blog.confiant.com Open in urlscan Pro
52.4.225.124 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd...
Effective URL:
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd...
Submission: On May 14 via manual (May 14th 2024, 9:46:03 am UTC) from IN — Scanned from DE

Summary HTTP 91 Redirects Links 86 Behaviour Indicators

Summary

This website contacted 10 IPs in 2 countries across 8 domains to perform 91 HTTP transactions. The main IP is 52.4.225.124, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is blog.confiant.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 7th 2024. Valid for: a year.

This is the only time blog.confiant.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 17	52.4.225.124 52.4.225.124	14618 (AMAZON-AES) (AMAZON-AES)
1 3	2606:4700:7::... 2606:4700:7::a29f:9804	13335 (CLOUDFLAR...) (CLOUDFLARENET)
63	2606:4700:7::... 2606:4700:7::a29f:9904	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:831::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:830::2004	15169 (GOOGLE) (GOOGLE)
1	108.138.26.87 108.138.26.87	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
1	2600:9000:205... 2600:9000:2057:6200:19:9934:6a80:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
3	2600:9000:249... 2600:9000:2491:6000:11:f728:3040:93a1	16509 (AMAZON-02) (AMAZON-02)
91	10

17 52.4.225.124 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-4-225-124.compute-1.amazonaws.com

blog.confiant.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:7::a29f:9804 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
miro.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

63 2606:4700:7::a29f:9904 (United States)

ASN13335 (CLOUDFLARENET, US)

glyph.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
miro.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn-client.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.26.87 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-26-87.fra56.r.cloudfront.net

cdn.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2057:6200:19:9934:6a80:93a1 (United States)

ASN16509 (AMAZON-02, US)

app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2491:6000:11:f728:3040:93a1 (United States)

ASN16509 (AMAZON-02, US)

api2.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
66	medium.com 1 redirects medium.com — Cisco Umbrella Rank: 10592 glyph.medium.com — Cisco Umbrella Rank: 21453 miro.medium.com — Cisco Umbrella Rank: 14491 cdn-client.medium.com — Cisco Umbrella Rank: 22747	2 MB
17	confiant.com 1 redirects blog.confiant.com	57 KB
4	branch.io cdn.branch.io — Cisco Umbrella Rank: 943 api2.branch.io — Cisco Umbrella Rank: 1196	25 KB
2	google.com www.google.com — Cisco Umbrella Rank: 2	1004 B
1	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 2533	256 B
1	app.link app.link — Cisco Umbrella Rank: 2481	640 B
1	gstatic.com www.gstatic.com	202 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	92 KB
91	8

	Domain	Requested by
36	cdn-client.medium.com	blog.confiant.com cdn-client.medium.com
19	miro.medium.com	blog.confiant.com
17	blog.confiant.com	1 redirects cdn-client.medium.com
10	glyph.medium.com	glyph.medium.com
3	api2.branch.io	cdn-client.medium.com
2	www.google.com	cdn-client.medium.com www.gstatic.com
1	region1.google-analytics.com	www.googletagmanager.com
1	app.link	cdn.branch.io
1	www.gstatic.com	www.google.com
1	cdn.branch.io	blog.confiant.com
1	www.googletagmanager.com	cdn-client.medium.com
1	medium.com	1 redirects
91	12

This site contains links to these domains. Also see Links.

Domain
rsci.app.link
medium.com
s.ad-pixel.com
www.virustotal.com
twitter.com
0d.dwalletlabs.com
detect.fyi
eddiebarth.medium.com
khaledyassen.medium.com
infosecwriteups.com
help.medium.com
medium.statuspage.io
blog.medium.com
policy.medium.com
speechify.com

Subject Issuer	Validity	Valid
blog.confiant.com Sectigo RSA Domain Validation Secure Server CA	`2024-05-07` - `2025-05-07`	a year	crt.sh
medium.com Cloudflare Inc ECC CA-3	`2024-02-16` - `2024-12-31`	a year	crt.sh
*.google-analytics.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
*.google.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
*.branch.io Amazon RSA 2048 M01	`2023-09-11` - `2024-10-09`	a year	crt.sh
*.gstatic.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
appipv4.link Amazon RSA 2048 M03	`2024-03-25` - `2025-04-22`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Frame ID: 42F9152E074BA5C7CC80B8AD43516B8C
Requests: 90 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Le-uGgpAAAAAPprRaokM8AKthQ9KNGdoxaGUvVp&co=aHR0cHM6Ly9ibG9nLmNvbmZpYW50LmNvbTo0NDM.&hl=de&v=vjbW55W42X033PfTdVf6Ft4q&size=invisible&cb=jqlqffuxuwah
Frame ID: A762A0537A01D66F7EAD2DDEE90AE080
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Confiant & Malwarebytes Uncover Steganography Based Ad Payload That Drops Shlayer Trojan On Mac Users | by Eliya Stein | Confiant

Page URL History Show full URLs

http://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shla... HTTP 307
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shla... HTTP 307
https://medium.com/m/global-identity-2?redirectUrl=https%3A%2F%2Fblog.confiant.com%2Fconfiant-m... HTTP 307
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shla... Page URL

Detected technologies

Medium (Blogs) Expand

Overall confidence: 100%
Detected patterns

medium\.com

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

91
Requests

100 %
HTTPS

80 %
IPv6

8
Domains

12
Subdomains

10
IPs

2
Countries

2832 kB
Transfer

5278 kB
Size

8
Cookies

86 Outgoing links

These are links going to different origins than the main page.

URL: https://rsci.app.link/?%24canonical_url=https%3A%2F%2Fmedium.com%2Fp%2Fcd31e885c202&%7Efeature=LoOpenInAppButton&%7Echannel=ShowPostUnderCollection&source=---two_column_layout_nav----------------------------------
Title: Open in app

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fconfiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202&source=post_page---two_column_layout_nav-----------------------global_nav-----------
Title: Sign up

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fblog.confiant.com%2Fconfiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202&source=post_page---two_column_layout_nav-----------------------global_nav-----------
Title: Sign in

Search URL Search Domain Scan URL

URL: https://medium.com/?source=---two_column_layout_nav----------------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fmedium.com%2Fnew-story&source=---two_column_layout_nav-----------------------new_post_topnav-----------
Title: Write

Search URL Search Domain Scan URL

URL: https://medium.com/search?source=---two_column_layout_nav----------------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/@eliyastein?source=post_page-----cd31e885c202--------------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fsubscribe%2Fuser%2F2c3f3d52c6be&operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fconfiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202&user=Eliya+Stein&userId=2c3f3d52c6be&source=post_page-2c3f3d52c6be----cd31e885c202---------------------post_header-----------
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fconfiant-blog%2Fcd31e885c202&operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fconfiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202&user=Eliya+Stein&userId=2c3f3d52c6be&source=-----cd31e885c202---------------------clap_footer-----------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2Fcd31e885c202&operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fconfiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202&source=-----cd31e885c202---------------------bookmark_footer-----------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2Fplans%3Fdimension%3Dpost_audio_button%26postId%3Dcd31e885c202&operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fconfiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202&source=-----cd31e885c202---------------------post_audio_button-----------
Title: Listen

Search URL Search Domain Scan URL

URL: http://s.ad-pixel.com/sscc.jpg'
Title: http://s.ad-pixel.com/sscc.jpg'

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/#/file/75426777c469dbce816dc197b5bef518f4eca577e9c53e4679d81db2780a262f/detection
Title: https://www.virustotal.com/#/file/75426777c469dbce816dc197b5bef518f4eca577e9c53e4679d81db2780a262f/detection

Search URL Search Domain Scan URL

URL: https://twitter.com/adamt5Six
Title: @adamt5Six)

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/#/file/6efb37adef3ae68cc3d7cc0512ae82eab4a39b1880e00412ce50f5c423eba00d/detection
Title: https://www.virustotal.com/#/file/6efb37adef3ae68cc3d7cc0512ae82eab4a39b1880e00412ce50f5c423eba00d/detection

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fconfiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202&source=---post_footer_upsell--cd31e885c202---------------------lo_non_moc_upsell-----------
Title: Sign up for free

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fmedium.com%2Fplans&source=---post_footer_upsell--cd31e885c202---------------------lo_non_moc_upsell-----------
Title: Try for 5 $/month

Search URL Search Domain Scan URL

URL: https://medium.com/tag/malware?source=post_page-----cd31e885c202---------------malware-----------------
Title: Malware

Search URL Search Domain Scan URL

URL: https://medium.com/tag/advertising?source=post_page-----cd31e885c202---------------advertising-----------------
Title: Advertising

Search URL Search Domain Scan URL

URL: https://medium.com/tag/javascript?source=post_page-----cd31e885c202---------------javascript-----------------
Title: JavaScript

Search URL Search Domain Scan URL

URL: https://medium.com/tag/cybersecurity?source=post_page-----cd31e885c202---------------cybersecurity-----------------
Title: Cybersecurity

Search URL Search Domain Scan URL

URL: https://medium.com/tag/infosec?source=post_page-----cd31e885c202---------------infosec-----------------
Title: Infosec

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=%2F_%2Fapi%2Fsubscriptions%2Fnewsletters%2Fff99e7a03b35&operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fconfiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202&newsletterV3=2c3f3d52c6be&newsletterV3Id=ff99e7a03b35&user=Eliya+Stein&userId=2c3f3d52c6be&source=-----cd31e885c202---------------------subscribe_user-----------

Search URL Search Domain Scan URL

URL: https://medium.com/@eliyastein/followers?source=post_page-----cd31e885c202--------------------------------
Title: 267 Followers

Search URL Search Domain Scan URL

URL: https://medium.com/@eliyastein?source=author_recirc-----cd31e885c202----0---------------------f416e06e_0df8_434b_91e8_ebba10801713-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fconfiant-blog%2F66f3794aea4b&operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fhow-one-crypto-drainer-template-facilitates-tens-of-millions-of-dollars-in-theft-66f3794aea4b&user=Eliya+Stein&userId=2c3f3d52c6be&source=-----66f3794aea4b----0-----------------clap_footer----f416e06e_0df8_434b_91e8_ebba10801713-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F66f3794aea4b&operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fhow-one-crypto-drainer-template-facilitates-tens-of-millions-of-dollars-in-theft-66f3794aea4b&source=-----cd31e885c202----0-----------------bookmark_preview----f416e06e_0df8_434b_91e8_ebba10801713-------

Search URL Search Domain Scan URL

URL: https://medium.com/@bozoslivehere?source=author_recirc-----cd31e885c202----1---------------------f416e06e_0df8_434b_91e8_ebba10801713-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fconfiant-blog%2F65ef7f412537&operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fexploring-scamclub-payloads-via-deobfuscation-using-abstract-syntax-trees-65ef7f412537&user=BOZOSLIVEHERE&userId=ada6611754c&source=-----65ef7f412537----1-----------------clap_footer----f416e06e_0df8_434b_91e8_ebba10801713-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F65ef7f412537&operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fexploring-scamclub-payloads-via-deobfuscation-using-abstract-syntax-trees-65ef7f412537&source=-----cd31e885c202----1-----------------bookmark_preview----f416e06e_0df8_434b_91e8_ebba10801713-------

Search URL Search Domain Scan URL

URL: https://medium.com/@crimewaretech?source=author_recirc-----cd31e885c202----2---------------------f416e06e_0df8_434b_91e8_ebba10801713-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fconfiant-blog%2Fbf7989b388d2&operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fscamclubs-deceptive-landing-pages-bf7989b388d2&user=Michael+Steele&userId=c54f26c28481&source=-----bf7989b388d2----2-----------------clap_footer----f416e06e_0df8_434b_91e8_ebba10801713-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2Fbf7989b388d2&operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Fscamclubs-deceptive-landing-pages-bf7989b388d2&source=-----cd31e885c202----2-----------------bookmark_preview----f416e06e_0df8_434b_91e8_ebba10801713-------

Search URL Search Domain Scan URL

URL: https://medium.com/@eliyastein?source=author_recirc-----cd31e885c202----3---------------------f416e06e_0df8_434b_91e8_ebba10801713-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fconfiant-blog%2Fc7bc04c418ca&operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Frevealing-how-the-dandelion-group-leverages-multiple-layers-of-cloaking-to-run-ad-fraud-campaigns-c7bc04c418ca&user=Eliya+Stein&userId=2c3f3d52c6be&source=-----c7bc04c418ca----3-----------------clap_footer----f416e06e_0df8_434b_91e8_ebba10801713-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2Fc7bc04c418ca&operation=register&redirect=https%3A%2F%2Fblog.confiant.com%2Frevealing-how-the-dandelion-group-leverages-multiple-layers-of-cloaking-to-run-ad-fraud-campaigns-c7bc04c418ca&source=-----cd31e885c202----3-----------------bookmark_preview----f416e06e_0df8_434b_91e8_ebba10801713-------

Search URL Search Domain Scan URL

URL: https://medium.com/@elad_ernst?source=read_next_recirc-----cd31e885c202----0---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------

Search URL Search Domain Scan URL

URL: https://0d.dwalletlabs.com/?source=read_next_recirc-----cd31e885c202----0---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------
Title: 0d--

Search URL Search Domain Scan URL

URL: https://0d.dwalletlabs.com/how-we-found-a-25k-bug-in-a-blockchain-project-by-mistake-bounty-hunting-journey-21c0c20440f6?source=read_next_recirc-----cd31e885c202----0---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------
Title: How We Found a 25K$ Bug in a Blockchain Project by Mistake | Bounty Hunting Journey

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2F0-d%2F21c0c20440f6&operation=register&redirect=https%3A%2F%2F0d.dwalletlabs.com%2Fhow-we-found-a-25k-bug-in-a-blockchain-project-by-mistake-bounty-hunting-journey-21c0c20440f6&user=Elad+Ernst&userId=b96e26f397c6&source=-----21c0c20440f6----0-----------------clap_footer----304bc51b_4d80_4714_876f_21f1ffb17842-------

Search URL Search Domain Scan URL

URL: https://0d.dwalletlabs.com/how-we-found-a-25k-bug-in-a-blockchain-project-by-mistake-bounty-hunting-journey-21c0c20440f6?responsesOpen=true&sortBy=REVERSE_CHRON&source=read_next_recirc-----cd31e885c202----0---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------
Title: 2

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F21c0c20440f6&operation=register&redirect=https%3A%2F%2F0d.dwalletlabs.com%2Fhow-we-found-a-25k-bug-in-a-blockchain-project-by-mistake-bounty-hunting-journey-21c0c20440f6&source=-----cd31e885c202----0-----------------bookmark_preview----304bc51b_4d80_4714_876f_21f1ffb17842-------

