518060642

Requested by

Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

9f3eaa7083276dd707bea1221736150cf3665e3528a0f0c8ac3afd5ad137ac6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
last-modified: Thu, 18 May 2023 11:09:49 GMT
server: Apache/2.4.29 (Ubuntu)
content-encoding: gzip
etag: "ba1a-5fbf5d7c31940-gzip"
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
content-type: application/javascript
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
accept-ranges: bytes
content-length: 8945

GET
H2 200 jamf-one-color-dark-for-print-css.svg
resources.jamf.com/images/logos/ 1 KB
1 KB 66ms
21ms Image
image/svg+xml 143.204.176.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://resources.jamf.com/images/logos/jamf-one-color-dark-for-print-css.svg
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.176.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-176-111.lhr50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 41ab5fe54178008304401cafcbd15e7028bc7bacd8d35bdc4426a825383f48db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-amz-version-id: 8qDxh1nyFEiPATU0peuHO.PIFUumQ8Y0
content-encoding: gzip
via: 1.1 8566cb770d0695bb6bffb61a26f5b400.cloudfront.net (CloudFront)
date: Mon, 22 May 2023 04:28:29 GMT
last-modified: Fri, 05 Oct 2018 18:53:57 GMT
server: AmazonS3
x-amz-cf-pop: LHR50-C1
age: 57717
etag: W/"55abc948af2b541a5847f4fd0768e026"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
x-amz-cf-id: VtCf_RzSmQLT4bBrs-ROJ5ruj2nnJJvR3lT8sf8ENakYEW79wxxNzQ==

GET
H2 200 bluenorof-rustbucket-malware_1.jpg
media.jamf.com/images/news/ 112 KB
113 KB 132ms
46ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/bluenorof-rustbucket-malware_1.jpg?q=80&w=1500
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 03606298f83a14e50ad6ac2a9cd00ba2560f83a2722c6725d2652adb32824599

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:25 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 13:58:35 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 80530
x-amz-server-side-encryption: AES256
etag: "baf56235720b5ee97a6a29da1689e747"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 114737
x-amz-cf-id: xKcaoHTmV9nxP8h2XbXB4Wj2sRuzV1LFN3lFTUsuH6JCHiTvUXAiEg==

GET
H2 200 bluenorof-rustbucket-malware-01_1.jpg
media.jamf.com/images/news/ 58 KB
58 KB 164ms
79ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/bluenorof-rustbucket-malware-01_1.jpg?q=80&w=1200
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: df0bd1ad124b174b6e77a4c94c9ff9902f93f80a3ca2b52af7a5b3297a98d13d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 05:43:46 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 15:14:05 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 53200
x-amz-server-side-encryption: AES256
etag: "05a7326af7c59a6c799a5e6ac4332d95"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 59273
x-amz-cf-id: JNpD2eHX9ogv3p5k1yx6pBf35J9l2U18dKDFt9eAw-_11N2W2_jGSQ==

GET
H2 200 bluenorof-rustbucket-malware-02_1.jpg
media.jamf.com/images/news/ 19 KB
19 KB 178ms
93ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/bluenorof-rustbucket-malware-02_1.jpg?q=80&w=1200
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 71f207ddc31602238ca63b1abb9d6a64cb8473bc89f07e7fca9068032112c85d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 08:24:41 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 15:14:04 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 43545
x-amz-server-side-encryption: AES256
etag: "100f0ed9532a2481920ccb19540539df"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 19254
x-amz-cf-id: ta2ztpMQnxiTf1pVIigSdcaZl14Ov95q2t78zQvhtK2BvYBF2u43BQ==

GET
H2 200 bluenorof-rustbucket-malware-03_1.jpg
media.jamf.com/images/news/ 20 KB
20 KB 128ms
43ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/bluenorof-rustbucket-malware-03_1.jpg?q=80&w=1200
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0c226eb7653ec6da5bc914f0e1d83a965eeb006be3687701f536056f2adbb64f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 05:43:46 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 15:14:04 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 53200
x-amz-server-side-encryption: AES256
etag: "85f6fac48f16aa774e0eb89acc751c90"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 20106
x-amz-cf-id: wNPQPK9IHrF2IVFGm-AdM_MLrvFWzNdklOBjl6gRGgHLYJZ23fS8dw==

GET
H2 200 bluenorof-rustbucket-malware-04_1.jpg
media.jamf.com/images/news/ 60 KB
60 KB 174ms
88ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/bluenorof-rustbucket-malware-04_1.jpg?q=80&w=1200
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 755b1599c7164f6c0399500a2401fb1c351a12cb48b989cb9b3a0507ab3a6cc8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 05:43:47 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 15:14:05 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 53199
x-amz-server-side-encryption: AES256
etag: "220a8d03a08e630fb88f1ed0aae6d23e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 61340
x-amz-cf-id: hYog2A4BuC8gRqUPySD8VZeK7B6SGYAGZzJJGTSbMGOXpeZLP4aPBA==

GET
H2 200 bluenorof-rustbucket-malware-05_1.jpg
media.jamf.com/images/news/ 11 KB
12 KB 171ms
86ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/bluenorof-rustbucket-malware-05_1.jpg?q=80&w=1200
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ba16615b149c13dda192d35e8419a6b407e2d5a1f8ca98db613001fe26f69a4b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 05:43:47 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 15:14:04 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 53199
x-amz-server-side-encryption: AES256
etag: "bda7a1358db3805a02e2f1640dc1f279"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 11621
x-amz-cf-id: 7eVKuyeMiBlbEcAC2Eq5wGdvAndbBrlKYEayY_lzB_CkPWMW2TQFUw==

GET
H2 200 bluenorof-rustbucket-malware-06_1.jpg
media.jamf.com/images/news/ 44 KB
45 KB 104ms
103ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/bluenorof-rustbucket-malware-06_1.jpg?q=80&w=1200
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ad52c1e360a52b5cfe16fb078d88bc2950e814ad19f83d5577a5ec191b9b5f80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 05:43:48 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 15:14:05 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 53198
etag: "cbc9f0c75443d79bd828aa0493a6d150"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 45175
x-amz-cf-id: wvWa1hByjI3h1kgBXU-CEBPYOC9kkfpmbbi14_kP-7Jn0f3olE3tBw==