Search URL Search Domain Scan URL

URL: https://medium.com/@simone.kraus?source=read_next_recirc-----cd31e885c202----1---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------

Search URL Search Domain Scan URL

URL: https://detect.fyi/?source=read_next_recirc-----cd31e885c202----1---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------
Title: Detect FYI

Search URL Search Domain Scan URL

URL: https://detect.fyi/sysmon-file-block-execution-how-we-can-use-sysmon-to-block-hermetic-wiper-rmm-tools-and-34993d7bc5af?source=read_next_recirc-----cd31e885c202----1---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------
Title: Sysmon File Block Execution — How we can use Sysmon to block Hermetic Wiper, RMM Tools and…As backup for EDR systems also in ICS environments

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fdetect-fyi%2F34993d7bc5af&operation=register&redirect=https%3A%2F%2Fdetect.fyi%2Fsysmon-file-block-execution-how-we-can-use-sysmon-to-block-hermetic-wiper-rmm-tools-and-34993d7bc5af&user=Simone+Kraus&userId=3d60ce83d2f7&source=-----34993d7bc5af----1-----------------clap_footer----304bc51b_4d80_4714_876f_21f1ffb17842-------

Search URL Search Domain Scan URL

URL: https://detect.fyi/sysmon-file-block-execution-how-we-can-use-sysmon-to-block-hermetic-wiper-rmm-tools-and-34993d7bc5af?responsesOpen=true&sortBy=REVERSE_CHRON&source=read_next_recirc-----cd31e885c202----1---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F34993d7bc5af&operation=register&redirect=https%3A%2F%2Fdetect.fyi%2Fsysmon-file-block-execution-how-we-can-use-sysmon-to-block-hermetic-wiper-rmm-tools-and-34993d7bc5af&source=-----cd31e885c202----1-----------------bookmark_preview----304bc51b_4d80_4714_876f_21f1ffb17842-------

Search URL Search Domain Scan URL

URL: https://medium.com/@MediumStaff/list/stories-to-help-you-grow-as-a-software-developer-b1d913188c20?source=read_next_recirc-----cd31e885c202--------------------------------
Title: Stories to Help You Grow as a Software Developer19 stories·1050 saves

Search URL Search Domain Scan URL

URL: https://eddiebarth.medium.com/list/general-coding-knowledge-f2d429d4f0cd?source=read_next_recirc-----cd31e885c202--------------------------------
Title: General Coding Knowledge20 stories·1205 saves

Search URL Search Domain Scan URL

URL: https://medium.com/@wearedelicious/list/tech-tools-541154dfb3ae?source=read_next_recirc-----cd31e885c202--------------------------------
Title: Tech & Tools16 stories·225 saves

Search URL Search Domain Scan URL

URL: https://medium.com/@walterbonnett71/list/modern-marketing-ef96a341a034?source=read_next_recirc-----cd31e885c202--------------------------------
Title: Modern Marketing133 stories·628 saves

Search URL Search Domain Scan URL

URL: https://khaledyassen.medium.com/?source=read_next_recirc-----cd31e885c202----0---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------

Search URL Search Domain Scan URL

URL: https://infosecwriteups.com/?source=read_next_recirc-----cd31e885c202----0---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------
Title: InfoSec Write-ups

Search URL Search Domain Scan URL

URL: https://infosecwriteups.com/how-i-found-multiple-xss-vulnerabilities-using-unknown-techniques-74f8e705ea0d?source=read_next_recirc-----cd31e885c202----0---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------
Title: How I Found Multiple XSS Vulnerabilities Using Unknown TechniquesHello, everyone. I hope you are well.

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fbugbountywriteup%2F74f8e705ea0d&operation=register&redirect=https%3A%2F%2Finfosecwriteups.com%2Fhow-i-found-multiple-xss-vulnerabilities-using-unknown-techniques-74f8e705ea0d&user=Khaledyassen&userId=180ba8c4ad77&source=-----74f8e705ea0d----0-----------------clap_footer----304bc51b_4d80_4714_876f_21f1ffb17842-------

Search URL Search Domain Scan URL

URL: https://infosecwriteups.com/how-i-found-multiple-xss-vulnerabilities-using-unknown-techniques-74f8e705ea0d?responsesOpen=true&sortBy=REVERSE_CHRON&source=read_next_recirc-----cd31e885c202----0---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------
Title: 23

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F74f8e705ea0d&operation=register&redirect=https%3A%2F%2Finfosecwriteups.com%2Fhow-i-found-multiple-xss-vulnerabilities-using-unknown-techniques-74f8e705ea0d&source=-----cd31e885c202----0-----------------bookmark_preview----304bc51b_4d80_4714_876f_21f1ffb17842-------

Search URL Search Domain Scan URL

URL: https://medium.com/@artturi-jalli?source=read_next_recirc-----cd31e885c202----1---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------

Search URL Search Domain Scan URL

URL: https://medium.com/@artturi-jalli/i-built-an-app-in-6-hours-that-makes-1-500-mo-85139edee87d?source=read_next_recirc-----cd31e885c202----1---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------
Title: I Built an App in 6 Hours that Makes $1,500/MoCopy my strategy!

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fp%2F85139edee87d&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40artturi-jalli%2Fi-built-an-app-in-6-hours-that-makes-1-500-mo-85139edee87d&user=Artturi+Jalli&userId=b7bdb0fad1c4&source=-----85139edee87d----1-----------------clap_footer----304bc51b_4d80_4714_876f_21f1ffb17842-------

Search URL Search Domain Scan URL

URL: https://medium.com/@artturi-jalli/i-built-an-app-in-6-hours-that-makes-1-500-mo-85139edee87d?responsesOpen=true&sortBy=REVERSE_CHRON&source=read_next_recirc-----cd31e885c202----1---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------
Title: 194

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F85139edee87d&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40artturi-jalli%2Fi-built-an-app-in-6-hours-that-makes-1-500-mo-85139edee87d&source=-----cd31e885c202----1-----------------bookmark_preview----304bc51b_4d80_4714_876f_21f1ffb17842-------

Search URL Search Domain Scan URL

URL: https://medium.com/@Sparky23172?source=read_next_recirc-----cd31e885c202----2---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------

Search URL Search Domain Scan URL

URL: https://medium.com/@Sparky23172/finding-the-static-base-of-multi-level-pointers-ca46a135971a?source=read_next_recirc-----cd31e885c202----2---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------
Title: Finding the Static Base of Multi-Level PointersA relatively simple explanation of finding the base of a multi-level pointer

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fp%2Fca46a135971a&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40Sparky23172%2Ffinding-the-static-base-of-multi-level-pointers-ca46a135971a&user=Alex+Thines&userId=70e1242ff5b9&source=-----ca46a135971a----2-----------------clap_footer----304bc51b_4d80_4714_876f_21f1ffb17842-------

Search URL Search Domain Scan URL

URL: https://medium.com/@Sparky23172/finding-the-static-base-of-multi-level-pointers-ca46a135971a?responsesOpen=true&sortBy=REVERSE_CHRON&source=read_next_recirc-----cd31e885c202----2---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2Fca46a135971a&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40Sparky23172%2Ffinding-the-static-base-of-multi-level-pointers-ca46a135971a&source=-----cd31e885c202----2-----------------bookmark_preview----304bc51b_4d80_4714_876f_21f1ffb17842-------

Search URL Search Domain Scan URL

URL: https://medium.com/@amitdutta6026?source=read_next_recirc-----cd31e885c202----3---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------

Search URL Search Domain Scan URL

URL: https://medium.com/@amitdutta6026/bypassing-cloudflares-sql-injection-filter-without-origin-ip-discovery-2bb8c97bc5db?source=read_next_recirc-----cd31e885c202----3---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------
Title: Bypassing Cloudflare’s SQL Injection Filter Without Origin IP Discovery!In this project, my initial approach involved attempting to bypass the WAF (Cloudflare) by uncovering the origin IP of the website. When…

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fp%2F2bb8c97bc5db&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40amitdutta6026%2Fbypassing-cloudflares-sql-injection-filter-without-origin-ip-discovery-2bb8c97bc5db&user=Amit+Dutta&userId=4de04f3b1308&source=-----2bb8c97bc5db----3-----------------clap_footer----304bc51b_4d80_4714_876f_21f1ffb17842-------

Search URL Search Domain Scan URL

URL: https://medium.com/@amitdutta6026/bypassing-cloudflares-sql-injection-filter-without-origin-ip-discovery-2bb8c97bc5db?responsesOpen=true&sortBy=REVERSE_CHRON&source=read_next_recirc-----cd31e885c202----3---------------------304bc51b_4d80_4714_876f_21f1ffb17842-------
Title: 2

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F2bb8c97bc5db&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40amitdutta6026%2Fbypassing-cloudflares-sql-injection-filter-without-origin-ip-discovery-2bb8c97bc5db&source=-----cd31e885c202----3-----------------bookmark_preview----304bc51b_4d80_4714_876f_21f1ffb17842-------

Search URL Search Domain Scan URL

URL: https://medium.com/?source=post_page-----cd31e885c202--------------------------------
Title: See more recommendations

Search URL Search Domain Scan URL

URL: https://help.medium.com/hc/en-us?source=post_page-----cd31e885c202--------------------------------
Title: Help

Search URL Search Domain Scan URL

URL: https://medium.statuspage.io/?source=post_page-----cd31e885c202--------------------------------
Title: Status

Search URL Search Domain Scan URL

URL: https://medium.com/about?autoplay=1&source=post_page-----cd31e885c202--------------------------------
Title: About

Search URL Search Domain Scan URL

URL: https://medium.com/jobs-at-medium/work-at-medium-959d1a85284e?source=post_page-----cd31e885c202--------------------------------
Title: Careers

Search URL Search Domain Scan URL

URL: https://blog.medium.com/?source=post_page-----cd31e885c202--------------------------------
Title: Blog

Search URL Search Domain Scan URL

URL: https://policy.medium.com/medium-privacy-policy-f03bf92035c9?source=post_page-----cd31e885c202--------------------------------
Title: Privacy

Search URL Search Domain Scan URL

URL: https://policy.medium.com/medium-terms-of-service-9db0094a1e0f?source=post_page-----cd31e885c202--------------------------------
Title: Terms

Search URL Search Domain Scan URL

URL: https://speechify.com/medium?source=post_page-----cd31e885c202--------------------------------
Title: Text to speech

Search URL Search Domain Scan URL

URL: https://medium.com/business?source=post_page-----cd31e885c202--------------------------------
Title: Teams

Search URL Search Domain Scan URL

URL: https://policy.medium.com/medium-privacy-policy-f03bf92035c9
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=a94425129172 HTTP 307
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=a94425129172 HTTP 307
https://medium.com/m/global-identity-2?redirectUrl=https%3A%2F%2Fblog.confiant.com%2Fconfiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202 HTTP 307
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

91 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202 Show response
blog.confiant.com/
Redirect Chain

http://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=a94425129172
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=a94425129172
https://medium.com/m/global-identity-2?redirectUrl=https%3A%2F%2Fblog.confiant.com%2Fconfiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

228 KB
46 KB

758ms
757ms

Document
text/html

52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-225-124.compute-1.amazonaws.com

Software

nginx /

Resource Hash

588e65ab7415cf5f79fc040e3de9e991dbba7d69b9eedce6128a434874fec62e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://medium.com

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: frame-ancestors 'self' https://medium.com
content-type: text/html; charset=utf-8
date: Tue, 14 May 2024 09:45:56 GMT
etag: W/"38f62-G8jgSM7Nz9+rx05OFgAv7lHD2/Q"
link: <https://glyph.medium.com/css/unbound.css>; as="style"; rel="preload"
medium-fulfilled-by: valencia/main-20240513-163228-daf81a340e, lite/main-20240514-080247-3e2dacb79f, rito/main-20240513-163228-daf81a340e, tutu/main-20240514-000735-0aa0c7955f
medium-missing-time: 574
sepia-upstream: medium
server: nginx
vary: Accept-Encoding
x-envoy-upstream-service-time: 658
x-request-received-at: 1715679956078

Redirect headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8839f54c0f5e35f1-FRA
content-length: 0
content-type: text/plain;charset=UTF-8
date: Tue, 14 May 2024 09:45:55 GMT
location: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
medium-fulfilled-by: edgy/8.7.1, valencia/main-20240513-163228-daf81a340e
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept-Encoding
worker-missing-cookies: 1
x-content-type-options: nosniff
x-envoy-upstream-service-time: 15

GET
H2 200 unbound.css
glyph.medium.com/css/ 19 KB
2 KB 61ms
29ms Stylesheet
text/css 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/css/unbound.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45dbf060ec052a3b0ca5ae7211eaa27c950db65b019aa456e1e686a85f8a327e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:56 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 1395
x-envoy-upstream-service-time: 1
alt-svc: h3=":443"; ma=86400
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=7200
access-control-allow-credentials: true
vary: Accept-Encoding
cf-ray: 8839f551f9db9730-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Tue, 14 May 2024 11:45:56 GMT

GET
H2 200 1*DimzYIT6p9LkmCFDLkF5og.png
miro.medium.com/v2/resize:fit:2328/format:webp/ 32 KB
33 KB 411ms
400ms Image
image/webp 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fit:2328/format:webp/1*DimzYIT6p9LkmCFDLkF5og.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5322e86e85f408fedf5c2dc62e11268a8c7da995b5dfdfed8655fdb40492b644

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-envoy-upstream-service-time: 234
content-disposition: inline; filename="1*DimzYIT6p9LkmCFDLkF5og.webp"
alt-svc: h3=":443"; ma=86400
content-length: 33050
x-request-id: f911aac9-cf96-4467-8726-6d1e11c1a88d
sepia-upstream: medium
server: cloudflare
etag: "Sbq4NovgZ_mQktd8v38PB4bCUyiBEgxna-kfcPaPHzk/RIjBlMjliMzYwODRmYWE3ZDJlNDk4MjE0MzJlNDE3OWEyIg"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240507-223507-a45e18f1bb
accept-ranges: bytes
cf-ray: 8839f5527a569730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 1*bG9--Ph8E_VYKL-r7pkY_Q.png
miro.medium.com/v2/resize:fit:720/format:webp/ 9 KB
9 KB 144ms
133ms Image
image/webp 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fit:720/format:webp/1*bG9--Ph8E_VYKL-r7pkY_Q.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f6add33bfd394e0535bbc9638a59b1c6268217c18bbbe81bfec0fa1cbf21f198