GET
H2 200 bluenorof-rustbucket-malware-07_1.jpg
media.jamf.com/images/news/ 51 KB
51 KB 79ms
78ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/bluenorof-rustbucket-malware-07_1.jpg?q=80&w=1200
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 630077042b1848bbfb3e5ec1bcfd1cd3447ba63b9732200364adb927bd7985ea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 05:43:48 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 15:14:05 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 53198
x-amz-server-side-encryption: AES256
etag: "a1f31300a9bb71c7373cfe7522c0dd89"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 52280
x-amz-cf-id: s_Ys6bvJB_w9GA9TAB7oQ-3yA1ziknOyTVQrStsT7ee70_2Eyrn-Tg==

GET
H2 200 bluenorof-rustbucket-malware-08_1.jpg
media.jamf.com/images/news/ 105 KB
106 KB 74ms
73ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/bluenorof-rustbucket-malware-08_1.jpg?q=80&w=1200
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3a5707468277c3d265f308b1dc1cf59061efb68c444c562ef213487f4a88e593

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 05:43:48 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 15:14:06 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 53198
x-amz-server-side-encryption: AES256
etag: "3c018814c07f39155cf2a25733393043"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 107637
x-amz-cf-id: wMjVLbRan557Ny1rgjAoXDov85_AkyBJheItovT1Og6b2rM2TiFw6g==

GET
H2 200 bluenorof-rustbucket-malware-09_1.jpg
media.jamf.com/images/news/ 111 KB
112 KB 99ms
98ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/bluenorof-rustbucket-malware-09_1.jpg?q=80&w=1200
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ff8b954f35672b3c283c36c177e7d7e4ca109fb81c273be61c1f19c798969c5d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 05:43:48 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 15:14:07 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 53198
x-amz-server-side-encryption: AES256
etag: "993cbbe2c22547a2968f630932502933"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 113702
x-amz-cf-id: LFvYjg9YGa9QyTqgJDyrncD3Wuwi1rhXNbuVqZfKUqeer-_2ZIBruw==

GET
H2 200 bluenorof-rustbucket-malware-10_1.jpg
media.jamf.com/images/news/ 207 KB
207 KB 108ms
107ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/bluenorof-rustbucket-malware-10_1.jpg?q=80&w=1200
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1e6bf8d3831701706b3ac0dcbeb445e4551bdb08b21a48dd644cf40379763d0f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 08:24:42 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 15:14:07 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 43544
x-amz-server-side-encryption: AES256
etag: "b21d6e822e81ea41e4cc09e50fb78e17"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 211758
x-amz-cf-id: 99o_SZygwa48Z7SIHb-7HiftvTO9ke5h3_BgisgIiKcXqjyX0eUF3A==

GET
H2 200 bluenorof-rustbucket-malware-11_1.jpg
media.jamf.com/images/news/ 14 KB
14 KB 73ms
72ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/bluenorof-rustbucket-malware-11_1.jpg?q=80&w=1200
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4510fb72333a1c028b4684002fd9a6f550635e84005ce60f8066a40137b2238b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 05:43:48 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 15:14:06 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 53198
x-amz-server-side-encryption: AES256
etag: "aae9a8a76f6ebd1940e044e37f5defef"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 14211
x-amz-cf-id: 9qjLtYhGIVMaOahkqEtQx-y30Q7fjd64pQ6nqqEZ5o6iXQZDdUZ9bA==

GET
H2 200 bluenorof-rustbucket-malware-12_1.jpg
media.jamf.com/images/news/ 26 KB
26 KB 108ms
107ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/bluenorof-rustbucket-malware-12_1.jpg?q=80&w=1200
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d8b0d2cde6cfb790be375244d673e34b75905ac8b8904198ac8c5bb5600351b5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 05:43:48 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 15:14:07 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 53198
x-amz-server-side-encryption: AES256
etag: "0ec020fcf977938f83201eaaa33a54aa"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 26304
x-amz-cf-id: QCAdSx9ihGHn7lsmen3f_qZeZdqsdKmh-LGI9t79PGX0Ib3GCujtRw==

GET
H2 200 bluenorof-rustbucket-malware-13_1.jpg
media.jamf.com/images/news/ 41 KB
42 KB 76ms
75ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/bluenorof-rustbucket-malware-13_1.jpg?q=80&w=1200
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 283db430257471bcf4a2ea2b18e949a0897d5f3ffd8e33fec644e33e6659dd8c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 05:43:48 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 15:14:07 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 53198
x-amz-server-side-encryption: AES256
etag: "246a2bfe127a4be1d0e404327ce6e791"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 42090
x-amz-cf-id: J800lMCBhEiiE-bCE3KIJorDHG5_Tq-8Lmb7QcZRf9xa_joDcz0RnQ==

GET
H2 200 bluenorof-rustbucket-malware-14_1.jpg
media.jamf.com/images/news/ 37 KB
38 KB 87ms
86ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/bluenorof-rustbucket-malware-14_1.jpg?q=80&w=1200
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ae17bea6b094dc209ff21e07ba2d8ea7a703e498cc684bc52905e7b7b27d6551

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 08:24:41 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 15:14:08 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 43545
x-amz-server-side-encryption: AES256
etag: "b6030af28d90c926b253c510dff0fc75"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 38398
x-amz-cf-id: E7ewZMfZIaAW5O2tB3Yy7zROMNe0gczdOvYYuSumjEZf4NkM77pw1A==

GET
H2 200 bluenorof-rustbucket-malware-15_1.jpg
media.jamf.com/images/news/ 46 KB
47 KB 108ms
107ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/bluenorof-rustbucket-malware-15_1.jpg?q=80&w=1200
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 800a55f749b399958a6adbf8b1d44d1375f78a3a7b13424d45efd9fb2efdd138

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 05:43:49 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 15:14:08 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 53197
x-amz-server-side-encryption: AES256
etag: "9d26add39b8f207e28274c0ded4c2bf8"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 47333
x-amz-cf-id: 9h2bXhjZlhfDlLBjcJfxCgQJM30A27lLejnQjaPKNbgMPbaRbetyFA==

GET
H2 200 bluenorof-rustbucket-malware-16_1.jpg
media.jamf.com/images/news/ 83 KB
84 KB 105ms
104ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/bluenorof-rustbucket-malware-16_1.jpg?q=80&w=1200
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ecdfcc4d96894357c1e4dc252f24026e93c7e564e13b69b18d0a851c42870cb1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 08:24:41 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 15:14:09 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 43545
x-amz-server-side-encryption: AES256
etag: "36c896060397ef2e793f6b95149559ec"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 85461
x-amz-cf-id: 5fSLMGD0k8_QG9pA5WKWgqJ_8jXg8EIDCq-acE6iHBvwBYXHdRTbbQ==

GET
H2 200 bluenorof-rustbucket-malware-17_1.jpg
media.jamf.com/images/news/ 55 KB
56 KB 92ms
91ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/bluenorof-rustbucket-malware-17_1.jpg?q=80&w=1200
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4967e2b3bb9d4fe354eeca566ef0f3ec48285b7bf648a0013e936764ea944eab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 05:43:49 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 15:14:09 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 53197
x-amz-server-side-encryption: AES256
etag: "3cda0d77a4c9015f2664e5f24db16c56"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 56566
x-amz-cf-id: X_k1Co8SrrmDEWtm8ypMiYbsPX2NXhEZ4h18t2snr81UDLqagIPPIg==

GET
H2 200 bluenorof-rustbucket-malware-18_1.jpg
media.jamf.com/images/news/ 73 KB
73 KB 95ms
94ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/bluenorof-rustbucket-malware-18_1.jpg?q=80&w=1200
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4f8b13f1af80f6f866095b6828d5a4ddb8df617e03a781b6fd087246bdba96b2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 08:24:41 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 15:14:10 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 43544
x-amz-server-side-encryption: AES256
etag: "d6fbce6abccc650843973be1a40284a1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 74354
x-amz-cf-id: nslG-jolXNVt9aBmCPILYTFJJExp9aNKOwgH3430ggbiN7XuWMsWyA==

GET
H2 200 bluenorof-rustbucket-malware-19_1.jpg
media.jamf.com/images/news/ 52 KB
53 KB 89ms
88ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/bluenorof-rustbucket-malware-19_1.jpg?q=80&w=1200
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1c62cae2a38f72ce8c59a72efd531b2e65b3b5266a30c54cb8585cb1f614af22

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 05:43:49 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 15:14:09 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 53197
x-amz-server-side-encryption: AES256
etag: "b10b95a310bfbc64d66d79e1d82393ad"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 53574
x-amz-cf-id: kigQ0x3KTDI-Jdncsb1l7F42IVJpu1kCOXeZBRAFEnLk5kG15JEozQ==

GET
H2 200 what-is-jamf-threat-labs.jpg
media.jamf.com/images/news/ 37 KB
37 KB 92ms
91ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/news/what-is-jamf-threat-labs.jpg?q=80&w=500
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8c18aaa192a1ce53b8f4f5d89332dc4cdf3ec90a3ba7b12b8572e7504fc97275

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 13:34:17 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Tue, 10 May 2022 18:32:19 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 24969
etag: "5c21f02cb02a4af396f530ba12ba95cc"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 37808
x-amz-cf-id: Yph6ey1F3sMuyE4ASS3Hw6OzVCfRCubNzSwUchqtbQfvpZcXMGwdqw==

GET
H2 200 how-to-establish-a-threat-hunting-team-in-your-organization-resource-card-image.jpg
media.jamf.com/images/resources/white-papers/ 19 KB
20 KB 103ms
102ms Image
image/jpeg 18.66.15.110
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.jamf.com/images/resources/white-papers/how-to-establish-a-threat-hunting-team-in-your-organization-resource-card-image.jpg?q=80&w=500
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.110 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-110.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 94fc096f8e35067dd8297a7f791745a7c700fc7065fd544860b0289ceea2fef1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:25 GMT
via: 1.1 c88540a8a2d41c2f38fed4cab35cb4f0.cloudfront.net (CloudFront)
last-modified: Thu, 10 Feb 2022 15:51:57 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 24170
etag: "a61343416f10dff5e53817bb3ff2b314"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 19863
x-amz-cf-id: gsEa001YFloSHYmUAHeLKejya2LeQ-jvgEoS_WtrDTMAhz1Y2gHNcQ==

GET
H2 200 analytics.min.js Show response
cdn.segment.com/analytics.js/v1/t5I7xjAjlbs6x0yXQAOc7p1XbGBC00E5/ 104 KB
28 KB 149ms
57ms Script
text/javascript 18.244.110.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics.js/v1/t5I7xjAjlbs6x0yXQAOc7p1XbGBC00E5/analytics.min.js
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/js/jamf-critical.min.js?v=20230518060642
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.244.110.166 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-244-110-166.waw51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4074b479b600081783b7241953117ca27855226b6acd0fee0434e1b2e06e0318

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-amz-version-id: pkgC229t0HeSf.vjDZd5pVvgFVBeoPO8
content-encoding: br
via: 1.1 297c174f17e016a5e9732dd0ce7e0946.cloudfront.net (CloudFront)
date: Mon, 22 May 2023 20:30:25 GMT
x-amz-cf-pop: WAW51-P4
age: 95
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 09 May 2023 23:52:28 GMT
server: AmazonS3
etag: W/"e24490a1108fdee1846851efa37a0f1b"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=120
vary: Accept-Encoding
x-amz-cf-id: zSJiKYwMum1vTsFwS6so6AZ_kph5GmaKbPbn7-BB1BfY05ji8tNolg==

GET
H2 200 vendors~jamf-dropdown-vendors.js Show response
www.jamf.com/scripts/dep/ 18 KB
7 KB 104ms
103ms Script
application/javascript 54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/scripts/dep/vendors~jamf-dropdown-vendors.js

Requested by

Host: www.jamf.com
URL: https://www.jamf.com/scripts/webcomponents.js?v=20230518060642