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:56 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-envoy-upstream-service-time: 343
content-disposition: inline; filename="1*bG9--Ph8E_VYKL-r7pkY_Q.webp"
alt-svc: h3=":443"; ma=86400
content-length: 9204
x-request-id: be112d09-e215-4419-b43d-eebd4c02efc3
sepia-upstream: medium
server: cloudflare
etag: "YXzh1miX4qndlYVobhq_bxorivcuaUlJ2JfvURNm1xU/RIjZjNmY3ZWY4Zjg3YzEzZjU1ODI4YmZhYmVlOTkxOGZkIg"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240507-223507-a45e18f1bb
accept-ranges: bytes
cf-ray: 8839f5527a589730-FRA
expires: Wed, 14 May 2025 09:45:56 GMT

GET
H2 200 1*SLDOgLQ7aMeoXCX5W-la9w.png
miro.medium.com/v2/resize:fit:2510/format:webp/ 95 KB
96 KB 260ms
250ms Image
image/webp 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fit:2510/format:webp/1*SLDOgLQ7aMeoXCX5W-la9w.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9b2ab5dc97f7d5b72ffd3ab8102686c38e077936dc5b5a3a7eebf7f8f927995b

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-envoy-upstream-service-time: 286
content-disposition: inline; filename="1*SLDOgLQ7aMeoXCX5W-la9w.webp"
alt-svc: h3=":443"; ma=86400
content-length: 97336
x-request-id: 767d4d29-22bf-4540-b695-68d3db0f5db0
sepia-upstream: medium
server: cloudflare
etag: "7Bjz7Ro2xt189No50Y_PGVWM_vCe3-YPC_BRRMq3lcA/RIjQ4YjBjZTgwYjQzYjY4YzdhODVjMjVmOTViZTk1YWY3Ig"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240507-223507-a45e18f1bb
accept-ranges: bytes
cf-ray: 8839f5527a5a9730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 1*kXdFy8KnilomuXeAOzuKsA.png
miro.medium.com/v2/resize:fit:432/format:webp/ 9 KB
9 KB 447ms
436ms Image
image/webp 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fit:432/format:webp/1*kXdFy8KnilomuXeAOzuKsA.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e204925855c2a1be11ebf53085b5f49d348e49e79a577c40eb75f9d36f7d6e71

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-envoy-upstream-service-time: 146
content-disposition: inline; filename="1*kXdFy8KnilomuXeAOzuKsA.webp"
alt-svc: h3=":443"; ma=86400
content-length: 8906
x-request-id: 7c6e3579-7018-455d-b0ee-508a99f4fdba
sepia-upstream: medium
server: cloudflare
etag: "vr3vby1FSAC_nRdqB5Sn3yIOTADvuq3QReMzlz09gLQ/RIjkxNzc0NWNiYzJhNzhhNWEyNmI5Nzc4MDNiM2I4YWIwIg"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240507-223507-a45e18f1bb
accept-ranges: bytes
cf-ray: 8839f5527a5d9730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 1*GmJPVaKouDTfp9LkSLpc3g.png
miro.medium.com/v2/resize:fit:238/format:webp/ 6 KB
6 KB 134ms
124ms Image
image/webp 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fit:238/format:webp/1*GmJPVaKouDTfp9LkSLpc3g.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

150b6de63ddf61eb028ab34b8d7ed7a6fb7e512b752a80c6d5effdd966e85465

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:56 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-envoy-upstream-service-time: 48
content-disposition: inline; filename="1*GmJPVaKouDTfp9LkSLpc3g.webp"
alt-svc: h3=":443"; ma=86400
content-length: 5780
x-request-id: 09ab4d2e-4e12-4f9f-b131-4b30f60619c5
sepia-upstream: medium
server: cloudflare
etag: "FGBDCLrUZAeS7PZrp5Rlrm_hClaU4cLBiJTj9IR7G-w/RIjFhNjI0ZjU1YTJhOGI4MzRkZmE3ZDJlNDQ4YmE1Y2RlIg"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240507-223507-a45e18f1bb
accept-ranges: bytes
cf-ray: 8839f5527a609730-FRA
expires: Wed, 14 May 2025 09:45:56 GMT

GET
H2 200 1*9WYiPh_UmjvGxAxuONSoSw.png
miro.medium.com/v2/resize:fit:1100/format:webp/ 24 KB
24 KB 407ms
397ms Image
image/webp 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fit:1100/format:webp/1*9WYiPh_UmjvGxAxuONSoSw.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3f9de0ef524b7640f04530942b7beea102664734c2506a8d83e0389ab9d12a04

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-envoy-upstream-service-time: 458
content-disposition: inline; filename="1*9WYiPh_UmjvGxAxuONSoSw.webp"
alt-svc: h3=":443"; ma=86400
content-length: 24430
x-request-id: 024fa849-c7b7-4ef1-9da6-84bd65778c74
sepia-upstream: medium
server: cloudflare
etag: "5S96LlExIHiSom4GIQIAgHlDRkwXhPnJoP2BSG1PzME/RImY1NjYyMjNlMWZkNDlhM2JjNmM0MGM2ZTM4ZDRhODRiIg"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240507-223507-a45e18f1bb
accept-ranges: bytes
cf-ray: 8839f5527a619730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 1*MM-qW9p2Fw__W5H-dgs81Q.png
miro.medium.com/v2/resize:fit:1100/format:webp/ 28 KB
28 KB 151ms
148ms Image
image/webp 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fit:1100/format:webp/1*MM-qW9p2Fw__W5H-dgs81Q.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea06b0266e95dda3e4ca749f4e3f058a059137b1016cb08f3ca9b3381c9e0f72

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-envoy-upstream-service-time: 329
content-disposition: inline; filename="1*MM-qW9p2Fw__W5H-dgs81Q.webp"
alt-svc: h3=":443"; ma=86400
content-length: 28832
x-request-id: d71ea204-1a09-4425-8b0b-54aca65f538e
sepia-upstream: medium
server: cloudflare
etag: "5S96LlExIHiSom4GIQIAgHlDRkwXhPnJoP2BSG1PzME/RIjMwY2ZhYTViZGE3NjE3MGZmZjViOTFmZTc2MGIzY2Q1Ig"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240507-223507-a45e18f1bb
accept-ranges: bytes
cf-ray: 8839f5534b829730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 1*11YX4ABQuE2JbB6eLFQk7A.png
miro.medium.com/v2/resize:fit:720/format:webp/ 205 KB
206 KB 140ms
137ms Image
image/webp 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fit:720/format:webp/1*11YX4ABQuE2JbB6eLFQk7A.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b5e77062d95b767a7c29e33b24cecca3bd747f58d8b3933749762064a3116c0e

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-envoy-upstream-service-time: 542
content-disposition: inline; filename="1*11YX4ABQuE2JbB6eLFQk7A.webp"
alt-svc: h3=":443"; ma=86400
content-length: 210290
x-request-id: da58e7e4-c5d5-412b-a1d5-f2385bbba868
sepia-upstream: medium
server: cloudflare
etag: "YXzh1miX4qndlYVobhq_bxorivcuaUlJ2JfvURNm1xU/RImQ3NTYxN2UwMDA1MGI4NGQ4OTZjMWU5ZTJjNTQyNGVjIg"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240507-223507-a45e18f1bb
accept-ranges: bytes
cf-ray: 8839f5534b839730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 1*UMRivsxI4oLQe-bupG85sA.png
miro.medium.com/v2/resize:fit:1100/format:webp/ 373 KB
373 KB 169ms
166ms Image
image/webp 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fit:1100/format:webp/1*UMRivsxI4oLQe-bupG85sA.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ede8711f2a9738e04e183938cae0c68728f1ce5f381c1829371d9048a5c195eb

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-envoy-upstream-service-time: 1104
content-disposition: inline; filename="1*UMRivsxI4oLQe-bupG85sA.webp"
alt-svc: h3=":443"; ma=86400
content-length: 381692
x-request-id: 273984e4-70ab-46ad-80a9-4b9b4bfb86e0
sepia-upstream: medium
server: cloudflare
etag: "5S96LlExIHiSom4GIQIAgHlDRkwXhPnJoP2BSG1PzME/RIjUwYzQ2MmJlY2M0OGUyODJkMDdiZTZlZWE0NmYzOWIwIg"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240507-223507-a45e18f1bb
accept-ranges: bytes
cf-ray: 8839f5534b849730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 1*qKCJR5QY1fJa5_DssYMENA.png
miro.medium.com/v2/resize:fit:1100/format:webp/ 246 KB
247 KB 199ms
196ms Image
image/webp 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fit:1100/format:webp/1*qKCJR5QY1fJa5_DssYMENA.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aca180e889ce7fc4689b9d7abd6d8b17c5d628554739a887798a0069531e8c96

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-envoy-upstream-service-time: 614
content-disposition: inline; filename="1*qKCJR5QY1fJa5_DssYMENA.webp"
alt-svc: h3=":443"; ma=86400
content-length: 252050
x-request-id: ad422b05-46fd-44bc-8faa-e3eb3058de7d
sepia-upstream: medium
server: cloudflare
etag: "5S96LlExIHiSom4GIQIAgHlDRkwXhPnJoP2BSG1PzME/RImE4YTA4OTQ3OTQxOGQ1ZjI1YWU3ZjBlY2IxODMwNDM0Ig"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240507-223507-a45e18f1bb
accept-ranges: bytes
cf-ray: 8839f5534b869730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 1*DNZPR8c8P4f0eLkNx1Nctg.png
miro.medium.com/v2/resize:fit:1100/format:webp/ 83 KB
83 KB 618ms
616ms Image
image/webp 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fit:1100/format:webp/1*DNZPR8c8P4f0eLkNx1Nctg.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

847a5694fa141acfc6fc76aad3e0dd4cc245582878d16d29acaab3089bac3d6e

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-envoy-upstream-service-time: 652
content-disposition: inline; filename="1*DNZPR8c8P4f0eLkNx1Nctg.webp"
alt-svc: h3=":443"; ma=86400
content-length: 84574
x-request-id: 81cd3cb8-d99b-44c4-9f7a-31a22dd58145
sepia-upstream: medium
server: cloudflare
etag: "5S96LlExIHiSom4GIQIAgHlDRkwXhPnJoP2BSG1PzME/RIjBjZDY0ZjQ3YzczYzNmODdmNDc4YjkwZGM3NTM1Y2I2Ig"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240507-223507-a45e18f1bb
accept-ranges: bytes
cf-ray: 8839f5534b879730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 1*QaNwxoa0CijIvugF4f9JAg.png
miro.medium.com/v2/resize:fit:1100/format:webp/ 50 KB
50 KB 489ms
487ms Image
image/webp 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fit:1100/format:webp/1*QaNwxoa0CijIvugF4f9JAg.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

afbeace1e95d6a40b8e141947277e61b176f91811b17a4fc3e6cfc57de36b77f

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-envoy-upstream-service-time: 383
content-disposition: inline; filename="1*QaNwxoa0CijIvugF4f9JAg.webp"
alt-svc: h3=":443"; ma=86400
content-length: 50982
x-request-id: d090cb15-3e1d-4bf2-a32c-bf64f49a800f
sepia-upstream: medium
server: cloudflare
etag: "5S96LlExIHiSom4GIQIAgHlDRkwXhPnJoP2BSG1PzME/RIjQxYTM3MGM2ODZiNDBhMjhjOGJlZTgwNWUxZmY0OTAyIg"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240507-223507-a45e18f1bb
accept-ranges: bytes
cf-ray: 8839f5534b889730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 1*ZzOZ1ZVhb9EQArJgDFFL-Q.png
miro.medium.com/v2/resize:fit:1100/format:webp/ 96 KB
96 KB 250ms
248ms Image
image/webp 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fit:1100/format:webp/1*ZzOZ1ZVhb9EQArJgDFFL-Q.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bc9d1168ad6de4e0b3d3775c925a608617133a8e8b255e26b7a1c3e01fcc36c9

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-envoy-upstream-service-time: 665
content-disposition: inline; filename="1*ZzOZ1ZVhb9EQArJgDFFL-Q.webp"
alt-svc: h3=":443"; ma=86400
content-length: 98314
x-request-id: c49bd35a-26ea-4e9d-a287-a162fe1b72e6
sepia-upstream: medium
server: cloudflare
etag: "5S96LlExIHiSom4GIQIAgHlDRkwXhPnJoP2BSG1PzME/RIjY3MzM5OWQ1OTU2MTZmZDExMDAyYjI2MDBjNTE0YmY5Ig"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240507-223507-a45e18f1bb
accept-ranges: bytes
cf-ray: 8839f5534b899730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 1*WUiwHhWqXMzObrMMBKRObg.png
miro.medium.com/v2/resize:fit:720/format:webp/ 20 KB
20 KB 161ms
159ms Image
image/webp 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fit:720/format:webp/1*WUiwHhWqXMzObrMMBKRObg.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

308202843db4c9ca5427bdf105b4bc75698dddcd7c071918cf64fd422785b2cb

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-envoy-upstream-service-time: 157
content-disposition: inline; filename="1*WUiwHhWqXMzObrMMBKRObg.webp"
alt-svc: h3=":443"; ma=86400
content-length: 20062
x-request-id: 23c0a18d-1fd3-4277-ad61-1dafbe625693
sepia-upstream: medium
server: cloudflare
etag: "YXzh1miX4qndlYVobhq_bxorivcuaUlJ2JfvURNm1xU/RIjU5NDhiMDFlMTVhYTVjY2NjZTZlYjMwYzA0YTQ0ZTZlIg"
vary: Accept-Encoding
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240507-223507-a45e18f1bb
accept-ranges: bytes
cf-ray: 8839f5534b8a9730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H3 200 sohne-700-normal.woff
glyph.medium.com/font/cf896f3/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 19 KB
19 KB 44ms
29ms Font
application/font-woff 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/cf896f3/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/sohne-700-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

78661d3e6871b6e5c37f3113d811cb3dfc69546449e3b2c28095b6e7f28d9a7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://glyph.medium.com/css/unbound.css
Origin: https://blog.confiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:56 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 4264320
x-envoy-upstream-service-time: 85
alt-svc: h3=":443"; ma=86400
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
vary: Accept-Encoding
cf-ray: 8839f552be689f2c-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Wed, 14 May 2025 09:45:56 GMT

GET
H3 200 sohne-400-normal.woff
glyph.medium.com/font/b492c44/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 19 KB
19 KB 66ms
52ms Font
application/font-woff 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/b492c44/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/sohne-400-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b0f424bafe993b016ea96973894f95dfc4290608478a2d7d3fdd080d9b0a60d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://glyph.medium.com/css/unbound.css
Origin: https://blog.confiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:56 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 4094936
x-envoy-upstream-service-time: 39
alt-svc: h3=":443"; ma=86400
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
vary: Accept-Encoding
cf-ray: 8839f552be749f2c-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Wed, 14 May 2025 09:45:56 GMT