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

6d444ef6c991190d067f7161f627b01004c785de1d21f500463c41448b7b112f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
last-modified: Thu, 18 May 2023 11:09:49 GMT
server: Apache/2.4.29 (Ubuntu)
content-encoding: gzip
etag: "4652-5fbf5d7c31940-gzip"
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
content-type: application/javascript
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
accept-ranges: bytes
content-length: 6326

GET
H2 200 vendors~jamf-script-editor-vendors.js Show response
www.jamf.com/js/webcomponents/nebula/dep/ 353 KB
111 KB 111ms
110ms Script
application/javascript 54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/js/webcomponents/nebula/dep/vendors~jamf-script-editor-vendors.js

Requested by

Host: www.jamf.com
URL: https://www.jamf.com/js/webcomponents/nebula/jamf-script-editor.js?v=20230518060642

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

1be1147aa2b56a6b06f3ffc4f3c40f632501714ae1af7e7bdf4e88709b6493b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
last-modified: Thu, 18 May 2023 11:06:53 GMT
server: Apache/2.4.29 (Ubuntu)
content-encoding: gzip
etag: "58523-5fbf5cd458d40-gzip"
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
content-type: application/javascript
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
accept-ranges: bytes

GET
H2 200 jamf-script-editor-vendors.js Show response
www.jamf.com/js/webcomponents/nebula/dep/ 320 B
1 KB 103ms
102ms Script
application/javascript 54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/js/webcomponents/nebula/dep/jamf-script-editor-vendors.js

Requested by

Host: www.jamf.com
URL: https://www.jamf.com/js/webcomponents/nebula/jamf-script-editor.js?v=20230518060642

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

76b8709268b15be6e2a86baee991bf50d363d2434309a47453c11868e4d45214

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
last-modified: Thu, 18 May 2023 11:06:53 GMT
server: Apache/2.4.29 (Ubuntu)
content-encoding: gzip
etag: "140-5fbf5cd458d40-gzip"
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
content-type: application/javascript
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
accept-ranges: bytes
content-length: 213

GET
H2 200 jcon_6372353d58f40790101470a75b02ecf2.woff2
resources.jamf.com/type/ 24 KB
25 KB 24ms
24ms Font
font/woff2 143.204.176.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.jamf.com/type/jcon_6372353d58f40790101470a75b02ecf2.woff2
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/css/main.css?v=20230518060642
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.176.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-176-111.lhr50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 414be1cf7d1a22d082c3c58a8d5f1f32d1df213625f67e865d340f15eb7bf7f8

Request headers

Referer: https://www.jamf.com/
Origin: https://www.jamf.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 09 May 2023 21:40:39 GMT
x-amz-version-id: 0k2zna3QN9w7pnBlPP3QtYam9eaRghG0
via: 1.1 bfb6f7dc0d2f5ec95537e251cdcf5524.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-C1
age: 1118987
x-cache: Hit from cloudfront
content-length: 24836
last-modified: Tue, 02 Mar 2021 19:02:56 GMT
server: AmazonS3
etag: "d69debcb451a5876e1d9faa48422717f"
vary: Origin
access-control-allow-methods: GET, HEAD
content-type: font/woff2
access-control-allow-origin: https://www.jamf.com
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
x-amz-cf-id: J8i45nVWq8uwGU--Fa63oL_fTH5--dOKvRijlYTQypHk4z6uKelBZQ==

GET
H2 200 / Show response
www.jamf.com/oauth/user/ 2 B
878 B 107ms
106ms Fetch
application/json 54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/oauth/user/

Requested by

Host: www.jamf.com
URL: https://www.jamf.com/js/webcomponents/jamf-account/index.js?v=20230518060642

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
server: Apache/2.4.29 (Ubuntu)
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
content-type: application/json
x-frame-options: SAMEORIGIN
content-length: 2

GET
H2 200 / Show response
www.jamf.com/oauth/user/ 2 B
867 B 107ms
107ms Fetch
application/json 54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/oauth/user/

Requested by

Host: www.jamf.com
URL: https://www.jamf.com/js/webcomponents/jamf-account/index.js?v=20230518060642

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
server: Apache/2.4.29 (Ubuntu)
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
content-type: application/json
x-frame-options: SAMEORIGIN
content-length: 2

GET
H2 200 / Show response
www.jamf.com/oauth/user/ 2 B
871 B 107ms
107ms Fetch
application/json 54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/oauth/user/

Requested by

Host: www.jamf.com
URL: https://www.jamf.com/js/webcomponents/jamf-account/index.js?v=20230518060642

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
server: Apache/2.4.29 (Ubuntu)
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
content-type: application/json
x-frame-options: SAMEORIGIN
content-length: 2

GET
H2 200 / Show response
www.jamf.com/oauth/user/ 2 B
866 B 106ms
106ms Fetch
application/json 54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/oauth/user/

Requested by

Host: www.jamf.com
URL: https://www.jamf.com/js/webcomponents/jamf-account/index.js?v=20230518060642

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
server: Apache/2.4.29 (Ubuntu)
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
content-type: application/json
x-frame-options: SAMEORIGIN
content-length: 2

GET
H2 200 a26e7c0f
d21y75miwcfqoq.cloudfront.net/ 68 B
455 B 740ms
637ms Image
image/png 2600:9000:2181:5400:1b:ef38:3680:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d21y75miwcfqoq.cloudfront.net/a26e7c0f
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2181:5400:1b:ef38:3680:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:27 GMT
x-amz-version-id: null
via: 1.1 d0945be30f5a4a7ae05683911a5fea2c.cloudfront.net (CloudFront)
last-modified: Mon, 17 May 2021 18:46:15 GMT
server: AmazonS3
x-amz-cf-pop: MRS52-P2
etag: "91e42db1c66c0b276abf6234dc50b2eb"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-type: image/png
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 68
x-amz-cf-id: Ap8mUBcc1vf4YMyzWfDcQaE8yLrYqSwiXybiM9mG90MzGwIaBl3R2Q==