GET
H3 200 source-serif-pro-400-normal.woff
glyph.medium.com/font/8e059b2/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 12 KB
12 KB 52ms
39ms Font
application/font-woff 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/8e059b2/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/source-serif-pro-400-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5d7947aa3e6131478a97f06e72913cb7b9e19161e03502ad1de3eb67f447213

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://glyph.medium.com/css/unbound.css
Origin: https://blog.confiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:56 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 5322278
x-envoy-upstream-service-time: 80
alt-svc: h3=":443"; ma=86400
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
vary: Accept-Encoding
cf-ray: 8839f552be639f2c-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Wed, 14 May 2025 09:45:56 GMT

GET
H3 200 source-serif-pro-400-italic.woff
glyph.medium.com/font/76c214a/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 12 KB
13 KB 49ms
36ms Font
application/font-woff 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/76c214a/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/source-serif-pro-400-italic.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ca820b9aa7681184130d09157ea679d1d31390bee2af294c088f6dcaa24923b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://glyph.medium.com/css/unbound.css
Origin: https://blog.confiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:56 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 5322277
x-envoy-upstream-service-time: 101
alt-svc: h3=":443"; ma=86400
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
vary: Accept-Encoding
cf-ray: 8839f552be609f2c-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Wed, 14 May 2025 09:45:56 GMT

GET
H3 200 source-code-pro-400-normal.woff
glyph.medium.com/font/3bd49b7/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 7 KB
7 KB 64ms
51ms Font
application/font-woff 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/3bd49b7/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/source-code-pro-400-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d6c90ff7bddb2b437a4130fbfaad1dd6fdc87a532ed4a97b5a4484c659e632ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://glyph.medium.com/css/unbound.css
Origin: https://blog.confiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:56 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 5327148
x-envoy-upstream-service-time: 31
alt-svc: h3=":443"; ma=86400
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
vary: Accept-Encoding
cf-ray: 8839f552be719f2c-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Wed, 14 May 2025 09:45:56 GMT

GET
H3 200 sohne-500-normal.woff
glyph.medium.com/font/df9ba7f/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 18 KB
19 KB 57ms
44ms Font
application/font-woff 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/df9ba7f/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/sohne-500-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

65f0c65b5db3aa0568c7986479a4a3e909a05a84fb34ced48d70a2d628dd1444

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://glyph.medium.com/css/unbound.css
Origin: https://blog.confiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:56 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 5331780
x-envoy-upstream-service-time: 45
alt-svc: h3=":443"; ma=86400
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
vary: Accept-Encoding
cf-ray: 8839f552be6d9f2c-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Wed, 14 May 2025 09:45:56 GMT

GET
H3 200 source-serif-pro-400-italic.woff
glyph.medium.com/font/76c214a/3k-4f_4h-52_54-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/ 55 KB
55 KB 57ms
45ms Font
application/font-woff 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/76c214a/3k-4f_4h-52_54-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/source-serif-pro-400-italic.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aa2dcb49178e613d7c504bf451d47354109e9dbd3cf5ad3c9e87896005398878

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://glyph.medium.com/css/unbound.css
Origin: https://blog.confiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:56 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 5322261
x-envoy-upstream-service-time: 22
alt-svc: h3=":443"; ma=86400
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
vary: Accept-Encoding
cf-ray: 8839f552be6e9f2c-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Wed, 14 May 2025 09:45:56 GMT

GET
H3 200 sohne-400-normal.woff
glyph.medium.com/font/b492c44/3k-4f_4h-52_54-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/ 28 KB
28 KB 63ms
51ms Font
application/font-woff 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/b492c44/3k-4f_4h-52_54-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/sohne-400-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c4e595378a4c2585a1eb91b7f65ed0526940ed8fd37a31810cd1e2eb2920b12

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://glyph.medium.com/css/unbound.css
Origin: https://blog.confiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:56 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 5322276
x-envoy-upstream-service-time: 75
alt-svc: h3=":443"; ma=86400
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
vary: Accept-Encoding
cf-ray: 8839f552be739f2c-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Wed, 14 May 2025 09:45:56 GMT

GET
H2 200 1*dmbNkD5D-u45r44go_cf0g.png
miro.medium.com/v2/resize:fill:64:64/ 1 KB
2 KB 31ms
30ms Image
image/png 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fill:64:64/1*dmbNkD5D-u45r44go_cf0g.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f90d19259478cca4381bea7e760845de9bcf2155ee96cd8b06049add894022d3

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:56 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
age: 493379
x-envoy-upstream-service-time: 51
content-disposition: inline; filename="1*dmbNkD5D-u45r44go_cf0g.png"
alt-svc: h3=":443"; ma=86400
content-length: 1310
x-request-id: 716855b3-79a7-4e20-9124-a7052843c164
sepia-upstream: medium
server: cloudflare
etag: "qUlGJkYhB4LINmyi_TVOvM25Dy409gGbmK5EqrHhPd0/RImNiNjU3ZGRlN2RhNjI0NjU3YTVmNmQ0ZDdhNzEyMDM3Ig"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240226-230532-797fb80223
accept-ranges: bytes
cf-ray: 8839f5531b1f9730-FRA
expires: Wed, 14 May 2025 09:45:56 GMT

GET
H2 200 1*6g6sWeOzruzLd-7jotXC9A.png
miro.medium.com/v2/resize:fill:88:88/ 18 KB
18 KB 31ms
30ms Image
image/png 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fill:88:88/1*6g6sWeOzruzLd-7jotXC9A.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

59be80adee0da9d87cf1e6e9692a64f26e38b5ada445206d65814ac9ed08320d

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:56 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
age: 419249
x-envoy-upstream-service-time: 150
content-disposition: inline; filename="1*6g6sWeOzruzLd-7jotXC9A.png"
alt-svc: h3=":443"; ma=86400
content-length: 18390
x-request-id: 37f58ab1-6ea3-44fd-bc4e-addee1ed3739
sepia-upstream: medium
server: cloudflare
etag: "9ivaNyhTKaKecaYmZr68Fn9V98S0df7YQu7TMR33mwc/RImVhMGVhYzU5ZTNiM2FlZWNjYjc3ZWVlM2EyZDVjMmY0Ig"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240425-160105-43aff7f504
accept-ranges: bytes
cf-ray: 8839f5531b1a9730-FRA
expires: Wed, 14 May 2025 09:45:56 GMT

GET
H2 200 1*KBANK80H_UhhQPtdpH4EYQ.png
miro.medium.com/v2/resize:fill:48:48/ 2 KB
3 KB 26ms
25ms Image
image/png 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/resize:fill:48:48/1*KBANK80H_UhhQPtdpH4EYQ.png

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42f22529e38ed31f0c4d1ba7e56fd16ac9e41c8e338fc02afdda1b09f1ab735b

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:56 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
age: 81840
x-envoy-upstream-service-time: 137
content-disposition: inline; filename="1*KBANK80H_UhhQPtdpH4EYQ.png"
alt-svc: h3=":443"; ma=86400
content-length: 2500
x-request-id: 741fb769-8bdd-4f39-a6f9-ca956c0493f3
sepia-upstream: medium
server: cloudflare
etag: "c1CjgVkcafhdh7F-WEYEpOglzgQoBxTrHiRusf4J2s4/RIjI4MTAwZDJiY2QwN2ZkNDg2MTQwZmI1ZGE0N2UwNDYxIg"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240425-160105-43aff7f504
accept-ranges: bytes
cf-ray: 8839f5531b1e9730-FRA
expires: Wed, 14 May 2025 09:45:56 GMT

GET
H2 200 manifest.0ea73aeb.js Show response
cdn-client.medium.com/lite/static/js/ 13 KB
6 KB 42ms
30ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/manifest.0ea73aeb.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a14d42d2a75c099d31b3c0458dc2fcb58b33b51cf043dd5884ccb36519c9d32e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:56 GMT
x-amz-version-id: pYOScU2ZsTPAmSLwG7skLvjzIFAJc9Ej
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: GD0FXEJAR0KWMQA7
age: 5443
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 79Ng+aWyvXLHCbUxZoCgkv7Igv/dGK1iwRyelBXEGrkcsIP88J/tAywEqx421aWbw6mSBJhEDhvj+B9tOV2gpxfoSWu/VOLxS7kZo2dZs9g=
last-modified: Tue, 14 May 2024 08:09:49 GMT
server: cloudflare
etag: W/"9d7447e4563704f08ec5328b5114e6f8"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5530b0a9730-FRA
expires: Wed, 14 May 2025 09:45:56 GMT

GET
H2 200 3057.5e22bbb0.js Show response
cdn-client.medium.com/lite/static/js/ 659 KB
207 KB 50ms
41ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9d4cacc612c452bdcc10a085e37f00f77d8863cb1e8fe669ca02c1156f2cb712

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:56 GMT
x-amz-version-id: 8U1kFgMJlUNmH8qkZNp1xniyDYQNS3lm
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: ZGDCJN5V5GJC38XJ
age: 661026
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: VSmYt5YKd8NCsoN1Fgbgor/JlUVlolvqmSvep6GIb2wExVldM64YEShk74SP/0otxz1PwJyfbpI=
last-modified: Thu, 19 Oct 2023 20:38:07 GMT
server: cloudflare
etag: W/"5cf73b47b8f9468e48683b2d39073bf2"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5530b0f9730-FRA
expires: Wed, 14 May 2025 09:45:56 GMT

GET
H2 200 main.117f5a1f.js Show response
cdn-client.medium.com/lite/static/js/ 767 KB
182 KB 37ms
28ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/main.117f5a1f.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d241bcca74b06405027382daea54f2e46544c82a2a96e6177e3b56218933a303

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:56 GMT
x-amz-version-id: EBgwaQp7IrkcQhXmZ1BOgR2na9WZtZIR
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: GD0FRQPTF0GCW765
age: 5450
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: gkQ9CszmpMsw+6CdmNKjQNYdkH+hMRzGJQiUmsU0n8lfeE//hnaqczzX28+Md7nFeyuoVpIgAK8=
last-modified: Tue, 14 May 2024 08:09:43 GMT
server: cloudflare
etag: W/"1a51d4857abf12c9ea7d71251c2712e0"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5530b0c9730-FRA
expires: Wed, 14 May 2025 09:45:56 GMT

GET
H2 200 instrumentation.7c58a71f.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 3 KB
2 KB 39ms
31ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/instrumentation.7c58a71f.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1d40ba6bcffd2d51735ad266bbcea130205c2560e34f60d204feed40bce804cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:56 GMT
x-amz-version-id: UX__5BGcNKiUoyDiu_x5KKgrlZdf_eFZ
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: 6FCMQQWV38R17RN7
age: 673178
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: QprA4aLLmiPr/GAiOQPv0BmtIZ73ADH5wuKceozbL7RNVzpXiGkPRA95m0qGBFwm1SV9m1By5NY=
last-modified: Tue, 06 Feb 2024 14:42:19 GMT
server: cloudflare
etag: W/"88ef7fedb2a5e4fc8f183b27a7395553"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5530b0d9730-FRA
expires: Wed, 14 May 2025 09:45:56 GMT

GET
H2 200 reporting.2021fe63.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 1 KB
1 KB 36ms
28ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/reporting.2021fe63.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3e114382d20a02d0ca050b5fb41beeeb8d1c63762fa2f2e2b75557a48117d365

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:56 GMT
x-amz-version-id: EAFtMMjOBNpoIMOAp_mjLfH0fLlmjqvd
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: GV4RFK8T778MPWRB
age: 488745
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 5O9oMi95fSwEDWCCoW/zAbpOECZr9PABcx2Hl854ytyXkFtFOiINgxMvNUEYKVN/c30Ona2aU9I=
last-modified: Fri, 23 Jun 2023 16:13:42 GMT
server: cloudflare
etag: W/"4f45b39c86a2eb9ca7068099b34d3af6"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5530b119730-FRA
expires: Wed, 14 May 2025 09:45:56 GMT

GET
H2 200 6068.e9093f2e.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 5 KB
1 KB 41ms
33ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/6068.e9093f2e.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5a1aa5b3fe12402794e0a8981461a9a908a62d6fdea536e669147fc38bfc7be5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:56 GMT
x-amz-version-id: LaFo2b5tnj4iD0imA.cXIy7d6iZ0jIMl
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: 95J23EWMJK2FNTSV
age: 488742
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: +ulmYgc54yw1+m/I7RzZyOAsSbh/gqTheiaj3R7cNIvuT8YbzRSfj42XDzowJ2D+ovdR8mH53pQ=
last-modified: Thu, 19 Oct 2023 20:38:11 GMT
server: cloudflare
etag: W/"e18bffffe340e41dc3b596cf1d9b13ee"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5530b0b9730-FRA
expires: Wed, 14 May 2025 09:45:56 GMT

GET
H2 200 4398.db4d4378.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 7 KB
3 KB 47ms
37ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/4398.db4d4378.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

25b283a69fdffec5aed19ca2a40b67f490744d4e28d1b41b14f78c7c3ca85304

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: nD1Ekxpw41hmPZGu8aCR69Fn6l56BS19
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: 710GYJMZMX9T7NGZ
age: 493385
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: sjqpdMVqjBfESWRs5xhG/mIWiF7BOMIkvwN/mtgjm/eW0hArhYoO6C+eqOMXw5Mx3WX33F6rPgg=
last-modified: Wed, 10 Jan 2024 23:43:40 GMT
server: cloudflare
etag: W/"2a9a8cc3a5c7456e93ac9fd0734d8562"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b4e9730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 7883.0e445e04.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 22 KB
10 KB 44ms
35ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/7883.0e445e04.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5e45ce783ff6f2159c09545f4a3a53cfd8aa6588e53ab2e3dc894b69048128e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: Xo3CN7D2L9evtWunaTa_wVLneZe0Q4Yq
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: 8KYM4MHTQKDCMD9W
age: 803129
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: fNZkOgaWJrlpH87uGAnN1GiWmY4r91pQ73zYpJWJeXH9JNggIbCrlNcDD1CLQdZ0wr9pFg8HI5M=
last-modified: Mon, 05 Feb 2024 14:32:27 GMT
server: cloudflare
etag: W/"ff460fdd31cf043a5b0c5480db3156c6"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b529730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 9281.e9be8bce.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 9 KB
4 KB 89ms
82ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/9281.e9be8bce.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e30251f4e625a346addb5cd29524310cad04a944b047d53d00e0bd15f0dcca25