GET
H2 200 settings Show response
cdn.segment.com/v1/projects/t5I7xjAjlbs6x0yXQAOc7p1XbGBC00E5/ 2 KB
1 KB 99ms
31ms Fetch
application/json 18.244.110.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/v1/projects/t5I7xjAjlbs6x0yXQAOc7p1XbGBC00E5/settings
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/t5I7xjAjlbs6x0yXQAOc7p1XbGBC00E5/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.244.110.166 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-244-110-166.waw51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: eb5e34fe9463f9b4e1408a38dd4b6ecac021eecac4f30a022fc28c177f2d7a80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-amz-version-id: 1jzJ5wKftcIalo7QoESBADyST8iTY4TZ
content-encoding: gzip
via: 1.1 3e06a22abc3358fceefdff5d54e3c3b0.cloudfront.net (CloudFront)
date: Mon, 22 May 2023 17:40:32 GMT
x-amz-cf-pop: WAW51-P4
age: 10592
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Fri, 14 Oct 2022 21:03:58 GMT
server: AmazonS3
etag: W/"d7965a76e4d8ff7644235778572e4c9f"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=10800
vary: Accept-Encoding
x-amz-cf-id: y-PmRIYq1BvqAx8qsFtbXfFflm8ZSEzX5320rLkBBGJaad8T5Ncc3Q==

GET
H2 200 ajs-destination.bundle.a1b5627f72b6c90f2baa.js Show response
cdn.segment.com/analytics-next/bundles/ 9 KB
3 KB 28ms
28ms Script
application/javascript 18.244.110.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics-next/bundles/ajs-destination.bundle.a1b5627f72b6c90f2baa.js
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/t5I7xjAjlbs6x0yXQAOc7p1XbGBC00E5/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.244.110.166 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-244-110-166.waw51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d976009e0ff2a163ec0fec368655f9d213b36817354f1d3f02cfbc99dbff51e7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 26 Apr 2023 17:07:44 GMT
x-amz-version-id: lG8QOVJuTZu8g20FGZd7OaJDhvnzeCqR
content-encoding: br
via: 1.1 297c174f17e016a5e9732dd0ce7e0946.cloudfront.net (CloudFront)
x-amz-cf-pop: WAW51-P4
age: 2258563
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Wed, 26 Apr 2023 16:07:24 GMT
server: AmazonS3
etag: W/"dba2c033bf5f6f351c330af3a7fde619"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
vary: Accept-Encoding
x-amz-cf-id: 55Tp4NW_JY6PuiSGNa-n7N8KZWRWUruoFA9n2i11FSZVMB2c6C6ltQ==

GET
H2 200 schemaFilter.bundle.f63551a29dc1697f71b6.js Show response
cdn.segment.com/analytics-next/bundles/ 2 KB
1 KB 31ms
31ms Script
application/javascript 18.244.110.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics-next/bundles/schemaFilter.bundle.f63551a29dc1697f71b6.js
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/t5I7xjAjlbs6x0yXQAOc7p1XbGBC00E5/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.244.110.166 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-244-110-166.waw51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b79a43a28dc356d07de97ee365a01d714812e2eb02b15397cefb226d2a019a83

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 08 May 2023 00:13:50 GMT
x-amz-version-id: zFzJz_MZg1UBV8OwiqrW6RV6wRgSvoyC
content-encoding: gzip
via: 1.1 297c174f17e016a5e9732dd0ce7e0946.cloudfront.net (CloudFront)
x-amz-cf-pop: WAW51-P4
age: 1282597
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 08 May 2023 00:07:07 GMT
server: AmazonS3
etag: W/"2a359f6227308e4ee31623f9381ae1d7"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
vary: Accept-Encoding
x-amz-cf-id: VGOpiWpbifoXcg9xjVGA_LHEQgrlMREmmCCeg12GPMnnaAbfdFpqYA==

GET
H2 200 google-analytics.dynamic.js.gz Show response
cdn.segment.com/next-integrations/integrations/google-analytics/2.18.5/ 16 KB
5 KB 28ms
27ms Script
application/javascript 18.244.110.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/google-analytics/2.18.5/google-analytics.dynamic.js.gz
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/t5I7xjAjlbs6x0yXQAOc7p1XbGBC00E5/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.244.110.166 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-244-110-166.waw51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fdda2bf7d8e87b5ac90a791a5131a9811c207171107482857b67f6b8329854fb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 09 May 2023 09:28:40 GMT
content-encoding: gzip
via: 1.1 297c174f17e016a5e9732dd0ce7e0946.cloudfront.net (CloudFront)
x-amz-version-id: 7_7PNZUD2yJMe93eR9qYeokPyapGnySW
x-amz-cf-pop: WAW51-P4
age: 1162907
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 4743
last-modified: Wed, 03 May 2023 11:04:44 GMT
server: AmazonS3
etag: "36786f75981fc0efd629c4a89e1c78ec"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
accept-ranges: bytes
x-amz-cf-id: ppgEM4T38qszaFQWf12tm7bXvRW2j2Zi5aPK-TD7-mQvw__PV3tzhA==

GET
H2 200 marketo.dynamic.js.gz Show response
cdn.segment.com/next-integrations/integrations/marketo/2.0.2/ 3 KB
2 KB 28ms
28ms Script
application/javascript 18.244.110.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/marketo/2.0.2/marketo.dynamic.js.gz
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/t5I7xjAjlbs6x0yXQAOc7p1XbGBC00E5/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.244.110.166 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-244-110-166.waw51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4bc2e69e7ed55fe596e9bb67ec777f6440165cae4a06ef76212cc9e5ed5d761a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Fri, 12 May 2023 00:35:27 GMT
content-encoding: gzip
via: 1.1 297c174f17e016a5e9732dd0ce7e0946.cloudfront.net (CloudFront)
x-amz-version-id: j3j_Waptt8F7LGUutLt_UPr4oEhJJy4.
x-amz-cf-pop: WAW51-P4
age: 935700
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 1598
last-modified: Wed, 03 May 2023 11:04:44 GMT
server: AmazonS3
etag: "c33f657f471dc2b99ecf4d1849a460bc"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
accept-ranges: bytes
x-amz-cf-id: VGZ1r-xV5Qy_bgtZYmc5U3rXzj9Q2xDng08DkTP9q6yo64jyUyYCug==