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: ZC099pBtAGAPaBMRHC22KXEADdiotpwP
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: D0NH4C9DTFG2FHKW
age: 500537
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 374LUte9WuAG6PjD3XX9QlKbRptG0+XpBg+MSeUgYSvt7pKy9/s1byCEn4FbSLufMcVsBgRqpeo=
last-modified: Tue, 09 Apr 2024 19:40:27 GMT
server: cloudflare
etag: W/"d036e5d86dbf699f79f51c8a9dc04532"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b549730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 7111.1421aaa2.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 7 KB
3 KB 37ms
30ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/7111.1421aaa2.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1a6cbbdaa0b959307ba67e74ce267275aa92a1f87cfc93dbefc0764d5ae8941b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: oCAN1Fbk_r6xaqWFhwwGOkdwKL93xICQ
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: KDE1VBEZ076AD1A8
age: 500537
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: MbNfkah3ZnqV4qaFFb/yt3imZh6ArbXdzS21tAdMJ589B3oZ9XfYzbt1CWoezciCs5sEpd6xE1k=
last-modified: Tue, 09 Apr 2024 19:40:25 GMT
server: cloudflare
etag: W/"f594e86062b1fd714d40c53cbc0b0940"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b559730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 6481.e3e8b67f.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 8 KB
3 KB 37ms
30ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/6481.e3e8b67f.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0542522e26b3c85fadd39128924793acb6e26c6f7b345c7733880416f24f07e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: JXzYquxmIfniMyFyZpUbYc9NBEwvr7Zq
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: A2E2KH22MY587P4P
age: 412628
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: FcjNAlyXfZl42SS7heJ+6Qb7orM1mbEY3XoQDkOcv/YqI101YAIcWy60MhlOmMLx5eHxVnFmiZs=
last-modified: Fri, 05 Jan 2024 14:49:41 GMT
server: cloudflare
etag: W/"4e3ad2f9f4017e33094d1f9b3b5e5054"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b579730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 8695.17d1af21.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 14 KB
5 KB 34ms
28ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/8695.17d1af21.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9eb4c7dc433345d934580d935222c3541949ef90e2ac349f3058433536f8838a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: q.2aIoBF3uPjEj_QLivcgYFNk0C1T023
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: 6GP3ZWCA99Q8JK68
age: 8097
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: V+hNiD6OAG/agJZA9TiuDiZBCL6yuftexwVkQOlnvWOCZbcS+lW0f38xLWCVGyZyfSEiHo4DRVg=
last-modified: Fri, 29 Mar 2024 09:01:10 GMT
server: cloudflare
etag: W/"9ab4720c3105f613ea273600cca7b6cb"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b589730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 9662.114aae57.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 40 KB
10 KB 41ms
35ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/9662.114aae57.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

37b1cd98423d55b910185983e0802f45800fd0176378bbf08ebc739c9af24a83

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: NjQp305MAYBkeCIJ7f_jsHeJonSHWgB.
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: G4NA57TP715GVJR9
age: 575814
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: f4fjkAhbPL60BjLndfFUvTq/nRH/OqyK6gRweGtavXWiNIP8YLMD6TeZcFd+ig/whk6244dU9nY=
last-modified: Mon, 01 Apr 2024 17:38:27 GMT
server: cloudflare
etag: W/"4f9b9c5d269cbc14cf3011dde4dffdee"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b599730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 5971.c8339d3b.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 19 KB
6 KB 40ms
33ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/5971.c8339d3b.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a0a325be88b972585013651fda18724a2ff7469f00d0f6f4b53df397d6524b7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: 9xT.k4EToFvLChIzt.__M4euWjGiADkT
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: 2DKR7R1N3HJ9DWZF
age: 865893
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: b4UYdI+Qr5Ueb5QDGqU9F7+mduQQAoqfdmoE/O/hYwdFBXC63RrPDHhlQj9Br9I83U6nmJ7WnJw=
last-modified: Tue, 19 Mar 2024 16:48:04 GMT
server: cloudflare
etag: W/"d3d3819de10e10439898ca3d243d8db4"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b5a9730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 5514.97be1308.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 41 KB
12 KB 35ms
29ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/5514.97be1308.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8082adcdf85e9a5c03e5c75c81e99379545bb808dfd0749dba9afe5efb64215a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: Nq4IuFyT5nygAbobg8Q_Z1qjNZXUaInk
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: 63C1JPZF1ADKRH2T
age: 673179
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: JTkeA9Oe/sPiGCrK5rgy1/uyQKrLxUpVB4K52IEnOQLX4Fn+5OYr/MH5hVu11Uz8i4kbGXLAaqU=
last-modified: Thu, 02 May 2024 18:47:11 GMT
server: cloudflare
etag: W/"f9e4d0c9e2cdd87e6573a6f9471061f1"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b5b9730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 5203.910c275f.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 17 KB
4 KB 32ms
26ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/5203.910c275f.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bf9978c2c91389e720463eafc3bb9657cf083d33700345ff3bbcf13516d55ad5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: LQrJa.Fom2kY4JLefkSfUAXfAN53.dHq
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: 63CBYPKD43M6EY7D
age: 673179
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: xYmd875QrJoWib2DLQNLRs8pfREqUR7V/silmuLzche9pClE5tx46Zavsb/4YCi2cNOzScnvQQU=
last-modified: Thu, 02 May 2024 18:47:10 GMT
server: cloudflare
etag: W/"4f7c815febe93a73bd9f93c3bbbb3d1f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b5d9730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 7098.7bbb418a.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 22 KB
6 KB 40ms
34ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/7098.7bbb418a.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

08f75ca0d78df8b3d6cc3a12583d5fed5e026b7b5fe95a42c9147641daebb022

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: sHNLj.BEJCAGm27cm8gszetGWJlurSbl
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: KDE7YE52GG07RB89
age: 500478
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 1IjgEJWUVhwrxwS/oPHagsiTrby5LeqHC7P3HfENnz3gOGO5W47sKncHIQofF23IKtJs8JRnzPg=
last-modified: Tue, 09 Apr 2024 19:40:25 GMT
server: cloudflare
etag: W/"1300086f9495224aa4c7d4a0b99d2538"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b5e9730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 703.f98c7898.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 80 KB
20 KB 37ms
32ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/703.f98c7898.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89eeb58f8d431be9690a0ff7862fe51b24bacbe58ca0c8b305fbd09bf79c4ebf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: eObSFd9Uj9e8IATbnYRWCj0t0HoQZujE
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: QZACYD3M586K4VWH
age: 478031
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: SwHaiZ6O3wj1WDBNLLhGchxV1cWFoYfCJD9SzE5jnWTBa/kleb/YXPyJL+ooDFSb7DwDwqbjZAs=
last-modified: Wed, 08 May 2024 20:43:27 GMT
server: cloudflare
etag: W/"0589f7a6a8a4821bf98e5e6850afceea"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b609730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 1711.b70f1a35.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 23 KB
6 KB 47ms
42ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/1711.b70f1a35.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

93efcb5760c80b2b05a06369f841dec8894aec84f393f473d4a98c97d753637c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: an7lZshTbeizT4YvZ.H_UfpGSLFLVp6K
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: J178EJGERS581XHJ
age: 488751
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 1I0RZFqis3VUg39l18/zzES9x70K/pwfl3YWM9quPJZkzqvAzZXymSFOZhptZBXkE89qOgs7zSg=
last-modified: Tue, 12 Dec 2023 20:16:53 GMT
server: cloudflare
etag: W/"be9a7f1d16e66912ad5aca0b77f43879"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b649730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 8597.4e70742a.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 49 KB
12 KB 41ms
36ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/8597.4e70742a.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e038cccba02a42226d231671419c5c3951d9cf3ddf058399f6aa50d8cedfde98

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: gZqKXivzTdKf1SLQYZqNHJss_.DmSucw
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: AYWR8P4CFXNK55Z9
age: 575814
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: RLAcrYxQBjOT/cfOgVNWhL8gQY/5qsfTyaqz8ONJHybZ6y/k13as09XIUyb/ldf1ZrA945MympU=
last-modified: Thu, 02 May 2024 19:53:15 GMT
server: cloudflare
etag: W/"b4376e6077cb23eff4072c29bb4fa431"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b679730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 9174.244cf6ba.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 106 KB
26 KB 45ms
40ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/9174.244cf6ba.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b21dc1bcf715a87b6c3c1058c2c2d8774a981145e002606bc5dd09b488675e6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: kgqExzC34Rj1.j8XJyHseO20DtM8lDnQ
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: DQMSE4BTSDZFQ3NW
age: 434423
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: pvQukpzLYaDDahOYnpiRQv8jabuiIqgWtO1u2sj08K0gCvo/hHCfD1Eek2G6em6jARaB0vbuhpzu7Kq6AgNWYYocacvJCoRGi8TQO4tlTYY=
last-modified: Thu, 25 Apr 2024 08:12:09 GMT
server: cloudflare
etag: W/"32aa373a8e058ffd43c7953eee49e1cb"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b699730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 8883.c8b03d13.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 30 KB
10 KB 46ms
41ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/8883.c8b03d13.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6371dbf8600466f6a05a06c3372f54b5df5ea4ce7e2145571a7f72886d61d879

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: rqCBYLKOv.8NNDtk1ZWJs0i2M.e6fYOU
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: A5KCZS907K5DFF0J
age: 488748
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: RJVkotYaB2FyGbXmgxrtRavmwdovW3HtDFYuf8SuY2B9bmi1SXDVFFKcTWrxzS7KCiXxKz6mLCs=
last-modified: Wed, 01 Nov 2023 19:54:54 GMT
server: cloudflare
etag: W/"db9f4f034f186af2c5d3eb5b06d84be1"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b6a9730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 705.da9267d6.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 20 KB
6 KB 50ms
46ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/705.da9267d6.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e642f77d39f41e54dde2fc9d80f7a1fc301e1449bb29ff508bec5010b44d5ce0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: fn7BbKRjb_AgHVr_9Ad3Jgzg7yZ961PG
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: KDE0ABZZP5N9TT3X
age: 500478
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: ziJiEB1pHdfSLwzsSnVNLSyBc9SYFVl5xiUSET8UVbTo3hkZ6qLYw3mfQMS0M/VGhQYinRijRaM=
last-modified: Tue, 09 Apr 2024 19:40:25 GMT
server: cloudflare
etag: W/"3f04ddf7487e84f1a471cc080e286470"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b6c9730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 5781.39279ff8.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 11 KB
3 KB 42ms
38ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/5781.39279ff8.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

56ac267d35794f41b04ab64ffcaec0043ffd45882e05ad339beef8c80fe87d44

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: 9PVjTUtmbxlQhuvUgBk4KyRxxzSYQETg
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: 90SQ0GQ7WNQYSJEJ
age: 588475
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: t416FQcJ1za/xlVszO7dABOV03p/lR85w40v5QVtmshawk1hAGvMHnzr14ibK2LUNzTPRJ4ZMrg=
last-modified: Thu, 04 Apr 2024 17:23:26 GMT
server: cloudflare
etag: W/"7f0592bff4564bdb5b40b825677bacb5"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b6d9730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 8580.feeb2549.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 20 KB
2 KB 43ms
38ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/8580.feeb2549.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ab4e6c77ee5e6178222bb7deefc0c6d5b0e2b3ab2df5d8623da00840809e639d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: zzAbVdzU1EHaoBWemZXYawSAaPKOliQq
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: CVDXW2ZGRRZW8RPG
age: 1089118
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 8+iN6W7H7MsTkXDNvzxacUh1VwoxkU/FbKqE6kP0wzu5dm55IYrp6t8RRVSskYPQ6e0fhhlk8Qc=
last-modified: Thu, 19 Oct 2023 20:38:14 GMT
server: cloudflare
etag: W/"807d78fe3a15361dfb7d56b056c4ff12"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b709730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 6046.f9be485b.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 23 KB
6 KB 51ms
46ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/6046.f9be485b.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

806ff1a7e5be16f7da7ea06a745c2b53ebd0f945c019b410095598af64271035

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: 0_Vn4xVFZ352xWQ1tzX5OTAFkS2JUuWa
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: 90SSSYQC8QRSENRA
age: 327611
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: Ge08vIU8SUopH0mtjw4bPPyXZgbGEB2dN5c5wFMSr24vmUCr8PPYuj97z7630lZlOJZxNmSWShA=
last-modified: Tue, 09 Apr 2024 14:12:43 GMT
server: cloudflare
etag: W/"c861691b79d5daf39e5466e7a37fdb78"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b719730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 1525.dc069e3a.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 10 KB
3 KB 46ms
42ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/1525.dc069e3a.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

71a5b0e4b3c21b05ecc4ee56b0ba4d994a67d75e6a308488e440aea2ddd84b63

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: EjzRYSo2kix1Vn2Ecso_h8F39PYkA.S4
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: AYWZFD9VM1A1PRTX
age: 575814
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: dmkCh3GNt5GiApTrra6lbz1s5T1mUml+lsX0XNBBjbDacjMoQyUG5bKzm8z5iMQX0Kg3/q+cCBs=
last-modified: Thu, 02 May 2024 19:53:09 GMT
server: cloudflare
etag: W/"f25f868150647462ab18e17395605334"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b729730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 500.596a9584.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 46 KB
15 KB 52ms
48ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/500.596a9584.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bfb9ec6177c317438a795f4f3da343dee02074bdcf9a5ce348b11568f06d367d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: FqhDx523P.XI8E.kvqrp16QrICzgfPXo
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: DQMQWMPKDYYARGBE
age: 434423
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: b4jHsBIztHM0cBb8XLtlmzkXFy77XM6xPc5mCu901zCK0xSzfVP3WrWjYrzJuAiIYgwtsGk6T7c=
last-modified: Thu, 25 Apr 2024 08:12:06 GMT
server: cloudflare
etag: W/"bfa05dbf5cd8ba5dbc9010939135010c"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b749730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 9408.93ecc1af.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 15 KB
4 KB 51ms
47ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/9408.93ecc1af.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6a2ac58e1e20601fba10519341f603b3deb8c3bc14a68302998c56f28668316c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: UKpgcBB1JCHIbYOK4lWnqli..azSFTdA
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: AYWTC8C32KP1S7WW
age: 575814
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: st3bkWDQqRMLMkizPWoukE8eY8xJ2OtZNc5QYhoJZM/VjGzgXHzLA1tfpKgIdGf+ov3W6idYSh0=
last-modified: Thu, 02 May 2024 19:53:16 GMT
server: cloudflare
etag: W/"030922dfd0fb3afc145d6514bb5c9c4a"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b769730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 6605.84e81b15.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 8 KB
3 KB 58ms
54ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/6605.84e81b15.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cdcc2fc364294f2d085517c4a3cbc74ba496b2755f6a971813a6d9faf052d776