GET
H2 200 commons.c42222c4cb2f8913500f.js.gz Show response
cdn.segment.com/next-integrations/integrations/vendor/ 73 KB
22 KB 32ms
32ms Script
application/javascript 18.244.110.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/next-integrations/integrations/vendor/commons.c42222c4cb2f8913500f.js.gz
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/t5I7xjAjlbs6x0yXQAOc7p1XbGBC00E5/analytics.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.244.110.166 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-244-110-166.waw51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b17b4a5cc840a366a4c006794502f887a316402f781f85e913ac4af19a93fc13

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sat, 22 Apr 2023 05:54:11 GMT
content-encoding: gzip
via: 1.1 297c174f17e016a5e9732dd0ce7e0946.cloudfront.net (CloudFront)
x-amz-version-id: _CDAHRpSMnFhUQgRIVvCIby4N2cITv0X
x-amz-cf-pop: WAW51-P4
age: 2644576
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 22177
last-modified: Mon, 17 Apr 2023 06:44:02 GMT
server: AmazonS3
etag: "befb217271e2e926c7d898f1c85f6cb7"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
accept-ranges: bytes
x-amz-cf-id: iH2PpUG4qS4SqbkLJKLx2PJDQVif5tSr8NLdSBacKtJug0IlMqKq7w==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 28ms
7ms Script
text/javascript 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: cdn.segment.com
URL: https://cdn.segment.com/next-integrations/integrations/vendor/commons.c42222c4cb2f8913500f.js.gz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 22 May 2023 18:35:39 GMT
last-modified: Mon, 17 Apr 2023 22:36:01 GMT
server: Golfe2
age: 6887
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20737
expires: Mon, 22 May 2023 20:35:39 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 46ms
8ms Script
application/x-javascript 104.102.38.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/next-integrations/integrations/vendor/commons.c42222c4cb2f8913500f.js.gz
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.102.38.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-38-132.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Mon, 22 May 2023 20:30:26 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Mar 2023 01:24:48 GMT
Server: AkamaiNetStorage
ETag: "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 729

GET
H2 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 19:55:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2111
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 859
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 22 May 2023 20:55:15 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 9ms
8ms Script
application/x-javascript 104.102.38.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.102.38.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-38-132.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Mon, 22 May 2023 20:30:26 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type: application/x-javascript
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4741
Expires: Wed, 30 Aug 2023 20:30:26 GMT

POST
H/1.1 200
OK visitWebPage
704-vyp-527.mktoresp.com/webevents/ 2 B
318 B 1367ms
155ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://704-vyp-527.mktoresp.com/webevents/visitWebPage?_mchNc=1684787426302&_mchCn=&_mchId=704-VYP-527&_mchTk=_mch-jamf.com-1684787426302-93672&_mchHo=www.jamf.com&_mchPo=&_mchRu=%2Fblog%2Fbluenoroff-apt-targets-macos-rustbucket-malware%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Mon, 22 May 2023 20:30:27 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: fa32ea7e-5926-44ff-bf6f-e5d1aed90546

GET
H2 200 jamf-non-critical.min.js Show response
www.jamf.com/js/ 270 KB
80 KB 110ms
109ms Script
application/javascript 54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/js/jamf-non-critical.min.js?v=20230518060642

Requested by

Host: www.jamf.com
URL: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

0b61281190a07db14aa7161ba50be3764d79c52bb4346e46e5cb636ac5e20799

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
last-modified: Thu, 18 May 2023 11:10:24 GMT
server: Apache/2.4.29 (Ubuntu)
content-encoding: gzip
etag: "438dc-5fbf5d9d92800-gzip"
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
content-type: application/javascript
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
accept-ranges: bytes

GET
H2 200 geofeed Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/location/ 75 B
243 B 47ms
21ms Script
text/javascript 2606:4700:4400::ac40:9062
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location/geofeed

Requested by

Host: www.jamf.com
URL: https://www.jamf.com/js/jamf-non-critical.min.js?v=20230518060642

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9062 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b7380dc25bb32b2bb3f3d43c073177de3475c8c6b38d49008271a21d5402c976

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
cf-ray: 7cb7d1291f0e1cab-FRA
vary: Accept-Encoding
content-type: text/javascript

GET
H2 200 print.css
www.jamf.com/css/ 20 KB
6 KB 101ms
101ms Stylesheet
text/css 54.173.104.166
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.jamf.com/css/print.css?v=20230518060642

Requested by

Host: www.jamf.com
URL: https://www.jamf.com/js/jquery.min.js?v=20230518060642

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.173.104.166 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-173-104-166.compute-1.amazonaws.com

Software

Apache/2.4.29 (Ubuntu) /

Resource Hash

8f291ca4fc17e6824073bc759d321b6bd818be94a6bae1211b653e796f61847b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 22 May 2023 20:30:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
last-modified: Thu, 18 May 2023 11:10:07 GMT
server: Apache/2.4.29 (Ubuntu)
content-encoding: gzip
etag: "4f35-5fbf5d8d5c1c0-gzip"
content-security-policy-report-only: default-src https: data: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; report-uri /csp-violation-report-endpoint.php; report-to csp-endpoint
report-to: {'group': 'csp-endpoint', 'max_age': 10886400, 'url': '/csp-violation-report-endpoint.php'}
content-type: text/css
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
accept-ranges: bytes
content-length: 5021

GET
H2 200 museo-slab-regular.woff2
resources.jamf.com/type/ 39 KB
40 KB 21ms
20ms Font
binary/octet-stream 143.204.176.111
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.jamf.com/type/museo-slab-regular.woff2
Requested by: Host: www.jamf.com
URL: https://www.jamf.com/css/main.css?v=20230518060642
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.176.111 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-176-111.lhr50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3ae9ac6e8a07d68109d7f7cf0accaae7906bbdb687556f14aa043469d8fca50b

Request headers

Referer: https://www.jamf.com/
Origin: https://www.jamf.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sat, 13 May 2023 15:42:48 GMT
x-amz-version-id: H8GhlxcZHuztdbc4Zb5nl3olJHK2sfs0
via: 1.1 bfb6f7dc0d2f5ec95537e251cdcf5524.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-C1
age: 794859
x-cache: Hit from cloudfront
content-length: 40363
last-modified: Wed, 13 Sep 2017 14:58:22 GMT
server: AmazonS3
etag: "f2987afe0d1edbb68faa0cd8f12698e7"
vary: Origin
access-control-allow-methods: GET, HEAD
content-type: binary/octet-stream
access-control-allow-origin: https://www.jamf.com
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
x-amz-cf-id: l7dPvixAB-Y0K3wNIy7-K8kjXbINec1ZTQ1a0N8Q6Lv93BM01Dtngg==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
347 B 80ms
22ms XHR
text/plain 2a00:1450:400c:c09::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j100&tid=UA-16025153-10&cid=1838187071.1684787426&jid=659250075&gjid=611253772&_gid=435930714.1684787426&_u=aGBAiEAjBAAAAEgCIAD~&z=462107953

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c09::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.jamf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 22 May 2023 20:30:26 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.jamf.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 6ms
6ms Image
image/gif 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j100&a=1398973261&t=pageview&_s=1&dl=https%3A%2F%2Fwww.jamf.com%2Fblog%2Fbluenoroff-apt-targets-macos-rustbucket-malware%2F&dp=%2Fblog%2Fbluenoroff-apt-targets-macos-rustbucket-malware%2F&ul=en-us&de=UTF-8&dt=%27RustBucket%27%20malware%20targets%20macOS&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAiEAjBAAAAAgCIAB~&jid=659250075&gjid=611253772&cid=1838187071.1684787426&tid=UA-16025153-10&_gid=435930714.1684787426&z=138117589

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 22 May 2023 15:20:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 18606
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 p Show response
api.segment.io/v1/ 21 B
172 B 741ms
175ms Fetch
application/json 54.218.150.145
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.segment.io/v1/p

Requested by

Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/t5I7xjAjlbs6x0yXQAOc7p1XbGBC00E5/analytics.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.218.150.145 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-218-150-145.us-west-2.compute.amazonaws.com

Software

Resource Hash

12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.jamf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.jamf.com
date: Mon, 22 May 2023 20:30:27 GMT
strict-transport-security: max-age=31536000
content-length: 21
vary: Origin
content-type: application/json

POST
H2 200 i Show response
api.segment.io/v1/ 21 B
171 B 740ms
175ms Fetch
application/json 54.218.150.145
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.segment.io/v1/i

Requested by

Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/t5I7xjAjlbs6x0yXQAOc7p1XbGBC00E5/analytics.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.218.150.145 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-218-150-145.us-west-2.compute.amazonaws.com

Software

Resource Hash

12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.jamf.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.jamf.com
date: Mon, 22 May 2023 20:30:27 GMT
strict-transport-security: max-age=31536000
content-length: 21
vary: Origin
content-type: application/json

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 66ms
45ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-16025153-10&cid=1838187071.1684787426&jid=659250075&_u=aGBAiEAjBAAAAEgCIAD~&z=266836832

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 22 May 2023 20:30:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 529ms
44ms Image
image/gif 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-16025153-10&cid=1838187071.1684787426&jid=659250075&_u=aGBAiEAjBAAAAEgCIAD~&z=266836832

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.jamf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 22 May 2023 20:30:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

106 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.jamf.com/	1970-01-20 11:59:54	Name: exp_exp_csrf_token Value: ef6c5907297f8c202ca7cc65041b34f150453c05
www.jamf.com/	1969-12-31 23:59:59	Name: WWWBALANCEID Value: aws.jamfweb-www-wa-2
.jamf.com/	1970-01-20 21:35:47	Name: _ga Value: GA1.2.1838187071.1684787426
.jamf.com/	1970-01-20 12:01:13	Name: _gid Value: GA1.2.435930714.1684787426
.jamf.com/	1970-01-20 21:35:47	Name: _mkto_trk Value: id:704-VYP-527&token:_mch-jamf.com-1684787426302-93672
.jamf.com/	1970-01-20 12:01:13	Name: cookieconsent_country_code Value: DE
.jamf.com/	1970-01-20 20:45:23	Name: ajs_anonymous_id Value: df1e924a-e631-4c77-ae11-6a0c996d5c59
.jamf.com/	1969-12-31 23:59:59	Name: cookieconsent_initialized Value: true
.jamf.com/	1970-01-20 11:59:47	Name: _gat Value: 1
www.jamf.com/	1970-01-20 12:09:52	Name: AWSALB Value: OK923M+tCvlCuaQ+p4PIA66NlhkLnMzOqfFJu4GraOvCmlJggIlZQTAN4v/l/idN825YSeVTaaVx1/8bF9xIUKOp17os/aMPDx09/QKOjv/lFRLu0/u4pDdvIHJx
www.jamf.com/	1970-01-20 12:09:52	Name: AWSALBCORS Value: OK923M+tCvlCuaQ+p4PIA66NlhkLnMzOqfFJu4GraOvCmlJggIlZQTAN4v/l/idN825YSeVTaaVx1/8bF9xIUKOp17os/aMPDx09/QKOjv/lFRLu0/u4pDdvIHJx