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: WlMpWRuAPHQ42f150ntsZh022kw9wkR2
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: CNVT9Z9FDWAG9PFD
age: 492378
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: AAqtkeYn/n68p6aV3xFkAVJwup5n6XAjzeIfbay5iU09PoRh4khqPmE1NmdV0r7ZHLAG6y5qnqQ=
last-modified: Wed, 24 Apr 2024 16:27:27 GMT
server: cloudflare
etag: W/"902b48e179868b274d1be58d4fa06015"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b789730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 2790.1bf395da.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 40 KB
6 KB 48ms
44ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/2790.1bf395da.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

897f207ea7222df1c87f1b91b7b3e6c5670fd61a23a7a372700bca238e097757

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: Qbq79jgxBSsrHeoQ7A62l_JzJjPRzOsg
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: AYWRNGFXZZZBZ2Z9
age: 575814
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: usRPZxN+5VHvbvH7Wz1FEVPREDUwf4IHa+fgMLw1Q3raPi4suXiuSmf7R2DG6Tfq7LVwpeGvppzuwNeIYaHXnw==
last-modified: Thu, 02 May 2024 19:53:10 GMT
server: cloudflare
etag: W/"6097a7d092399d86d368efa16588554c"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b7a9730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 7421.3f94f5ea.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 23 KB
6 KB 44ms
40ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/7421.3f94f5ea.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

17274971fa3ac182df06276ac2ef7c98add2b2f17e9247145763334b4f5468cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: rxA8oRyIrw214l5JNS0od_ydV29pbj2L
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: ZRV2F13BNKA014X8
age: 575814
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: FFZ3RtDHgP9HB5fL3HQ0exKAlmM30tpjqGvOeCpZIi7fzruZbDz1mKXEJOoGrL4asv+6kQQg8iM=
last-modified: Tue, 09 Apr 2024 14:12:45 GMT
server: cloudflare
etag: W/"30321ceea236ffc21f79407e9c690f05"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b7e9730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 51.517a7c68.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 17 KB
4 KB 43ms
39ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/51.517a7c68.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a6fddab7778d9ffa8719ee184ed1c159bc70ddc6db003fcc9e0a26db50464b15

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: RneGddWEu2g7.0sri0_6dUNvarUwQb4G
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: AYWVTBRC88S1DK1D
age: 575814
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: YYAY/ugtmoKQ/izcAyAB1fD3HJ5k5G9bHUpsJGxdijwSzcUzneQdvnWQ7rRy3E97HExrRCNysJU=
last-modified: Fri, 03 May 2024 17:03:00 GMT
server: cloudflare
etag: W/"cb26b137927959f07f944987749e163f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b7f9730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 PostPage.MainContent.bf218724.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 157 KB
36 KB 47ms
43ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/PostPage.MainContent.bf218724.chunk.js

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e9af46296822a66b9b4ca0fb75361832947b9603d9695924f8f12ebe5916f184

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: lky5WdkW148V0Ani4CUGpSV8In6pfgXT
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: N4G9YNQKHETJ022P
age: 67415
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: JhGKEFVRC7sN+tFZV2XU9jS5SBigkRgrktFNedmBQSh2V74cBQxLfuQlw3lhLPqFX/jQ16vAEQc=
last-modified: Thu, 09 May 2024 15:01:40 GMT
server: cloudflare
etag: W/"ac3b266023ebbd79f690d28ab4b688c2"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5534b819730-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

POST
H2 200 /
blog.confiant.com/_/clientele/reports/performance/ 0
0 113ms
113ms Fetch
application/octet-stream 52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.confiant.com/_/clientele/reports/performance/
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.117f5a1f.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-225-124.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Medium-Clientele-Client: lite
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
medium-fulfilled-by: valencia/main-20240513-163228-daf81a340e, clientele/main-20240507-223507-a45e18f1bb
x-envoy-upstream-service-time: 15
sepia-upstream: medium
server: nginx
content-length: 0
content-type: application/octet-stream

GET
H3 200 2230.c546f16c.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 20 KB
8 KB 44ms
44ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/2230.c546f16c.chunk.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.0ea73aeb.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf9e6a6362e194c2e0d66aec3b1e207810fcd0eb794937c01e215478b29bc182

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: xWJf__tEGtfK6SYsYt3.b.Ctl1FYrL2e
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: 85VJM3V314JWTXB9
age: 497573
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: IXegUsVJFiW8N+jvCGcJMQ1i6PcaEnHnJxbGIZONqSETfXpgtrH/icMHvmv3j5tlIcMaDN6EdDk=
last-modified: Thu, 19 Oct 2023 20:38:05 GMT
server: cloudflare
etag: W/"5b5ebdea4bda0086b419f1dc8ca91a75"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f5575d7dbb86-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

POST
H2 200 /
blog.confiant.com/_/clientele/reports/performance/ 0
0 109ms
108ms Fetch
application/octet-stream 52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.confiant.com/_/clientele/reports/performance/
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.117f5a1f.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-225-124.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Medium-Clientele-Client: lite
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
medium-fulfilled-by: valencia/main-20240513-163228-daf81a340e, clientele/main-20240507-223507-a45e18f1bb
x-envoy-upstream-service-time: 11
sepia-upstream: medium
server: nginx
content-length: 0
content-type: application/octet-stream

GET
H3 200 GiveTipButton.7844a2d2.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 7 KB
3 KB 29ms
28ms Script
application/javascript 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/GiveTipButton.7844a2d2.chunk.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.0ea73aeb.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc5cb8bee960b5d5fd591fde3730e4d20198f53a4883b19f1a36d072b7f4e0a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
x-amz-version-id: 5wxFaPBbZuXVEH4zg8t9Fz46CDAnJYq7
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: CJ62WD4Q898WG2EE
age: 488752
x-amz-server-side-encryption: AES256
alt-svc: h3=":443"; ma=86400
x-amz-id-2: IVrWCYWvwXUgDj1tmKZOMMZcJjtCthP1H7NnYiTCimppg9Qh9Ql3gbG9sRFoViGi7SUAprzsTug=
last-modified: Thu, 19 Oct 2023 20:38:24 GMT
server: cloudflare
etag: W/"c9d3c6b5a486ea6dcc919c927917cf19"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 8839f557ee32bb86-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H3 200 gt-super-400-normal.woff
glyph.medium.com/font/4a44748/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 13 KB
13 KB 29ms
29ms Font
application/font-woff 2606:4700:7::a29f:9904
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/4a44748/0-3j_4g_53_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/gt-super-400-normal.woff

Requested by

Host: glyph.medium.com
URL: https://glyph.medium.com/css/unbound.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9904 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

40c05a07ac09c244b63a1755d524e094c32a18072335fb6cfc7f13da9cfe3eb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://glyph.medium.com/css/unbound.css
Origin: https://blog.confiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
age: 5322290
x-envoy-upstream-service-time: 29
alt-svc: h3=":443"; ma=86400
server: cloudflare
access-control-max-age: 86400
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
access-control-allow-credentials: true
vary: Accept-Encoding
cf-ray: 8839f5582eab9f2c-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Wed, 14 May 2025 09:45:57 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 263 KB
92 KB 55ms
30ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-7JY7T788PK

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a2a46d070a05f359694d6ba3612ad106b3491024725770a7cc6e83fe947d4970

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 93497
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 14 May 2024 09:45:57 GMT

GET
H3 200 enterprise.js Show response
www.google.com/recaptcha/ 2 KB
1004 B 39ms
20ms Script
text/javascript 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise.js?render=6Le-uGgpAAAAAPprRaokM8AKthQ9KNGdoxaGUvVp

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

b4867b87cc65d88836b62aacd94058491d9d60bb53dcdb0f31cd5d18ac84fbaa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Tue, 14 May 2024 09:45:57 GMT

GET
H2 200 branch-latest.min.js Show response
cdn.branch.io/ 75 KB
23 KB 44ms
8ms Script
text/javascript 108.138.26.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.branch.io/branch-latest.min.js
Requested by: Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.26.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-26-87.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d8c436394846ea20127a8db032f848015d4d239789429b7e0202609089b5525a

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: JdSJSDd4bnNFPjlwdZ2RC7ixUU_rrhPQ
content-encoding: gzip
via: 1.1 8dc3ccc34d68ee81173fff2a80f72bde.cloudfront.net (CloudFront)
date: Tue, 14 May 2024 09:41:48 GMT
last-modified: Wed, 10 Apr 2024 21:44:10 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P7
age: 250
etag: "f4ec9657a3dc111d088e2eca7b9796a4"
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age=300
content-length: 23431
x-amz-cf-id: Bs3-s3ONlR9Yx_SXWzXrnkd8DCO0ttprcf3VMgTnCqnWlv6uSYZNKg==

GET
H3 200 5c50caa54067fd622d2f0fac18392213bf92f6e2fae89b691e62bceb40885e74
miro.medium.com/v2/da:true/resize:fit:0/ 300 KB
300 KB 46ms
46ms Image
image/png 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/v2/da:true/resize:fit:0/5c50caa54067fd622d2f0fac18392213bf92f6e2fae89b691e62bceb40885e74

Requested by

Host: blog.confiant.com
URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

67c2e60e6e47776cd0394b8dca668b89acaadee5198bbf9172a61ecc33dec97a

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
age: 493371
x-envoy-upstream-service-time: 149
content-disposition: inline; filename="5c50caa54067fd622d2f0fac18392213bf92f6e2fae89b691e62bceb40885e74.png"
alt-svc: h3=":443"; ma=86400
content-length: 306868
x-request-id: 4e0998d4-e9ba-4e7e-a3ec-89e403f44026
sepia-upstream: medium
server: cloudflare
etag: "_89iZTbMWFrDAXoszgLV1LA1pq4J7sBwEDXleeW4l1U/RIjIwZDEwN2Y4NjUyZGRjYWYzMDBkNGYxNjllNjMwODQ5Ig"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240226-230532-797fb80223
accept-ranges: bytes
cf-ray: 8839f5581ddb3719-FRA
expires: Wed, 14 May 2025 09:45:57 GMT

POST
H2 200 graphql Show response
blog.confiant.com/_/ 129 B
426 B 164ms
163ms Fetch
application/json 52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.confiant.com/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-225-124.compute-1.amazonaws.com

Software

nginx /

Resource Hash

ea5f04688a268de1e7cba2e628c064d88b85423652bf9ecb44268fc7d6230a80

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
medium-frontend-route: post
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-platform: "Win32"
apollographql-client-name: lite
ot-tracer-sampled: true
sec-ch-ua-mobile: ?0
ot-tracer-traceid: 565a5693fb9f52bd
medium-frontend-path: /confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
graphql-operation: VisitorQuery
content-type: application/json
accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
medium-frontend-app: lite/main-20240514-080247-3e2dacb79f
apollographql-client-version: main-20240514-080247-3e2dacb79f
ot-tracer-spanid: 575d86e77be8c247

Response headers

date: Tue, 14 May 2024 09:45:58 GMT
sepia-upstream: medium
server: nginx
etag: W/"81-q6BbKX3GoS9h5OxZtEpp2NxxhVU"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20240513-163228-daf81a340e, rito/main-20240513-163228-daf81a340e
x-envoy-upstream-service-time: 66
content-length: 129
x-xss-protection: 0
x-request-received-at: 1715679957952

POST
H2 200 graphql Show response
blog.confiant.com/_/ 80 B
375 B 129ms
129ms Fetch
application/json 52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.confiant.com/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-225-124.compute-1.amazonaws.com

Software

nginx /

Resource Hash

f6adb47c34f420ef114d5ecdb9b7daab2948c5e9c6d7e3441fee907e5a8fef3f

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
medium-frontend-route: post
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-platform: "Win32"
apollographql-client-name: lite
ot-tracer-sampled: true
sec-ch-ua-mobile: ?0
ot-tracer-traceid: 565a5693fb9f52bd
medium-frontend-path: /confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
graphql-operation: AvatarMenuQuery
content-type: application/json
accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
medium-frontend-app: lite/main-20240514-080247-3e2dacb79f
apollographql-client-version: main-20240514-080247-3e2dacb79f
ot-tracer-spanid: 575d86e77be8c247

Response headers

date: Tue, 14 May 2024 09:45:57 GMT
sepia-upstream: medium
server: nginx
etag: W/"50-uwdNQiS1cauYvMsRotgPVGuGSSE"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20240513-163228-daf81a340e, rito/main-20240513-163228-daf81a340e
x-envoy-upstream-service-time: 32
content-length: 80
x-xss-protection: 0
x-request-received-at: 1715679957957

POST
H2 200 graphql Show response
blog.confiant.com/_/ 1 KB
858 B 268ms
267ms Fetch
application/json 52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.confiant.com/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-225-124.compute-1.amazonaws.com

Software

nginx /

Resource Hash

3f4bc8db1b9a93c26b5e1f7b78f670ea23da2e321ee6ed9191aa24b414c8746b

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
medium-frontend-route: post
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-platform: "Win32"
apollographql-client-name: lite
ot-tracer-sampled: true
sec-ch-ua-mobile: ?0
ot-tracer-traceid: 565a5693fb9f52bd
medium-frontend-path: /confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
graphql-operation: ClapCountQuery
content-type: application/json
accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
medium-frontend-app: lite/main-20240514-080247-3e2dacb79f
apollographql-client-version: main-20240514-080247-3e2dacb79f
ot-tracer-spanid: 575d86e77be8c247

Response headers

date: Tue, 14 May 2024 09:45:58 GMT
content-encoding: gzip
sepia-upstream: medium
server: nginx
etag: W/"568-XaNbNWNanw5nZtG4oBq9BnNj9Ww"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20240513-163228-daf81a340e, rito/main-20240513-163228-daf81a340e, tutu/main-20240514-090737-278eef85d2
x-envoy-upstream-service-time: 169
x-xss-protection: 0
x-request-received-at: 1715679957962

POST
H2 200 graphql Show response
blog.confiant.com/_/ 210 B
533 B 271ms
271ms Fetch
application/json 52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.confiant.com/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-225-124.compute-1.amazonaws.com

Software

nginx /

Resource Hash

f9edf3e5c94804c9d17c66581d927de82a7921b7611973d3edfe79180627aa72

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
medium-frontend-route: post
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-platform: "Win32"
apollographql-client-name: lite
ot-tracer-sampled: true
sec-ch-ua-mobile: ?0
ot-tracer-traceid: 565a5693fb9f52bd
medium-frontend-path: /confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
graphql-operation: NewsletterV3ViewerEdge
content-type: application/json
accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
medium-frontend-app: lite/main-20240514-080247-3e2dacb79f
apollographql-client-version: main-20240514-080247-3e2dacb79f
ot-tracer-spanid: 575d86e77be8c247