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

704-vyp-527.mktoresp.com
api.segment.io
cdn.segment.com
d21y75miwcfqoq.cloudfront.net
geolocation.onetrust.com
media.jamf.com
munchkin.marketo.net
resources.jamf.com
stats.g.doubleclick.net
tinyurl.com
www.google-analytics.com
www.google.com
www.google.de
www.jamf.com
104.102.38.132
143.204.176.111
18.244.110.166
18.66.15.110
192.28.147.68
2600:9000:2181:5400:1b:ef38:3680:21
2606:4700:10::6814:8b41
2606:4700:4400::ac40:9062
2a00:1450:4001:812::200e
2a00:1450:4001:827::2004
2a00:1450:4001:830::2003
2a00:1450:400c:c09::9c
54.173.104.166
54.218.150.145
03527ef045daf323f21897cbab84c09ead0a49a0f1ae85bfabe46f4d8da91b86
03606298f83a14e50ad6ac2a9cd00ba2560f83a2722c6725d2652adb32824599
0b61281190a07db14aa7161ba50be3764d79c52bb4346e46e5cb636ac5e20799
0c226eb7653ec6da5bc914f0e1d83a965eeb006be3687701f536056f2adbb64f
12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254
1be1147aa2b56a6b06f3ffc4f3c40f632501714ae1af7e7bdf4e88709b6493b2
1c62cae2a38f72ce8c59a72efd531b2e65b3b5266a30c54cb8585cb1f614af22
1e6bf8d3831701706b3ac0dcbeb445e4551bdb08b21a48dd644cf40379763d0f
2024f8a682cdb8eb3579fdff57575d3421804950cfcadda88a093398fc8ea7f9
204f8619417a0727f80bfab85bdd0d8e08a8821b771ec410eaaeab81e95b3f90
283db430257471bcf4a2ea2b18e949a0897d5f3ffd8e33fec644e33e6659dd8c
3a5707468277c3d265f308b1dc1cf59061efb68c444c562ef213487f4a88e593
3ae9ac6e8a07d68109d7f7cf0accaae7906bbdb687556f14aa043469d8fca50b
4074b479b600081783b7241953117ca27855226b6acd0fee0434e1b2e06e0318
414be1cf7d1a22d082c3c58a8d5f1f32d1df213625f67e865d340f15eb7bf7f8
41ab5fe54178008304401cafcbd15e7028bc7bacd8d35bdc4426a825383f48db
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4510fb72333a1c028b4684002fd9a6f550635e84005ce60f8066a40137b2238b
4967e2b3bb9d4fe354eeca566ef0f3ec48285b7bf648a0013e936764ea944eab
4bc2e69e7ed55fe596e9bb67ec777f6440165cae4a06ef76212cc9e5ed5d761a
4f8b13f1af80f6f866095b6828d5a4ddb8df617e03a781b6fd087246bdba96b2
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
52b2c9f777cc2e1e51f74fdebcbed2af52e26774f25a0a6d138991e6202062d3
532336cd1e9ff5bd041c34b85d09503bf2182f9f73b1c6763220d5e621eefd7d
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
59617daaf38fc01aa17e1d1cc02e3f2a4c2bbaaf650d17348b7869d036ca1148
630077042b1848bbfb3e5ec1bcfd1cd3447ba63b9732200364adb927bd7985ea
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
67671093eef8d6a896a1bae9de4068642bbe8e3935cbf24c53dc310eed0aec0e
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6d444ef6c991190d067f7161f627b01004c785de1d21f500463c41448b7b112f
71f207ddc31602238ca63b1abb9d6a64cb8473bc89f07e7fca9068032112c85d
755b1599c7164f6c0399500a2401fb1c351a12cb48b989cb9b3a0507ab3a6cc8
76b8709268b15be6e2a86baee991bf50d363d2434309a47453c11868e4d45214
790d04bc004242670fe4909931ff8433f69620bd4b87879a3c2f11d1f20a7b89
79e3b0211c316c36227f21a0ef4a0cd5744295981d539a855c4556461b7fdcc7
800a55f749b399958a6adbf8b1d44d1375f78a3a7b13424d45efd9fb2efdd138
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8c18aaa192a1ce53b8f4f5d89332dc4cdf3ec90a3ba7b12b8572e7504fc97275
8ec451a959767e32e172802746f68ef9b36a6fbbb4c5e33d58b3ce653f67d266
8f291ca4fc17e6824073bc759d321b6bd818be94a6bae1211b653e796f61847b
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
94fc096f8e35067dd8297a7f791745a7c700fc7065fd544860b0289ceea2fef1
993ff53700dc37c5876024b174c233eaf629e7f0e581cdd1430dbc98b19e446c
9f3eaa7083276dd707bea1221736150cf3665e3528a0f0c8ac3afd5ad137ac6e
ad52c1e360a52b5cfe16fb078d88bc2950e814ad19f83d5577a5ec191b9b5f80
ae17bea6b094dc209ff21e07ba2d8ea7a703e498cc684bc52905e7b7b27d6551
b17b4a5cc840a366a4c006794502f887a316402f781f85e913ac4af19a93fc13
b7380dc25bb32b2bb3f3d43c073177de3475c8c6b38d49008271a21d5402c976
b79a43a28dc356d07de97ee365a01d714812e2eb02b15397cefb226d2a019a83
ba16615b149c13dda192d35e8419a6b407e2d5a1f8ca98db613001fe26f69a4b
c51d95a70da69fdaf1d0b36d4fd9de081aa4df8c0c46740ee0323866682b302c
cd2d359251224ba9e2d52ffa24ff57d11ffd8d67bad1670fac88e4cb03075d19
cea5674acfab00e21cc23be53647ee74e14fb8d23df9d4fe86a9d47eb160383f
d8b0d2cde6cfb790be375244d673e34b75905ac8b8904198ac8c5bb5600351b5
d976009e0ff2a163ec0fec368655f9d213b36817354f1d3f02cfbc99dbff51e7
df0bd1ad124b174b6e77a4c94c9ff9902f93f80a3ca2b52af7a5b3297a98d13d
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
eb5e34fe9463f9b4e1408a38dd4b6ecac021eecac4f30a022fc28c177f2d7a80
ecdfcc4d96894357c1e4dc252f24026e93c7e564e13b69b18d0a851c42870cb1
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fdda2bf7d8e87b5ac90a791a5131a9811c207171107482857b67f6b8329854fb
ff8b954f35672b3c283c36c177e7d7e4ca109fb81c273be61c1f19c798969c5d

www.jamf.com Open in urlscan Pro 54.173.104.166 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

69 Requests

100 %HTTPS

50 %IPv6

12 Domains

14 Subdomains

13 IPs

3 Countries

2220 kBTransfer

4637 kBSize

11 Cookies

19 Outgoing links

Page URL History

Redirected requests

69 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.jamf.com Open in urlscan Pro
54.173.104.166 Public Scan

Screenshot
Live screenshot

Full Image

69
Requests

100 %
HTTPS

50 %
IPv6

12
Domains

14
Subdomains

13
IPs

3
Countries

2220 kB
Transfer

4637 kB
Size

11
Cookies

69 HTTP transactions
0 data transactions