Response headers

date: Tue, 14 May 2024 09:45:58 GMT
sepia-upstream: medium
server: nginx
etag: W/"d2-jQS7pDGkTkzIxWGg0ReO1BWeKm4"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20240513-163228-daf81a340e, rito/main-20240513-163228-daf81a340e, tutu/main-20240514-090737-278eef85d2
x-envoy-upstream-service-time: 171
content-length: 210
x-xss-protection: 0
x-request-received-at: 1715679957976

POST
H2 200 graphql Show response
blog.confiant.com/_/ 27 KB
6 KB 449ms
449ms Fetch
application/json 52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.confiant.com/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-225-124.compute-1.amazonaws.com

Software

nginx /

Resource Hash

c1d2a766d16705c24fe15351abb2db64a04ab173e8a9886bc5d7aa36d2ca8a78

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
medium-frontend-route: post
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-platform: "Win32"
apollographql-client-name: lite
ot-tracer-sampled: true
sec-ch-ua-mobile: ?0
ot-tracer-traceid: 565a5693fb9f52bd
medium-frontend-path: /confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
graphql-operation: MoreFromMediumRecircQuery
content-type: application/json
accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
medium-frontend-app: lite/main-20240514-080247-3e2dacb79f
apollographql-client-version: main-20240514-080247-3e2dacb79f
ot-tracer-spanid: 575d86e77be8c247

Response headers

date: Tue, 14 May 2024 09:45:58 GMT
content-encoding: gzip
sepia-upstream: medium
server: nginx
etag: W/"6a88-FktRjKhCaR9WI7NKo+dWbsSJDYI"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20240513-163228-daf81a340e, rito/main-20240513-163228-daf81a340e, tutu/main-20240513-075253-d0dfcba1ca
x-envoy-upstream-service-time: 262
x-xss-protection: 0
x-request-received-at: 1715679958047

POST
H2 200 graphql Show response
blog.confiant.com/_/ 27 B
322 B 209ms
209ms Fetch
application/json 52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.confiant.com/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-225-124.compute-1.amazonaws.com

Software

nginx /

Resource Hash

706e568e0c4a22004a1c177674ae9489b5a3ca9f5a97e4addb3c626c03016548

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
medium-frontend-route: post
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-platform: "Win32"
apollographql-client-name: lite
ot-tracer-sampled: true
sec-ch-ua-mobile: ?0
ot-tracer-traceid: 565a5693fb9f52bd
medium-frontend-path: /confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
graphql-operation: ViewerQuery
content-type: application/json
accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
medium-frontend-app: lite/main-20240514-080247-3e2dacb79f
apollographql-client-version: main-20240514-080247-3e2dacb79f
ot-tracer-spanid: 575d86e77be8c247

Response headers

date: Tue, 14 May 2024 09:45:58 GMT
sepia-upstream: medium
server: nginx
etag: W/"1b-zcE2qsOE110W+7rHoTa9C+cwT68"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20240513-163228-daf81a340e, rito/main-20240513-163228-daf81a340e
x-envoy-upstream-service-time: 19
content-length: 27
x-xss-protection: 0
x-request-received-at: 1715679958050

POST
H2 200 graphql Show response
blog.confiant.com/_/ 79 B
375 B 225ms
225ms Fetch
application/json 52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.confiant.com/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-225-124.compute-1.amazonaws.com

Software

nginx /

Resource Hash

52d25ab4a53674b721be8fa2983c6b0f2b6821618f6d4fbc3472fec02b5e67d0

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
medium-frontend-route: post
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-platform: "Win32"
apollographql-client-name: lite
ot-tracer-sampled: true
sec-ch-ua-mobile: ?0
ot-tracer-traceid: 565a5693fb9f52bd
medium-frontend-path: /confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
graphql-operation: LogGateExposure
content-type: application/json
accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
medium-frontend-app: lite/main-20240514-080247-3e2dacb79f
apollographql-client-version: main-20240514-080247-3e2dacb79f
ot-tracer-spanid: 575d86e77be8c247

Response headers

date: Tue, 14 May 2024 09:45:58 GMT
sepia-upstream: medium
server: nginx
etag: W/"4f-PyDyq/vz3tkRgbZXHMnLXcJrsR4"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20240513-163228-daf81a340e, rito/main-20240513-163228-daf81a340e
x-envoy-upstream-service-time: 37
content-length: 79
x-xss-protection: 0
x-request-received-at: 1715679958058

POST
H2 200 graphql Show response
blog.confiant.com/_/ 79 B
375 B 214ms
213ms Fetch
application/json 52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.confiant.com/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-225-124.compute-1.amazonaws.com

Software

nginx /

Resource Hash

52d25ab4a53674b721be8fa2983c6b0f2b6821618f6d4fbc3472fec02b5e67d0

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
medium-frontend-route: post
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-platform: "Win32"
apollographql-client-name: lite
ot-tracer-sampled: true
sec-ch-ua-mobile: ?0
ot-tracer-traceid: 565a5693fb9f52bd
medium-frontend-path: /confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
graphql-operation: LogGateExposure
content-type: application/json
accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
medium-frontend-app: lite/main-20240514-080247-3e2dacb79f
apollographql-client-version: main-20240514-080247-3e2dacb79f
ot-tracer-spanid: 575d86e77be8c247

Response headers

date: Tue, 14 May 2024 09:45:58 GMT
sepia-upstream: medium
server: nginx
etag: W/"4f-PyDyq/vz3tkRgbZXHMnLXcJrsR4"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20240513-163228-daf81a340e, rito/main-20240513-163228-daf81a340e
x-envoy-upstream-service-time: 26
content-length: 79
x-xss-protection: 0
x-request-received-at: 1715679958052

POST
H2 200 graphql Show response
blog.confiant.com/_/ 96 B
418 B 421ms
421ms Fetch
application/json 52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.confiant.com/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-225-124.compute-1.amazonaws.com

Software

nginx /

Resource Hash

f31a687147bb24fd2f746b73e0a03bc3a20012d1b0218a457ac02602a110de07

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
medium-frontend-route: post
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-platform: "Win32"
apollographql-client-name: lite
ot-tracer-sampled: true
sec-ch-ua-mobile: ?0
ot-tracer-traceid: 565a5693fb9f52bd
medium-frontend-path: /confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
graphql-operation: InteractivePostBodyQuery
content-type: application/json
accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
medium-frontend-app: lite/main-20240514-080247-3e2dacb79f
apollographql-client-version: main-20240514-080247-3e2dacb79f
ot-tracer-spanid: 575d86e77be8c247

Response headers

date: Tue, 14 May 2024 09:45:58 GMT
sepia-upstream: medium
server: nginx
etag: W/"60-psdEAmUV3nAeakTOBiVfQpI+Lpg"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20240513-163228-daf81a340e, rito/main-20240513-163228-daf81a340e, tutu/main-20240514-090737-278eef85d2
x-envoy-upstream-service-time: 146
content-length: 96
x-xss-protection: 0
x-request-received-at: 1715679958141

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/vjbW55W42X033PfTdVf6Ft4q/ 505 KB
202 KB 47ms
7ms Script
text/javascript 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/vjbW55W42X033PfTdVf6Ft4q/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise.js?render=6Le-uGgpAAAAAPprRaokM8AKthQ9KNGdoxaGUvVp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a624368de63b32a27d36d8032e5e1bfe03a5e738338493aa0dfc4938d9cd3c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Origin: https://blog.confiant.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:02:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2606
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 206091
x-xss-protection: 0
last-modified: Sun, 05 May 2024 20:00:16 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 14 May 2025 09:02:31 GMT

GET
H2 200 _r Show response
app.link/ 91 B
640 B 211ms
173ms Script
text/javascript 2600:9000:2057:6200:19:9934:6a80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://app.link/_r?sdk=web2.85.0&branch_key=key_live_ofxXr2qTrrU9NqURK8ZwEhknBxiI6KBm&callback=branch_callback__0

Requested by

Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2057:6200:19:9934:6a80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

openresty /

Resource Hash

777c3d595809c290ac8a2ca2413e0145808602227bdb57002df97ca76a27659a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
via: 1.1 04599a8a3c6eb66f23e5ae02d1ec4cf2.cloudfront.net (CloudFront)
server: openresty
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Model
x-amz-cf-pop: FRA6-C1
etag: W/"5b-pZl6sZJ5QFEafyOkaYOIHtgmm44"
x-cache: Miss from cloudfront
content-type: text/javascript; charset=utf-8
content-length: 91
x-amz-cf-id: kOP5RNAGjue9J1BPLBrxK4MOduywx5LERLNEAUCoa8i6mmQDzBdR6Q==

POST
H2 204 collect
region1.google-analytics.com/g/ 0
256 B 39ms
14ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-7JY7T788PK&gtm=45je45d0v9123887712za200&_p=1715679957767&gcd=13l3lPl2l1&npa=1&dma_cps=sypham&dma=1&cid=1993871478.1715679958&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B124.0.6367.201%7CGoogle%2520Chrome%3B124.0.6367.201%7CNot-A.Brand%3B99.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&frm=0&pscdl=noapi&_s=1&sid=1715679957&sct=1&seg=0&dl=https%3A%2F%2Fblog.confiant.com%2Fconfiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202&dt=Confiant%20%26%20Malwarebytes%20Uncover%20Steganography%20Based%20Ad%20Payload%20That%20Drops%20Shlayer%20Trojan%20On%20Mac%20Users%20%7C%20by%20Eliya%20Stein%20%7C%20Confiant&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2516
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-7JY7T788PK
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 14 May 2024 09:45:58 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blog.confiant.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 graphql Show response
blog.confiant.com/_/ 81 B
377 B 175ms
174ms Fetch
application/json 52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.confiant.com/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-225-124.compute-1.amazonaws.com

Software

nginx /

Resource Hash

8d77856f82e0d7f87dd11d8bd8fd214ef515b13a49b9b1bbe99dc2ce1de0eef7

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
medium-frontend-route: post
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-platform: "Win32"
apollographql-client-name: lite
ot-tracer-sampled: true
sec-ch-ua-mobile: ?0
ot-tracer-traceid: 565a5693fb9f52bd
medium-frontend-path: /confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
graphql-operation: PostGiveTipOnExternalPlatformQuery
content-type: application/json
accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
medium-frontend-app: lite/main-20240514-080247-3e2dacb79f
apollographql-client-version: main-20240514-080247-3e2dacb79f
ot-tracer-spanid: 575d86e77be8c247

Response headers

date: Tue, 14 May 2024 09:45:58 GMT
sepia-upstream: medium
server: nginx
etag: W/"51-xJ9AiNQDoDLYxg66BlUhydvgDJE"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20240513-163228-daf81a340e, rito/main-20240513-163228-daf81a340e
x-envoy-upstream-service-time: 40
content-length: 81
x-xss-protection: 0
x-request-received-at: 1715679958143

GET
H3 200 anchor
www.google.com/recaptcha/enterprise/ Frame A762 0
0 31ms
18ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Le-uGgpAAAAAPprRaokM8AKthQ9KNGdoxaGUvVp&co=aHR0cHM6Ly9ibG9nLmNvbmZpYW50LmNvbTo0NDM.&hl=de&v=vjbW55W42X033PfTdVf6Ft4q&size=invisible&cb=jqlqffuxuwah

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/vjbW55W42X033PfTdVf6Ft4q/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-jT3d6wMt6ROIseVBTTAD1g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-jT3d6wMt6ROIseVBTTAD1g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 14 May 2024 09:45:58 GMT
expires: Tue, 14 May 2024 09:45:58 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

POST
H2 200 open Show response
api2.branch.io/v1/ 316 B
709 B 207ms
172ms XHR
application/json 2600:9000:2491:6000:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.branch.io/v1/open

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2491:6000:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

/ Branch

Resource Hash

f6700f6e300ced28f3eb71fa8dc97dc9bc0de032dbac2480de32da7022946b70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 14 May 2024 09:45:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 6e5ec1ef7875ec0751cb61200df7f212.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
x-powered-by: Branch
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
x-branch-request-id: 83a21527-b4be-4bad-8fd5-b15814a50621-2024051409
content-length: 316
x-amz-cf-id: Gx6RjdvBzrTu62NBEq1QIs7o-8wrSFZimPsZ-MDZqZfNvLIV6-mQkA==

POST
H2 200 /
blog.confiant.com/_/clientele/reports/performance/ 0
0 111ms
109ms Fetch
application/octet-stream 52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.confiant.com/_/clientele/reports/performance/
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.117f5a1f.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-225-124.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Medium-Clientele-Client: lite
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:58 GMT
medium-fulfilled-by: valencia/main-20240513-163228-daf81a340e, clientele/main-20240507-223507-a45e18f1bb
x-envoy-upstream-service-time: 13
sepia-upstream: medium
server: nginx
content-length: 0
content-type: application/octet-stream

GET
H3 200 1*5H-tJYt9fYssXADwuNM0qg.png
miro.medium.com/v2/resize:fill:128:128/ 19 KB
19 KB 31ms
31ms Other
image/png 2606:4700:7::a29f:9804
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://miro.medium.com/v2/resize:fill:128:128/1*5H-tJYt9fYssXADwuNM0qg.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:7::a29f:9804 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6acb9ae37ae2a1599dc575245e9aeeca352b19afafb0e3412b3594da4f62d0c5

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:45:58 GMT
content-security-policy: script-src 'none'
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=15552000; includeSubDomains; preload
age: 80381
x-envoy-upstream-service-time: 64
content-disposition: inline; filename="1*5H-tJYt9fYssXADwuNM0qg.png"
alt-svc: h3=":443"; ma=86400
content-length: 19138
x-request-id: cff590ac-5e26-4976-bca2-9aefda391ac0
sepia-upstream: medium
server: cloudflare
etag: "XwMNYH4h2oyItA_164WNgGIa41cTvCU2G4H9EIfTYHw/RImU0N2ZhZDI1OGI3ZDdkOGIyYzVjMDBmMGI4ZDMzNGFhIg"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
medium-fulfilled-by: miro-v2/main-20240507-223507-a45e18f1bb
accept-ranges: bytes
cf-ray: 8839f55c3b593719-FRA
expires: Wed, 14 May 2025 09:45:58 GMT

POST
H2 200 graphql Show response
blog.confiant.com/_/ 3 KB
802 B 226ms
226ms Fetch
application/json 52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.confiant.com/_/graphql

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-4-225-124.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e397830529cca4a3acbd6257cc78d69a3694943cb048160ff065be1cb6c9f341

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
medium-frontend-route: post
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-platform: "Win32"
apollographql-client-name: lite
ot-tracer-sampled: true
sec-ch-ua-mobile: ?0
ot-tracer-traceid: 565a5693fb9f52bd
medium-frontend-path: /confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
graphql-operation: ClapCountQuery
content-type: application/json
accept: */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
medium-frontend-app: lite/main-20240514-080247-3e2dacb79f
apollographql-client-version: main-20240514-080247-3e2dacb79f
ot-tracer-spanid: 575d86e77be8c247

Response headers

date: Tue, 14 May 2024 09:45:58 GMT
content-encoding: gzip
sepia-upstream: medium
server: nginx
etag: W/"da5-kv2nXNRorAFdUMQeaDwCSsCY59Q"
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: valencia/main-20240513-163228-daf81a340e, rito/main-20240513-163228-daf81a340e, tutu/main-20240514-090737-278eef85d2
x-envoy-upstream-service-time: 129
x-xss-protection: 0
x-request-received-at: 1715679958775

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
350 B 203ms
203ms XHR
application/json 2600:9000:2491:6000:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.branch.io/v1/pageview

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2491:6000:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

/ Branch

Resource Hash

a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 14 May 2024 09:45:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 6e5ec1ef7875ec0751cb61200df7f212.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
x-powered-by: Branch
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: S4369IqlExiZMemx4MPqh48s30n72MEsIBBbdJhRWIYAl4x7Ar63Yg==

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
351 B 208ms
182ms XHR
application/json 2600:9000:2491:6000:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.branch.io/v1/pageview

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/3057.5e22bbb0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2491:6000:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

/ Branch

Resource Hash

a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 14 May 2024 09:45:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 6e5ec1ef7875ec0751cb61200df7f212.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P7
x-powered-by: Branch
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: 7LvYjcXdq9gKhQqvivFxdpT6yR1ZzAxmq6zY8eKnYceXM0B0EV5vdw==

POST
H2 200 batch Show response
blog.confiant.com/_/ 17 B
172 B 139ms
138ms Fetch
application/json 52.4.225.124
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.confiant.com/_/batch
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.117f5a1f.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.4.225.124 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-225-124.compute-1.amazonaws.com
Software: nginx /
Resource Hash: f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
x-xsrf-token: 1
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
content-type: application/json
Referer: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 09:46:02 GMT
medium-fulfilled-by: valencia/main-20240513-163228-daf81a340e
x-envoy-upstream-service-time: 38
sepia-upstream: medium
server: nginx
content-length: 17
content-type: application/json

Verdicts & Comments Add Verdict or Comment

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.medium.com/	1970-01-21 06:10:39	Name: uid Value: lo_92dc8d9fa76c
.medium.com/	1970-01-21 06:10:39	Name: sid Value: 1:14gLN7C8IeTk5F26cLvDPoLA9EHZg0ayaLX2cPmSATo4Zd+Np3ASSiSnQMWZdeYX
blog.confiant.com/	1970-01-21 06:10:39	Name: uid Value: lo_92dc8d9fa76c
blog.confiant.com/	1970-01-21 06:10:39	Name: sid Value: 1:wKF3MD+GBoMdcNTGLI0ByxMGX1y+Y8eJlyKGnCgIgKVn6aEYTt++mu1eGkp2fJRz
blog.confiant.com/	1970-01-20 20:34:40	Name: _dd_s Value: rum=0&expire=1715680857664
.confiant.com/	1970-01-21 06:10:39	Name: _ga_7JY7T788PK Value: GS1.1.1715679957.1.0.1715679957.0.0.0
.confiant.com/	1970-01-21 06:10:39	Name: _ga Value: GA1.1.1993871478.1715679958
.app.link/	1970-01-21 05:20:15	Name: _s Value: 1%2B0qM%2FWNEGx2Jxi%2BVgk7F%2FQYm%2F9xybj3QSE12ghLg0UwI3hYAV9%2Fwe16v8iq7b0C

114 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
security	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: document.domain mutation is ignored because the surrounding agent cluster is origin-keyed.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 41) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 71) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 71) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 71) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 71) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 71) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202?gi=80e4e1d5387e(Line 71) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202(Line 71) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202(Line 71) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202(Line 71) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202(Line 71) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202(Line 71) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202(Line 71) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202(Line 71) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202(Line 71) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202(Line 71) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202(Line 71) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202(Line 71) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202(Line 71) Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://blog.confiant.com/confiant-malwarebytes-uncover-steganography-based-ad-payload-that-drops-shlayer-trojan-on-mac-cd31e885c202 Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://medium.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api2.branch.io
app.link
blog.confiant.com
cdn-client.medium.com
cdn.branch.io
glyph.medium.com
medium.com
miro.medium.com
region1.google-analytics.com
www.google.com
www.googletagmanager.com
www.gstatic.com
108.138.26.87
2001:4860:4802:34::36
2600:9000:2057:6200:19:9934:6a80:93a1
2600:9000:2491:6000:11:f728:3040:93a1
2606:4700:7::a29f:9804
2606:4700:7::a29f:9904
2a00:1450:4001:810::2003
2a00:1450:4001:830::2004
2a00:1450:4001:831::2008
52.4.225.124
0542522e26b3c85fadd39128924793acb6e26c6f7b345c7733880416f24f07e4
08f75ca0d78df8b3d6cc3a12583d5fed5e026b7b5fe95a42c9147641daebb022
0c4e595378a4c2585a1eb91b7f65ed0526940ed8fd37a31810cd1e2eb2920b12
150b6de63ddf61eb028ab34b8d7ed7a6fb7e512b752a80c6d5effdd966e85465
17274971fa3ac182df06276ac2ef7c98add2b2f17e9247145763334b4f5468cb
1a6cbbdaa0b959307ba67e74ce267275aa92a1f87cfc93dbefc0764d5ae8941b
1ca820b9aa7681184130d09157ea679d1d31390bee2af294c088f6dcaa24923b
1d40ba6bcffd2d51735ad266bbcea130205c2560e34f60d204feed40bce804cb
25b283a69fdffec5aed19ca2a40b67f490744d4e28d1b41b14f78c7c3ca85304
308202843db4c9ca5427bdf105b4bc75698dddcd7c071918cf64fd422785b2cb
37b1cd98423d55b910185983e0802f45800fd0176378bbf08ebc739c9af24a83
3e114382d20a02d0ca050b5fb41beeeb8d1c63762fa2f2e2b75557a48117d365
3f4bc8db1b9a93c26b5e1f7b78f670ea23da2e321ee6ed9191aa24b414c8746b
3f9de0ef524b7640f04530942b7beea102664734c2506a8d83e0389ab9d12a04
40c05a07ac09c244b63a1755d524e094c32a18072335fb6cfc7f13da9cfe3eb9
42f22529e38ed31f0c4d1ba7e56fd16ac9e41c8e338fc02afdda1b09f1ab735b
45dbf060ec052a3b0ca5ae7211eaa27c950db65b019aa456e1e686a85f8a327e
4a624368de63b32a27d36d8032e5e1bfe03a5e738338493aa0dfc4938d9cd3c0
52d25ab4a53674b721be8fa2983c6b0f2b6821618f6d4fbc3472fec02b5e67d0
5322e86e85f408fedf5c2dc62e11268a8c7da995b5dfdfed8655fdb40492b644
56ac267d35794f41b04ab64ffcaec0043ffd45882e05ad339beef8c80fe87d44
588e65ab7415cf5f79fc040e3de9e991dbba7d69b9eedce6128a434874fec62e
59be80adee0da9d87cf1e6e9692a64f26e38b5ada445206d65814ac9ed08320d
5a1aa5b3fe12402794e0a8981461a9a908a62d6fdea536e669147fc38bfc7be5
5e45ce783ff6f2159c09545f4a3a53cfd8aa6588e53ab2e3dc894b69048128e3
6371dbf8600466f6a05a06c3372f54b5df5ea4ce7e2145571a7f72886d61d879
65f0c65b5db3aa0568c7986479a4a3e909a05a84fb34ced48d70a2d628dd1444
67c2e60e6e47776cd0394b8dca668b89acaadee5198bbf9172a61ecc33dec97a
6a2ac58e1e20601fba10519341f603b3deb8c3bc14a68302998c56f28668316c
6acb9ae37ae2a1599dc575245e9aeeca352b19afafb0e3412b3594da4f62d0c5
706e568e0c4a22004a1c177674ae9489b5a3ca9f5a97e4addb3c626c03016548
71a5b0e4b3c21b05ecc4ee56b0ba4d994a67d75e6a308488e440aea2ddd84b63
777c3d595809c290ac8a2ca2413e0145808602227bdb57002df97ca76a27659a
78661d3e6871b6e5c37f3113d811cb3dfc69546449e3b2c28095b6e7f28d9a7d
806ff1a7e5be16f7da7ea06a745c2b53ebd0f945c019b410095598af64271035
8082adcdf85e9a5c03e5c75c81e99379545bb808dfd0749dba9afe5efb64215a
847a5694fa141acfc6fc76aad3e0dd4cc245582878d16d29acaab3089bac3d6e
897f207ea7222df1c87f1b91b7b3e6c5670fd61a23a7a372700bca238e097757
89eeb58f8d431be9690a0ff7862fe51b24bacbe58ca0c8b305fbd09bf79c4ebf
8d77856f82e0d7f87dd11d8bd8fd214ef515b13a49b9b1bbe99dc2ce1de0eef7
93efcb5760c80b2b05a06369f841dec8894aec84f393f473d4a98c97d753637c
9b2ab5dc97f7d5b72ffd3ab8102686c38e077936dc5b5a3a7eebf7f8f927995b
9d4cacc612c452bdcc10a085e37f00f77d8863cb1e8fe669ca02c1156f2cb712
9eb4c7dc433345d934580d935222c3541949ef90e2ac349f3058433536f8838a
a0a325be88b972585013651fda18724a2ff7469f00d0f6f4b53df397d6524b7f
a14d42d2a75c099d31b3c0458dc2fcb58b33b51cf043dd5884ccb36519c9d32e
a2a46d070a05f359694d6ba3612ad106b3491024725770a7cc6e83fe947d4970
a6fddab7778d9ffa8719ee184ed1c159bc70ddc6db003fcc9e0a26db50464b15
a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb
aa2dcb49178e613d7c504bf451d47354109e9dbd3cf5ad3c9e87896005398878
ab4e6c77ee5e6178222bb7deefc0c6d5b0e2b3ab2df5d8623da00840809e639d
aca180e889ce7fc4689b9d7abd6d8b17c5d628554739a887798a0069531e8c96
afbeace1e95d6a40b8e141947277e61b176f91811b17a4fc3e6cfc57de36b77f
b0f424bafe993b016ea96973894f95dfc4290608478a2d7d3fdd080d9b0a60d1
b21dc1bcf715a87b6c3c1058c2c2d8774a981145e002606bc5dd09b488675e6d
b4867b87cc65d88836b62aacd94058491d9d60bb53dcdb0f31cd5d18ac84fbaa
b5e77062d95b767a7c29e33b24cecca3bd747f58d8b3933749762064a3116c0e
bc9d1168ad6de4e0b3d3775c925a608617133a8e8b255e26b7a1c3e01fcc36c9
bf9978c2c91389e720463eafc3bb9657cf083d33700345ff3bbcf13516d55ad5
bfb9ec6177c317438a795f4f3da343dee02074bdcf9a5ce348b11568f06d367d
c1d2a766d16705c24fe15351abb2db64a04ab173e8a9886bc5d7aa36d2ca8a78
cdcc2fc364294f2d085517c4a3cbc74ba496b2755f6a971813a6d9faf052d776
cf9e6a6362e194c2e0d66aec3b1e207810fcd0eb794937c01e215478b29bc182
d241bcca74b06405027382daea54f2e46544c82a2a96e6177e3b56218933a303
d5d7947aa3e6131478a97f06e72913cb7b9e19161e03502ad1de3eb67f447213
d6c90ff7bddb2b437a4130fbfaad1dd6fdc87a532ed4a97b5a4484c659e632ee
d8c436394846ea20127a8db032f848015d4d239789429b7e0202609089b5525a
dc5cb8bee960b5d5fd591fde3730e4d20198f53a4883b19f1a36d072b7f4e0a0
e038cccba02a42226d231671419c5c3951d9cf3ddf058399f6aa50d8cedfde98
e204925855c2a1be11ebf53085b5f49d348e49e79a577c40eb75f9d36f7d6e71
e30251f4e625a346addb5cd29524310cad04a944b047d53d00e0bd15f0dcca25
e397830529cca4a3acbd6257cc78d69a3694943cb048160ff065be1cb6c9f341
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e642f77d39f41e54dde2fc9d80f7a1fc301e1449bb29ff508bec5010b44d5ce0
e9af46296822a66b9b4ca0fb75361832947b9603d9695924f8f12ebe5916f184
ea06b0266e95dda3e4ca749f4e3f058a059137b1016cb08f3ca9b3381c9e0f72
ea5f04688a268de1e7cba2e628c064d88b85423652bf9ecb44268fc7d6230a80
ede8711f2a9738e04e183938cae0c68728f1ce5f381c1829371d9048a5c195eb
f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4
f31a687147bb24fd2f746b73e0a03bc3a20012d1b0218a457ac02602a110de07
f6700f6e300ced28f3eb71fa8dc97dc9bc0de032dbac2480de32da7022946b70
f6adb47c34f420ef114d5ecdb9b7daab2948c5e9c6d7e3441fee907e5a8fef3f
f6add33bfd394e0535bbc9638a59b1c6268217c18bbbe81bfec0fa1cbf21f198
f90d19259478cca4381bea7e760845de9bcf2155ee96cd8b06049add894022d3
f9edf3e5c94804c9d17c66581d927de82a7921b7611973d3edfe79180627aa72

blog.confiant.com Open in urlscan Pro 52.4.225.124 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

91 Requests

100 %HTTPS

80 %IPv6

8 Domains

12 Subdomains

10 IPs

2 Countries

2832 kBTransfer

5278 kBSize

8 Cookies

86 Outgoing links

Page URL History

Redirected requests

91 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

blog.confiant.com Open in urlscan Pro
52.4.225.124 Public Scan

Screenshot
Live screenshot

Full Image

91
Requests

100 %
HTTPS

80 %
IPv6

8
Domains

12
Subdomains

10
IPs

2
Countries

2832 kB
Transfer

5278 kB
Size

8
Cookies

91 HTTP transactions
0 data transactions